Multi-factor Authentication Protocol Research Articles

An Automated Multi-Layered Methodology to Assist the Secure and Risk-Aware Design of Multi-Factor Authentication Protocols

An Automated Multi-Layered Methodology to Assist the Secure and Risk-Aware Design of Multi-Factor Authentication Protocols

An Enhanced Multifactor Authentication and Key Agreement Protocol in Industrial Internet of Things

An Enhanced Multifactor Authentication and Key Agreement Protocol in Industrial Internet of Things

Proving Mutual Authentication Property of Industrial Internet of Things Multi-Factor Authentication Protocol Based on Logic of Events

Security protocols are the basis of modern network communication, proving that the security problem of protocols is one of the hot research topics today. The data in industrial IoT are usually transmitted through insecure channels, which brings certain security risks. The Logic of Events is a formal method for proving the security properties of protocols based on event systems. The new theoretical extension is based on the Logic of Events theory, which proposes new event classes Compurte, TimeGap, Construct, and Reconstruct and an axiom AxiomRe and related inference rules for malicious attacks and security privacy issues in emerging protocols, as well as extending the matching descriptions of protocol behaviours in complex cryptographic algorithms and information sharing techniques for applications for the formal analysis of authentication protocols for the Industrial Internet of Things. Finally, formal analysis is carried out using the example of a secure multi-factor authentication protocol for the industrial IoT, which proves the security of the protocol.

Chaotic map based multi-factor authentication protocol for underwater environment monitoring

Chaotic map based multi-factor authentication protocol for underwater environment monitoring

An Improved Lightweight Two-Factor Authentication Protocol for IoT Applications

The Internet of Things (IoT) is defined as a network of connected objects or devices that gather information and share or exchange them through communication systems. In many applications, maintaining the privacy and security of the exchanged data is of great importance. Therefore protecting sensitive data against security threats is a major concern in IoT applications. Using Multi-factor authentication protocols is an efficient solution to provide these features. Recently, a two-factor authentication protocol using Physical Unclonable Functions (PUFs) and wireless fingerprints has been proposed by Aman et al. In this paper, we first analyze Aman et al.'s protocol and discuss its weaknesses and vulnerabilities. Then, we propose an improved two-factor authentication protocol to provide strong mutual authentication and overcome the mentioned issues. The informal security analysis of the proposed scheme demonstrates that it is resistant to several well-known attacks. We also perform a security analysis of the proposed scheme using Burrows-Abadi-Needham (BAN) logic. We further evaluate the proposed protocol in terms of computational complexity and security features. The results demonstrate that our scheme has significantly better computational efficiency and provides better security features compared to Aman et al.'s protocol.

FSMFA: Efficient firmware-secure multi-factor authentication protocol for IoT devices

With the rapid development of 5G mobile communication technology and the continuous expansion of the scale of the Internet of Things (IoT) industry, the number of IoT devices has grown exponentially. IoT devices have uneven security guarantees due to different application scenarios, which brings great security threats to the devices themselves and the IoT system. Especially with the physical threats of the device and firmware tampering, attackers can even make your home’s sweeping robot a spy by modifying the firmware. In view of these threats, this paper proposes a FSMFA: Firmware-Secure Multi-Factor Authentication protocol based on PUF (physical unclonable function) and device firmware integrity, which enhance the physical and software security of IoT devices while enhancing the security of IoT system. So as to realize mutual authentication and key negotiation between the device and the server. At the same time, in order to guarantee the safety of the whole life cycle of the device, we propose the challenge response pairs (CRPs) and firmware update scheme of the device. Finally, we use BAN logic and ProVerif to prove the security of authentication and update protocols. Compared with other similar protocols, the proposed protocol achieves better security and higher efficiency.

