Ce diaporama a bien été signalé.
Nous utilisons votre profil LinkedIn et vos données d’activité pour vous proposer des publicités personnalisées et pertinentes. Vous pouvez changer vos préférences de publicités à tout moment.

Plone OTP

125 vues

Publié le

Simple and Secure OTP base Authentication Mechanism for Content Management Systems– Plone as a case

Publié dans : Formation
  • Soyez le premier à commenter

  • Soyez le premier à aimer ceci

Plone OTP

  1. 1. Simple and Secure OTP based Authentication Mechanism for Content Management Systems – Plone as a case Authors Sameer Kumar Choudhary, Krishnapriya T Centre for Development of Advanced Computing CDAC, Hyderabad, India
  2. 2. Introduction • An info-centric website requires to meet the internet standard of usability, accessibility and flexibility of both content and system. • An alternate and easy way besides normal login procedure for non-technical authors and content contributors to access content management system , is mobile number based login and via Plone authentication service. • This alternate approach keeps in regard the necessity of maintaining the roles of different actors involved in the full life cycle of content management system separate and secure.
  3. 3. Universally Designed Websites = Best Practices Flexibility Usable Accessible
  4. 4. Related Research • Two step verification using Google Authenticator App for Plone 4 or above. • It requires a user to have a smart phone installed with Google Authenticator App.
  5. 5. • It requires Google Authenticator App to scan this QR code(Quick Response code) and generates verification code, which is used to log in to site. • But a user with no smart phone, can not use it. • This violates internet standard of usability and accessibility. • The present OTP application integration in Plone makes it compatible to any text enabled mobile device and makes access easy.
  6. 6. Concepts OTP not a new concept first addressed in 1980. OTP GENERATION & AUTHENTICATION METHODS: Based on time Synchronization between server and client. Algorithm to generate new password based on old password . Algorithm to generate new password based on some challenge by server.
  7. 7. Theoretical Background • The approach we followed is very simple, a random number of 5 digit number is generated , which is used as seed to generate sample of unique numbers. • This sample is used to return non repeating random number of 6 digits, this length can be changed as required depending on parameters of return statement. This can be decoded back .
  8. 8. Comparison of MATRIX size and random number size: • This random number is again encrypted using AES encryption technique. • Finally comes into picture the Plone Authentication Plugin.
  9. 9. Random 5 digit Number (original number) Logic to generate non-repeating random number and obfuscate Logic to Encrypt SMS sent Encrypted message Key Logic To Decrypt Key Logic to clarify obfuscated code Random 5 digit Number (original number)
  10. 10. Plone CMS based Web Portal Architecture Optional Web Server (e.g, LDAP Server) WEB APPLICATION Affects Reliance Plone Plug-in (Content Management System) Plone (Content Management Framework) CMF (Web Application Server) ZOPE Python (Programming Language)
  11. 11. gjhk Phone Number verification OTP Application from Users’s Point of View OTP Generation OTP as SMS to user OTP verification User Authentication and roles mapping.
  12. 12. Thank You