I’m trying to design a two factor authentication system (on PHP) using SMS as the second auth method. This is for a test project thus can anyone help me to design this service?
This will be an web based system and below is what i have done so far.
-
Once the client enters the Username and Password the website will send a secure HTTP request to our server with the MSISDN, a UID (to identify the session), their UserID & PassWord.
-
Our server will add the request to a MySQL DB and respond the website with a Code, UID and some other info.
-
Our server will send the client a SMS with the one time password.
-
Once the client enters the OTP into the website, the website will send another HTTPS request with the encrypted OTP to our server and we will send a success or fail code as the response.
this is the flow i have thought about. Anyone have a better flow? or suggestions?
Thanks.
Seems like a valid mechanism. But what if the SMS device is not in a service area? Or dead battery?