A secure communication using multifactor authentication and key agreement techniques in internet of medical things for COVID‐19 patients

AbstractCurrently, Internet of Medical Things (IoMT) gained popularity because of an ongoing pandemic. A few developed countries plan to deploy the IoMT for improving the security and safety of frontline workers to decrease the mortality rates of COVID‐19 patients. However, IoMT devices share the information through an open network which leads to increased vulnerability to various attacks. Hence, electronic health management systems remain many security challenges, like recording sensitive patient data, secure communication, transferring patient information to other doctors, providing the data for future medical diagnosis, collecting data from WBAN, etc. In addition, the sensor devices attached to the human body are resource‐limited and have minimal power capacity. Hence, to protect the medical privacy of patients, confidentiality and reliability of the system, the register sensor, doctor and server need to authenticate each other. Therefore, rather than two factors, in this work, a multifactor authentication protocol has been proposed to provide more secure communication. The presented scheme uses biometric and fuzzy extractors for more security purposes. Furthermore, the scheme is proved using informal and formal security verification BAN logic, ProVerif and AVISPA tools. The ProVerif simulation result of the suggested scheme shows that the proposed protocol achieves session key secrecy and mutual authentication

Understanding Failures in Security Proofs of Multi-Factor Authentication for Mobile Devices

Multi-factor authentication is a promising way to enhance the security of password-based authenticated key exchange (PAKE) schemes. It is widely deployed in various daily applications for mobile devices (e.g., e-Bank, smart home, and cloud services) to provide the first line of defense for system security. However, despite intensive research, how to design a secure and efficient multi-factor authentication scheme is still a challenging problem. Hundreds of new schemes have been successfully proposed, and many are even equipped with a formal security proof. However, most of them have been shortly found to be insecure and cannot achieve the claimed security goals. Now a paradox arises: How can a multi-factor scheme that was “formally proven secure” later be found insecure? To answer this seemingly contradicting question, this paper takes a substantial first step towards systematically exploring the security proof failures in multi-factor authentication schemes for mobile devices. We first investigate the root causes of the “provable security” failure in vulnerable multi-factor authentication schemes under the random oracle model, and classify them into eight different types in terms of the five steps of conducting a formal security proof. Then, we elaborate on each type of these eight proof failures by examining three typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 70 representative multi-factor authentication schemes under our extended evaluation criteria. The schemes we select range from 2009 to 2022, and the comparison results suggest that understanding failures in formal security proofs is helpful to design more secure multi-factor authentication protocols for mobile devices.

A Secure Multi-factor Authentication Protocol for Healthcare Services Using燙loud-based SDN

Cloud-based SDN (Software Defined Network) integration offers new kinds of agility, flexibility, automation, and speed in the network. Enterprises and Cloud providers both leverage the benefits as networks can be configured and optimized based on the application requirement. The integration of cloud and SDN paradigms has played an indispensable role in improving ubiquitous health care services. It has improved the real-time monitoring of patients by medical practitioners. Patients’ data get stored at the central server on the cloud from where it is available to medical practitioners in no time. The centralisation of data on the server makes it more vulnerable to malicious attacks and causes a major threat to patients’ privacy. In recent days, several schemes have been proposed to ensure the safety of patients’ data. But most of the techniques still lack the practical implementation and safety of data. In this paper, a secure multi-factor authentication protocol using a hash function has been proposed. BAN (Body Area Network) logic has been used to formally analyse the proposed scheme and ensure that no unauthenticated user can steal sensitivepatient information. Security Protocol Animator (SPAN)–Automated Validation of Internet Security Protocols and Applications (AVISPA) tool has been used for simulation. The results prove that the proposed scheme ensures secure access to the database in terms of spoofing and identification. Performance comparisons of the proposed scheme with other related historical schemes regarding time complexity, computation cost which accounts to only 423 ms in proposed, and security parameters such as identification and spoofing prove its efficiency.

