Scribd Logo
Upload

Welcome to Scribd!

  • 69 views

    One Time Password Authentication Integration Approach: Indroduction

    Uploaded by

    puneet mishra
    This document discusses an approach for integrating one-time password authentication. It describes how two-factor authentication requires an extra login step of entering an OTP sent via SMS to the user's registered phone. It then discusses how OTPs are generated using the HMAC algorithm to prevent prediction of future codes from previous ones. The process involves the user entering their ID and password, triggering an OTP validation API call, generating and sending the OTP via SMS, prompting the user to enter the received OTP, and validating it for login.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    One Time Password Authentication Integration Approach: Indroduction

    Uploaded by

    puneet mishra
    69 views2 pages
    This document discusses an approach for integrating one-time password authentication. It describes how two-factor authentication requires an extra login step of entering an OTP sent via SMS to the user's registered phone. It then discusses how OTPs are generated using the HMAC algorithm to prevent prediction of future codes from previous ones. The process involves the user entering their ID and password, triggering an OTP validation API call, generating and sending the OTP via SMS, prompting the user to enter the received OTP, and validating it for login.

    Original Title

    OTP_Approach_Document.pdf

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses an approach for integrating one-time password authentication. It describes how two-factor authentication requires an extra login step of entering an OTP sent via SMS to the user's registered phone. It then discusses how OTPs are generated using the HMAC algorithm to prevent prediction of future codes from previous ones. The process involves the user entering their ID and password, triggering an OTP validation API call, generating and sending the OTP via SMS, prompting the user to enter the received OTP, and validating it for login.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    69 views2 pages

    One Time Password Authentication Integration Approach: Indroduction

    Uploaded by

    puneet mishra
    This document discusses an approach for integrating one-time password authentication. It describes how two-factor authentication requires an extra login step of entering an OTP sent via SMS to the user's registered phone. It then discusses how OTPs are generated using the HMAC algorithm to prevent prediction of future codes from previous ones. The process involves the user entering their ID and password, triggering an OTP validation API call, generating and sending the OTP via SMS, prompting the user to enter the received OTP, and validating it for login.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 2

    ONE TIME PASSWORD AUTHENTICATION INTEGRATION

    APPROACH
    Indroduction

    Two-factor authentication is just an extra layer of security for a user’s log in. That means that,
    after enabling two factor authentication, the user has to go through one more step to log in successfully.
    In most of the application SMS based method is used for each and every time the user logs in, they
    receive a text message to their registered phone number, which contains a One Time Password.

    Now after every login operation, we need to check if this particular user has 2-factor
    authentication enabled. If it is enabled, then we ask for the one time password displayed in the phone
    application. And if that typed code is correct, only then is the user authenticated.

    Approaches for generation of OTP

    One-Time Passwords (OTP) can provide complete protection of the login-time authentication
    mechanism against replay attacks. A one-time password (OTP) is a password that is valid for only one
    login session or transaction. OTPs avoid a number of shortcomings that are associated with traditional
    (static) passwords.

    The most important shortcoming that is addressed by OTPs is that, in contrast to static
    passwords, they are not vulnerable to replay attacks. This means that a potential intruder who manages
    to record an OTP that was already used to log into a service or to conduct a transaction will not be able
    to abuse it, since it will be no longer valid On the downside, OTPs are difficult for human beings to
    memorize.Therefore they require additional technology to work.

    We have used the HMAC algorithm for OTP generation. This is necessary because otherwise, it
    would be easy to predict future OTPs by observing previous ones.
    The user enters the user id and password in the finacle login screen then clicks the login button,
    the webserver will get the request and OTP validation purpose custom finacle core API will get triggered
    then the request will be passed to finacle core application and we will get the user registered mobile
    number and required information.

    Once finacle core application provides a success response then OTP will get generated and the
    webserver will send OTP to SMS provider gateway.

    The SMS gateway provider will send the OTP to the user registered mobile number and once
    SMS is delivered successfully from SMS gateway provider to mobile number then at the same time user
    receives a popup screen for entering OTP. Its mandatory for 2-factor authentication purpose .

    After receiving the OTP, the user has to enter the OTP in the popup screen and confirm then the
    webserver will validate user-entered OTP is valid or invalid.The OTP is invalid then the user receives the
    message saying that OTP is invalid otherwise user will get finacle successful login screen.

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy