One Time Password

One-time password systems provide a mechanism for logging on to a network or service using a unique password which can only be used once, as the name suggests. This prevents some forms of identity theft by making sure that a captured user name/password pair cannot be used a second time. Typically the users logon name stays the same, and the one-time password changes with each logon. One-time passwords are a form of so-called strong authentication, providing much better protection to on-line bank accounts, corporate networks and other systems containing sensitive data.

Today most enterprise networks, e-commerce sites and online communities require only a user name and static password for logon and access to personal and sensitive data. Although this authentication method is convenient, it is not secure because online identity theft ? using phishing, keyboard logging, man-in-the-middle attacks and other methods ? is increasing throughout the world.

Strong authentication systems address the limitations of static passwords by incorporating an additional security credential, for example, a temporary one-time password (OTP), to protect network access and end-users? digital identities. This adds an extra level of protection and makes it extremely difficult to access unauthorized information, networks or online accounts.

One-time passwords can be generated in several ways and each one has trade-offs in term of security, convenience, cost and accuracy. Simple methods such as transaction numbers lists and grid cards can provide a set of one-time passwords. These methods offer low investment costs but are slow, difficult to maintain, easy to replicate and share, and require the users to keep track of where they are in the list of  passwords.

A more convenient way for users is to use an OTP token which is a hardware device capable of  generating one-time passwords. Some of these devices are PIN-protected, offering an additional level of security. The user enters the one-time password with other identity credentials (typically user name and password) and an authentication server validates the logon request. Although this is a proven solution for enterprise applications, the deployment cost can make the solution expensive for consumer applications. Because the token must be using the same method as the server, a separate token is required for each server logon, so users need a separate token for each Web site or network they use.

More advanced hardware tokens use microprocessor-based smart cards to calculate one-time passwords. Smart cards have several advantages for strong authentication including data storage capacity, processing power, portability, and ease of use. They are inherently more secure than other OTP tokens because they generate a unique, non-reusable password for each authentication event, store personal data, and they do not transmit personal or private data over the network.

Smart cards can also include additional strong authentication capabilities such as PKI, or Public Key Infrastructure certificates. When used for PKI applications, the smart card device can provide core PKI services, including encryption, digital signature and private key generation and storage

Gemalto smart cards support OTP strong authentication in both Java? and Microsoft .NET environments. Multiple form factors and connectivity options are available so that end-users have the most appropriate device for their individual network access requirements. All Gemalto OTP devices work with the same Strong Authentication Server and are supported with a common set of administrative tools.