Practical and secure multifactor authentication protocol for autonomous vehicles in 5G

AbstractAutonomous vehicles (AV) can not only improve traffic safety and congestion, but also have strategic significance for the development of the transportation industry. With the continuous updating of core technologies such as artificial intelligence, sensor detection, synchronous positioning, and high‐precision mapping, the development of AV has been promoted. When 5G network is combined with Internet of Vehicles, the problems of AV can be solved by taking advantage of 5G ultra‐large bandwidth, low latency and high reliability. However, when the user controls the vehicle remotely, a real‐time and reliable authentication process is needed, while minimizing the overhead of security protocols. Therefore, this article proposes a practical and secure multifactor user authentication protocol for AV in 5G network. By introducing non‐interactive zero‐knowledge proof technology and physical uncloning function, the protocol completes mutual authentication and key agreement without revealing any sensitive information. The article proves the security of the protocol through BAN logic and the simulation of Scyther. And it can resist malicious attacks and provide more security features. The informal security analysis shows that the protocol can meet the proposed security requirements. Finally, we evaluate the efficiency of the protocol, and the results show that the protocol can provide better performance.

PUF-Assisted Lightweight Group Authentication and Key Agreement Protocol in Smart Home

Various IoT-based applications such as smart home, intelligent medical, and VANETs have been put into practical utilization. The smart home is one of the most concerned environments, allowing users to access and control smart devices via the public network remotely. The smart home can provide many intelligent services for users through these smart devices. To securely access devices and obtain collected data over the public network, multifactor authentication protocols for smart home have gained wide attention. However, most of these protocols cannot withstand impersonation attack, smart device lost attack, privileged-insider attack, smart card lost attack, and so on. Besides, high communication and computational costs weaken the system performance, which leads to most authentication protocols are not suitable for resource-constrained smart devices. To mitigate the aforementioned drawbacks, we proposed a PUF-assisted lightweight group authentication and key agreement protocol to implement secure access to multiple devices in the smart home simultaneously using the Chinese Remainder Theorem and secret sharing technique. Our protocol also utilizes physical unclonable function (PUF) and fuzzy extractor technique to extract the digital fingerprint of the smart devices, which can uniquely validate smart devices and protect the secrets stored in their memory. Our protocol can support various security features and withstand the many well-known attacks in the smart home. The performance analysis indicates that the proposed protocol can efficiently reduce communication/computational costs when the user simultaneously accesses multiple devices.

A novel ECC-based provably secure and privacy-preserving multi-factor authentication protocol for cloud computing

A novel ECC-based provably secure and privacy-preserving multi-factor authentication protocol for cloud computing

A Physical Layer, Zero-Round-Trip-Time, Multifactor Authentication Protocol

Lightweight physical layer security schemes that have recently attracted a lot of attention include physical unclonable functions (PUFs), RF fingerprinting / proximity based authentication and secret key generation (SKG) from wireless fading coefficients. In this paper, we propose a fast, privacy-preserving, zero-round-trip-time (0-RTT), multi-factor authentication protocol, that for the first time brings all these elements together, i.e., PUFs, proximity estimation and SKG. We use Kalman filters to extract proximity estimates from real measurements of received signal strength (RSS) in an indoor environment to provide soft fingerprints for node authentication. By leveraging node mobility, a multitude of such fingerprints are extracted to provide resistance to impersonation type of attacks e.g., a false base station. Upon removal of the proximity fingerprints, the residual measurements are then used as an entropy source for the distillation of symmetric keys and subsequently used as resumption secrets in a 0-RTT fast authentication protocol. Both schemes are incorporated in a challenge-response PUF-based mutual authentication protocol, shown to be secure through formal proofs using Burrows, Abadi, and Needham (BAN) and Mao and Boyd (MB) logic, as well as the Tamarin-prover. Our protocol showcases that in future networks purely physical layer security solutions are tangible and can provide an alternative to public key infrastructure in specific scenarios.

