ZHAW-Logo OAPA-Logo TAT-Logo
zurück  
Diplomarbeit 2004 (DA04): Arbeits-Archiv
 
DA Rer 04/1 - Application for generating One-Time-Passwords on mobile phones
Studierende: Thomas Flatz, flatztho
  Tobias Schwaller, schwatob

Betreuer: Marc Rennhard, rema

A One-Time-Password (OTP) is a variety of a normal password authentication, where, as its name suggests, the password is used only once. However, because it is difficult to invent and remember various random passwords they are usually created by a generator or taken from a password list. An OTP generator is usually a hardware device, the so-called security token, which is carried along by the user. For applications with high security needs such as e-banking often strong or two factor authentication is applied in addition to a personal long-lasting password (knowledge), the OTP generated by a security token (possession) is required for authentication. However to carry several such tokens approximately the size of a match box with you is inconvenient. This led to the idea of a software application on a mobile phone, which is usually carried along anyway, that can substitute multiple tokens. The goal of this diploma thesis is the development of such an application. The OTPs generated this way should have equal qualities than dedicated hardware based. The program is implemented in Java, whereas the specialized Java environment (J2ME) was used as the target platform. This work also includes the evaluation of the possible methods of creating OTPs in consideration of the underlying device and the investigation of techniques similar products are based upon. For the solution also cryptographical libraries have been investigated. In terms of the authentication procedure, it was also considered that the use of the system should be intuitive. In order to test the functionality of the application, a server with connection to a database was set up. A Web Service provides the mechanism for authentication.

zurück