基于时间限制和唯一性的OTP安全验证系统设计

import java.security.SecureRandom;
import java.time.Instant;
import java.util.HashSet;
import java.util.Random;
import java.util.Set;

public class OtpService {

    private static final int OTP_LENGTH = 8;
    private static final int OTP_VALIDITY_SECONDS = 300; // 5 minutes
    private static final Set<String> usedOtps = new HashSet<>();

    public static String generateOtp() {
        Random random = new SecureRandom();
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < OTP_LENGTH; i++) {
            sb.append(random.nextInt(10));
        }
        return sb.toString();
    }

    public static boolean validateOtp(String otp, Instant creationTime) {
        if (isOtpExpired(creationTime)) {
            return false;
        }

        synchronized (usedOtps) {
            if (usedOtps.contains(otp)) {
                return false;
            }
            usedOtps.add(otp);
            return true;
        }
    }

    private static boolean isOtpExpired(Instant creationTime) {
        Instant now = Instant.now();
        return now.getEpochSecond() - creationTime.getEpochSecond() > OTP_VALIDITY_SECONDS;
    }

    public static void main(String[] args) {
        String otp = generateOtp();
        Instant creationTime = Instant.now();
        System.out.println("Generated OTP: " + otp);

        boolean isValid = validateOtp(otp, creationTime);
        System.out.println("OTP Validation Result: " + isValid);

        // Simulate a second validation attempt with the same OTP
        isValid = validateOtp(otp, creationTime);
        System.out.println("Second OTP Validation Result: " + isValid);
    }
}