Lightweight Multifactor Authentication Scheme for NextGen Cellular Networks

With increased interest in 6G (6th Generation) cellular networks that can support intelligently small-cell communication will result in effective device-to-device (D2D) communication. High throughput requirement in 5G/6G cellular technology requires each device to act as intelligent transmission relays. Inclusion of such intelligence relays and support of quantum computing at D2D may compromise existing security mechanisms and may lead towards primitive attacks such as impersonation attack, rouge device attack, replay attack, MITM attack, and DoS attack. Thus, an effective yet lightweight security scheme is required that can support existing low computation devices and can address the challenges that 5G/6G poses. This paper proposes a Lightweight ECC (elliptic curve cryptography)-based Multifactor Authentication Protocol (LEMAP) for miniaturized mobile devices. LEMAP is the extension of our previous published work TLwS (trust-based lightweight security scheme) which utilizes ECC with Elgamal for achieving lightweight security protocol, confidentiality, integrity, and non-repudiation. Multi-factor Authentication is based on OTP (Biometrics, random number), timestamp, challenge, and password. This scheme has mitigated the above-mentioned attacks with significantly lower computation cost, communication cost, and authentication overhead. We have proven the correctness of the scheme using widely accepted Burrows-Abadi-Needham (BAN) logic and analyzed the performance of the scheme by using a simulator. The security analysis of the scheme has been conducted using the Discrete Logarithm Problem to verify any quantum attack possibility. The proposed scheme works well for 5G/6G cellular networks for single and multihop scenarios.

Authentication of IoT device with the enhancement of One-time Password (OTP)

The Robust and Energy Efficient Authentication Protocol works for Industrial Internet of Things. The Internet of Things (IoT) is an arising innovation and expected to give answers for different modern fields. The IoT enable connection of physical devices all around the world to the internet by collecting and sharing critical and real-time data among each other. The increment of devices increases the computational cost during data transmission between devices and towards the internet. In this paper we proposed a solution that is a multi-factor authentication protocol to enhance the protocol proposed by Li et al. For Industrial IoT by adding One Time Password (OTP) after the biometric information of the user is checked by the Gateway Node (GWN) to be able to tackle additional network attack aside from those that are overcome by Li et al. scheme. Our contribution for this project is, we proposed the solution that a multi-factor authentication protocol to enhance the protocol proposed. For Industrial IoT by adding One Time Password (OTP) after the biometric information of the user is checked by the Gateway Node (GWN) to be able to tackle additional network attack aside from those that are overcome. The idea of adding OTP is inspired by where they scheme correlates to biometric of user as well. Our proposal is lower cost than the three protocols regarding authentication overhead and computational cost perspectives. Challenges and future directions of this paper examined the security shortcomings of a client confirmation convention for WSN, which is as proposed by Chang and Le. To address the normal security shortcomings of past protocols, we proposed a strong and energy effective three-factor authentication protocol for WSN.

An Efficient and Provable Multifactor Mutual Authentication Protocol for Multigateway Wireless Sensor Networks

As the most popular way of communication technology at the moment, wireless sensor networks have been widely concerned by academia and industry and plays an important role in military, agriculture, medicine, and other fields. Identity authentication offers the first line of defence to ensure the security communication of wireless sensor networks. Since the sensor nodes are resource-limited in the wireless networks, how to design an efficient and secure protocol is extremely significant. The current authentication protocols have the problem that the sensor nodes need to execute heavy calculation and communication consumption during the authentication process and cannot resist node capture attack, and the protocols also cannot provide perfect forward and backward security and cannot resist replay attack. Multifactor identity authentication protocols can provide a higher rank of security than single-factor and two-factor identity authentication protocols. The multigateway wireless sensor networks’ structure can provide a larger communication coverage area than the single-gateway network structure, so it has become the focus of recent studies. Therefore, we design a novel multifactor authentication protocol for multigateway wireless sensor networks, which only apply the lightweight hash function and are given biometric information to achieve a higher level of security and efficiency and a larger communication coverage area. We separately apply BAN logic, random oracle model, and AVISPA tool to validate the security of our authentication protocol in Case 1 and Case 2. We put forward sixteen evaluation criteria to comprehensively evaluate our authentication protocol. Compared with the related authentication protocols, our authentication protocol is able to achieve higher security and efficiency.

