Two Factor Authentication

Two-factor authentication (also known as 2FA or 2-Step Verification) is a technology that provides identification of users by means of the combination of two different components. These components may be something that the user knows, something that the user possesses or something that is inseparable from the user. Only the correct combination of a password (something that the user possesses) and a PIN (something that the user can retrieve - at the time of login process) allows the login transaction to be carried out.

HMIS supports two factor authentication for the purposes of protecting user identity and data . It uses Google Authenticator as a means to generate one time password (OTP) which can be used by the user at the second step in the two step authentication process.

The one-time password secret keys, code generation, and code verification are based on the industry standard Google Authenticator. Each OTP is intended for use by only one user, is valid for a specific period of time, and becomes invalid after the user successfully logs in. It cannot be easily duplicated and reused elsewhere. The entered code is sent securely to HMIS cloud through HTTPS (Secure HTTP) encryption on TCP port 443.

Follow the steps in the link below for setting up Google Authenticator on mobile app. Google Authenticator set up on Mobile

Following flow diagrams show the registration and two factor authentication flow for HMIS platform.