US 12,003,502 B2
Method, apparatus, and computer program product for secure two-factor authentication
Patrick G. Traynor, Gainesville, FL (US); Christian Peeters, Gainesville, FL (US); Christopher Patton, San Francisco, CA (US); Imani Sherman, Cincinnati, OH (US); Daniel Olszewski, Gainesville, FL (US); and Thomas Shrimpton, Gainesville, FL (US)
Assigned to UNIVERSITY OF FLORIDA RESEARCH FOUNDATION, INCORPORATED, Gainesville, FL (US)
Filed by UNIVERSITY OF FLORIDA RESEARCH FOUNDATION, INCORPORATED, Gainesville, FL (US)
Filed on Aug. 26, 2021, as Appl. No. 17/446,023.
Claims priority of provisional application 63/076,131, filed on Sep. 9, 2020.
Prior Publication US 2022/0078184 A1, Mar. 10, 2022
Int. Cl. H04L 9/40 (2022.01); H04W 4/14 (2009.01); H04W 12/0431 (2021.01); H04W 12/069 (2021.01)
CPC H04L 63/0838 (2013.01) [H04L 63/0435 (2013.01); H04L 63/166 (2013.01); H04W 4/14 (2013.01); H04W 12/0431 (2021.01); H04W 12/069 (2021.01); H04L 2463/082 (2013.01)] 15 Claims
OG exemplary drawing
 
1. An apparatus comprising at least one processor and at least one non-transitory memory including computer program code instructions, the computer program code instructions configured to, when executed, cause the apparatus to at least:
receive a request for registration for two-factor authentication from a client;
receive a username and password;
provide a request for a mobile device number in response to the username and password corresponding to an account;
receive the mobile device number and a pre-shared key;
send, to a mobile device corresponding to the mobile device number, an identity of the client and a server key share;
receive, from the mobile device, a device key share;
send information corresponding to an exchange with the mobile device and a challenge derived from the pre-shared key to the client in response to the device key share corresponding to the server key share;
receive, from the client, confirmation of registration with the mobile device;
establish a shared key in response to verification of the confirmation;
receive an access request including the username and password;
select a random string;
transmit the random string to the mobile device via short message service (SMS);
receive a one-time password from the mobile device derived from the random string, wherein the one-time password is derived by computing a Media Access Control (MAC) address and truncating the MAC address to obtain the one-time password; and
allow the access request in response to the one-time password corresponding to the random string based on the shared key.