A Lightweight Three-Factor Authentication and Key Agreement Scheme for Multigateway WSNs in IoT

The Internet of Things (IoT) has built an information bridge between people and the objective world, wherein wireless sensor networks (WSNs) are an important driving force. For applications based on WSN, such as environment monitoring, smart healthcare, user legitimacy authentication, and data security, are always worth exploring. In recent years, many multifactor user authentication schemes for WSNs have been proposed using smart cards, passwords, as well as biometric features. Unfortunately, these schemes are revealed to various vulnerabilities (e.g., password guessing attack, impersonation attack, and replay attack) due to nonuniform security evaluation criteria. Wang et al. put forward 12 pieces of widely accepted evaluation criteria by investigating quantities of relevant literature. In this paper, we first propose a lightweight multifactor authentication protocol for multigateway WSNs using hash functions and XOR operations. Further, BAN logic and BPR model are employed to formally prove the correctness and security of the proposed scheme, and the informal analysis with Wang et al.’s criteria also indicates that it can resist well-known attacks. Finally, performance analysis of the compared schemes is given, and the evaluation results show that only the proposed scheme can satisfy all 12 evaluation criteria and keep efficient among these schemes.

An Extensive Formal Analysis of Multi-factor Authentication Protocols

Passwords are still the most widespread means for authenticating users, even though they have been shown to create huge security problems. This motivated the use of additional authentication mechanisms in so-called multi-factor authentication protocols. In this article, we define a detailed threat model for this kind of protocol: While in classical protocol analysis attackers control the communication network, we take into account that many communications are performed over TLS channels, that computers may be infected by different kinds of malware, that attackers could perform phishing, and that humans may omit some actions. We formalize this model in the applied pi calculus and perform an extensive analysis and comparison of several widely used protocols—variants of Google 2-step and FIDO’s U2F (Yubico’s Security Key token). The analysis is completely automated, generating systematically all combinations of threat scenarios for each of the protocols and using the P ROVERIF tool for automated protocol analysis. To validate our model and attacks, we demonstrate their feasibility in practice, even though our experiments are run in a laboratory environment. Our analysis highlights weaknesses and strengths of the different protocols. It allows us to suggest several small modifications of the existing protocols that are easy to implement, as well as an extension of Google 2-step that improves security in several threat scenarios.

Provably Secure Crossdomain Multifactor Authentication Protocol for Wearable Health Monitoring Systems

Wearable health monitoring systems (WHMSs) have become the most effective and practical solutions to provide users with low-cost, noninvasive, long-term continuous health monitoring. Authentication is one of the key means to ensure physiological information security and privacy. Although numerous authentication protocols have been proposed, few of them cater to crossdomain WHMSs. In this paper, we present an efficient and provably secure crossdomain multifactor authentication protocol for WHMSs. First, we propose a ticket-based authentication model for multidomain WHMSs. Specifically, a mobile device of one domain can request a ticket from the cloud server of another domain with which wearable devices are registered and remotely access the wearable devices with the ticket. Secondly, we propose a crossdomain three-factor authentication scheme based on the above model. Only a doctor who can present all three factors can request a legitimate ticket and use it to access the wearable devices. Finally, a comprehensive security analysis of the proposed scheme is carried out. In particular, we give a provable security analysis in the random oracle model. The comparisons of security and efficiency with the related schemes demonstrate that the proposed scheme is secure and practical.

Multi-Factor One-Way Authentication and Key Retrieval Based on Ideal Threshold Secret Sharing

It is not a secret that one-factor authentication protocols suffer from many attacks nowadays. So there exist numerous solutions that use two or more authentication factors. The most popular is two-factor authentication via mobile network where the Password and SMS are used. More critical applications require even biometric authentication procedure. All these protocols use distinct algorithm for processing different factors. Therefore, developing a universal, secure and low-cost authentication scheme is an important task. We propose a new universal multi-factor one-way authentication and key retrieval protocol based on ideal threshold secret sharing. Our protocol allows to retrieve a key that encrypts user data stored on the server. We also provide the ways of combining our protocol with traditional authentication factors like Password, Personal Data, Biometrics, Geometrical Lines and Random Strings. In addition, our protocol does not use costly mathematical operations and can be implemented on various low-energy devices.