One-time authorization code

How to Change the Authentication Method from SMS to GateKeeper ...

src: i.ytimg.com

Video One-time authorization code

Definition

In a broad sense, a one time authorization code (OTAC) means a code that is valid to authenticate a user`s identity for only one session. It is not only used in mechanisms to identify a user's identity in daily life, but also used in the field of computer technology, a desktop client for a web application might use an OTAC to securely authenticate with the web application.

Maps One-time authorization code

Benefits

Passwords that are continuously used in daily life or stored on the computer can easily be deciphered and compromised. The use of an OTAC removes the need for remembering/storing/caching the user's actual passwords.

This method of authenticating has two benefits:

The user's actual username/password is never transmitted over the network;
The user never has to remember/cache/store the username/passwords.

smart safe cash management solution, Anyteksys

src: www.buykorea.org

Usage

Mobile Phone

A mobile phone itself can be a hand-held authentication token. Mobile text messaging is the one of the ways of receiving an OTAC through a mobile phone. In this way, a service provider sends a text message that includes an OTAC enciphered by a digital certificate to a user for authentication. According to a report, mobile text messaging provides high security when it uses public key infrastructure (PKI) to provide bidirectional authentication and non-repudiation, in accordance with theoretical analysis.

Mobile text messaging as a method of receiving OTACs is broadly used in our daily lives for purposes such as banking, credit/debit cards, and security.

Telephone

There are two methods of using a telephone to verify a user's authentication.

With the first method, a service provider shows an OTAC on the computer or smart phone screen and then makes an automatic telephone call to a number which has already been authenticated. Then the user enters the OTAC that appears on their screen into the telephone keypad.

With the second method, which is used to authenticate and activate Microsoft Programmes, the user call a number which is provided by the service provider and enters the OTAC that the phone system gives the user.

Computer

In the field of computer technology, it is known that using one time authorization code (OTAC) through email, in a broad sense, and using one time authorization code (OTAC) through web-application, in a professional sense.

Email

An email is one of the common ways of using OTACs, there are two main methods used.

With the first method, a service provider sends a personalised one time URL link to an authenticated email address e.g. @ucl.ac.uk, when the user clicks the URL link the server authenticates the user.

With the second method, a service provider sends a personalised OTAC (e.g. an Enciphered token) to an authenticated email address, when the user types the OTAC into the website the server authenticates the user.

Application

The web application generates a unique code (pin) that the user can input into the desktop client, the desktop client in turn uses that code to authenticate itself to the web application.

This form of authentication is particularly useful in web applications that do not have an internal username/password store but instead use SAML for authentication. Since SAML only works within the browser, a desktop based web application client cannot successfully authenticate using SAML. Instead, the client application, can use the one time authorization code (OTAC) to authenticate itself to the web application.

In addition, it is possible to use the OAuth 2.0 authorization framework when a third party application needs to obtain limited access to an HTTP service.

Post

It is possible to send OTACs to a user via post or registered mail. When a user requests an OTAC, the service provider sends it via post or registered mail and then the user can use it for authentication. For example, in the UK, some banks send their OTAC for Internet banking authorization via post or registered mail.

VenCKi Code: OAuth with Meetup and PhoneGap

src: 4.bp.blogspot.com

Expansion

Quantum cryptography, which is based on the uncertainty principle is one of the ideal methods to produce an OTAC.

Moreover, it has been discussed and used not only using an enciphered code for authentication but also using Graphical one time PIN authentication such as QR code which provides decentralized access control technique with anonymous authentication.