UI Automation TOTP Generation with Stored Shared Secrets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Automated testing of applications requiring time-based one-time passwords (TOTP) is hindered by the need for external entities to manage and generate TOTP, leading to connectivity issues, increased complexity, and security risks, especially when multiple authenticator accounts are involved.
Innovation Solution
A system and method that stores shared secrets, such as QR codes, on a client device, allowing a UI automation tool to extract, manage, and generate TOTP tokens independently, enabling seamless authentication during automated testing without reliance on external providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TOTP authentication is implemented to improve security, then account security is improved, but automated testing becomes more complex and requires external entities
Solution Approach 1:
The patent extracts the TOTP generation functionality from external authenticator applications and embeds it within the automated testing tool itself. The testing tool now contains an internal TOTP generator that can produce valid TOTP codes using stored shared secrets, eliminating the need for external TOTP providers and reducing testing complexity while maintaining security.
Solution Approach 2:
The patent introduces a shared secret repository as an intermediary component that stores the cryptographic shared secrets needed for TOTP generation. This repository acts as a mediator between the testing tool and the authentication system, allowing the tool to generate valid TOTP codes without requiring connection to external authenticator services.
2Ease of operation
If external TOTP providers are used to manage authentication, then TOTP generation capability is provided, but connectivity issues and security risks increase
Solution Approach 1:
The automated testing tool becomes self-sufficient by incorporating its own TOTP generation capability. Instead of relying on external TOTP providers, the tool uses its internal TOTP generator and stored shared secrets to produce authentication codes independently, eliminating connectivity requirements and reducing security risks associated with external dependencies.
Solution Approach 2:
The patent performs preliminary action by storing the shared secrets in the testing tool before the authentication process begins. This pre-loading of cryptographic materials allows the tool to generate TOTP codes offline without requiring real-time connection to external services, thereby eliminating connectivity issues and reducing security exposure.
3Reliability
If manual intervention is used for TOTP entry during testing, then authentication can be completed, but testing speed and sustainability decrease
Solution Approach 1:
The automated testing tool performs the TOTP entry operation itself without human intervention. The internal TOTP generator automatically produces the required authentication codes and the testing tool automatically inputs them into the application under test, maintaining authentication reliability while dramatically improving testing speed and sustainability.
Solution Approach 2:
The patent replaces the manual mechanical process of TOTP entry with an automated electronic system. Instead of a human operator manually reading and entering TOTP codes from an external device, the testing tool electronically generates and inputs the codes programmatically, eliminating the bottleneck of manual intervention and enabling continuous automated testing.
Data Source
AI summary
Automated testing of an application under test (AUT) often requires providing valid responses to an authentication challenge. Many AUTs require a username and password and, increasingly, a time-based one-time password (TOTP) that complicate automated testing. By storing a shared secret on a client device, a human can train an automated testing application to select the shared secret and provide the shared secret to a shared secret provider. The shared secret provider then provides a token code as the TOTP. The shared secret may be stored as a graphical element, such as a quick response (QR) code, and may further correspond to a particular username used to test the AUT.