One-time password bound to server/session data to stop MITM phishing
A method that combines a one-time password (OTP) with server-reflective data (URL, server certificate, session key, or transaction info) to produce a reflective OTP (ROTP) that proves the client saw the real server context. The server and client independently concatenate a cryptographic key, the OTP, and the reflective information, apply a secure cryptographic algorithm, and compare results to authenticate the session. Intended users are online service operators and authentication systems defending against phishing and real-time MITM attacks.
(57) What the patent covered
This write-up was generated by AI from the patent's text and may contain mistakes, so check it against the original patent before relying on it.
The main independent claim required (1) obtaining reflective information from the server that includes the server URL, server certificate, and a session key; (2) combining a cryptographic key, an OTP, and that reflective information by concatenation; (3) generating a user reflective one-time password (ROTP) by running a secure cryptographic algorithm on the concatenated parameters; and (4) sending the ROTP to the server for verification.
Distinguishing feature: Binding the OTP to server-specific and session-specific reflective data (URL, certificate, session key) so an intercepted OTP cannot be replayed by an attacker that lacks that reflective context.
Novelty 4/5. At filing time OTPs and TLS server certificates were common; the distinctive step was explicitly combining OTPs with server and session information to resist real-time MITM phishing rather than relying on channel separation or client certificates.
Implementation
Implement a server endpoint that, after TLS handshake, exposes the server URL and a session identifier (session key) to the client. Ship a client app or token service that reads the OTP (time- or challenge-based), obtains the server URL and certificate fingerprint and the session identifier presented by the server, concatenates a stored cryptographic key, the OTP, and the reflective fields, computes an HMAC-SHA256 (likely) over that concatenation to produce the ROTP, and submits the ROTP to the server. The server computes the same HMAC and accepts only matching ROTP values.
Components: Authentication server (OTP verifier), client-side OTP generator (hardware token or app), session context extractor (reads URL, server certificate, session key), HMAC or other secure cryptographic algorithm implementation, secure transport (TLS) for reflective data exchange.
Buildability 5/5. Main engineering work is integrating session/context extraction and HMAC computation into client and server; the hard parts are accurate extraction of the same reflective fields and secure key provisioning.
Market demand
No demand check has been run for this patent. Likely search terms: OTP bound to session context, phishing-resistant OTP ROTP, OTP certificate session binding. The links in the sidebar open these searches.
Buyers: Online service operators, banks, identity providers.
Before manufacturing
No related continuation or divisional patents in force were found. Design patents, trademarks and unrelated patents may still cover the product.
Practical risks include ensuring both client and server extract identical reflective fields (URL normalization, certificate fingerprints, session key transport), user experience friction, and coexistence with existing OTP workflows; patent lapsed but other related patents may exist.
About 1.5% of lapsed patents are later revived by their owners. This page is a research lead, not legal advice. Obtain a freedom-to-operate opinion before manufacturing.