Manageable One-Time Password for Consumer Applications

Abstract

One-time password (OTP) typically provides a better security protection than static password. However, a hindrance to consumer experience is the OTP manageability: users may need to store many secret values when they use OTP for authentication of distinct websites. In this paper, we extend the password generator technique to add the manageability to OTP authentication while retaining the computation and communication efficiency. Under the proposed scheme, a user, memorizing one password, can perform OTP authentication with various websites. Furthermore, the manageability for authentication servers is also improved, as the proposed scheme enables servers to infer the security status of client devices based on the received one-time passwords.