Multi-factor Authentication Solution Research Articles

Analysis of multi-factor authentication solutions

This article analyzes open-source multi-factor authentication (MFA) solutions. Research on adapting the MFA solution is given, this research will help businesses to provide security in the implementation of remote work. This article discusses 5 open-source MFA solutions, functionality, advantages and disadvantages. For Small and Medium-sized Businesses (SMBs), using a multi-factor authentication (MFA) solution is an important element of security. MFA is an authentication method that requires several forms of authentication before a user can access a system or application. For SMBs, using MFA helps protect their business from cyberattacks, including phishing, network traffic interception and password cracking. In addition, the use of MFA helps to comply with regulations such as GDPR and HIPAA, which require companies to ensure data security. In general, the use of MFA helps to protect important information and reduce the risks of security breaches, which can lead to financial losses, reputational problems and loss of customer confidence.

Image Based Authentication Using Zero-Knowledge Protocol

Numerous well-known Internet applications have been introduced as a result of technological advancements. E-banking, or mobile banking, is one such vital program that significantly affects our contemporary lives. Although banks urge customers to interact online, citing it as a secure method, the truth reveals serious risks involved. The ongoing expansion of mobile banking applications raises concerns about security and drives up the expense of putting strong security measures in place for banks and clients alike. This study explores potential compromises via methods like Trojan horses, botnets, and phishing as it dives into the weaknesses of mobile banking systems. Although multifactor authentication solutions are available to verify the authenticity of clients, their transaction-level focus exposes browsers and smart phones to man-in-the-middle attacks. This work recognizes the urgent need for improved security for mobile banking and offers a novel approach to authentication. The main focus is on a hybrid one-time password solution that combines SHA 256-bit encryption with random OTP. The suggested approach seeks to strengthen security at the transaction and authentication levels by integrating picture verification into the authentication procedure.

A review of multi-factor authentication in the Internet of Healthcare Things.

This review paper aims to evaluate existing solutions in healthcare authentication and provides an insight into the technologies incorporated in Internet of Healthcare Things (IoHT) and multi-factor authentication (MFA) applications for next-generation authentication practices. Our review has two objectives: (a) Review MFA based on the challenges, impact and solutions discussed in the literature; and (b) define the security requirements of the IoHT as an approach to adapting MFA solutions in a healthcare context. To review the existing literature, we indexed articles from the IEEE Xplore, ACM Digital Library, ScienceDirect, and SpringerLink databases. The search was refined to combinations of 'authentication', 'multi-factor authentication', 'Internet of Things authentication', and 'medical authentication' to ensure that the retrieved journal articles and conference papers were relevant to healthcare and Internet of Things-oriented authentication research. The concepts of MFA can be applied to healthcare where security can often be overlooked. The security requirements identified result in stronger methodologies of authentication such as hardware solutions in combination with biometric data to enhance MFA approaches. We identify the key vulnerabilities of weaker approaches to security such as password use against various cyber threats. Cyber threats and MFA solutions are categorised in this paper to facilitate readers' understanding of them in healthcare domains. We contribute to an understanding of up-to-date MFA approaches and how they can be improved for use in the IoHT. This is achieved by discussing the challenges, benefits, and limitations of current methodologies and recommendations to improve access to eHealth resources through additional layers of security.

Chirp-Loc: Multi-factor authentication via acoustically-generated location signatures

Context-based authentication has been proposed as a way to enable secure authentication with minimal or even no user interaction requirements by using sensor data to ensure the device being authenticated is in possession of the person initiating the authentication request. A key limitation of practically all context-based authentication systems is that they are vulnerable to context manipulation attacks where an attacker manipulates the environment to create a desired response in the sensor data. We contribute Chirp-Loc as a system that has been designed to improve the robustness of context-based authentication solutions against context-manipulation attacks. Chirp-Loc integrates an innovative approach based on room impulse response (RIR) to establish a location fingerprint that characterizes the physical environment instead of the ambient environment. We describe the design and development of an Android prototype of Chirp-Loc. We also conduct extensive accuracy and security analysis of Chirp-Loc by considering a multi-factor authentication solution that uses Chirp-Loc to verify the proximity of an authentication token, such as a smartphone. Through extensive experiments, we demonstrate that Chirp-Loc offers high degree of security and usability. Our work paves the way for improving the resilience of context-based authentication against attackers that manipulate the context information and offers a way to implement authentication systems that minimize user interaction demands while offering a high degree of security.

Novel user authentication method based on body composition analysis

Authentication is the process of confirming one’s identity. There is a steadily growing need to protect confidential, especially financial, data, as banks provide their services online through their ubiquitous systems. This paper presents a novel authentication method based on the analysis of body composition. A trusted system that relies on the biometric authentication has been designed, implemented, and evaluated, showing a false accept rate (FAR) of 0%, while its false reject rate (FRR) is 2.65%. As the proposed solution requires virtually no special action from the user during the authentication process, it can be seen as suitable for incorporation into existing multifactor authentication solutions.

Formal Analysis of Mobile Multi-Factor Authentication with Single Sign-On Login

Over the last few years, there has been an almost exponential increase in the number of mobile applications that deal with sensitive data, such as applications for e-commerce or health. When dealing with sensitive data, classical authentication solutions based on username-password pairs are not enough, and multi-factor authentication solutions that combine two or more authentication factors of different categories are required instead. Even if several solutions are currently used, their security analyses have been performed informally or semiformally at best, and without a reference model and a precise definition of the multi-factor authentication property. This makes a comparison among the different solutions both complex and potentially misleading. In this article, we first present the design of two reference models for native applications based on the requirements of two real-world use-case scenarios. Common features between them are the use of one-time password approaches and the support of a single sign-on experience. Then, we provide a formal specification of our threat model and the security goals, and discuss the automated security analysis that we performed. Our formal analysis validates the security goals of the two reference models we propose and provides an important building block for the formal analysis of different multi-factor authentication solutions.

A survey on multi-factor authentication for online banking in the wild

In recent years, the usage of online banking services has considerably increased. To protect the sensitive resources managed by these services against attackers, banks have started adopting Multi-Factor Authentication (MFA). To date, a variety of MFA solutions have been implemented by banks, leveraging different designs and features and providing a non-homogeneous level of security and user experience. Public and private authorities have defined laws and guidelines to guide the design of more secure and usable MFA solutions, but their influence on existing MFA implementations remains unclear. In this work, we present a latitudinal study on the adoption of MFA and the design choices made by banks operating in different countries. In particular, we evaluate the MFA solutions currently adopted in the banking sector in terms of (i) compliance with laws and best practices, (ii) robustness against attacks and (iii) complexity. We also investigate possible correlations between these criteria. Based on this study, we identify a number of lessons learned and open challenges.

The many ways to hack 2FA

As the days of pervasive password authentication are starting to wane, administrators and end users are increasingly turning to stronger types of authentication such as two-factor authentication (2FA) and multi-factor authentication (MFA). All other considerations considered equal, MFA solutions (which include 2FA) are usually stronger than single-factor authentication (1FA) solutions such as the ubiquitous duo of username and password. This is generally agreed upon by all computer security professionals. People are increasingly turning to stronger types of authentication such as two-factor authentication (2FA) and multi-factor authentication (MFA). But somewhere along the way, many people have come to associate MFA solutions with being far less hackable or even unhackable. Nothing could be further from the truth. In fact, it's possible to use nothing more than a simple phishing email to easily bypass many beloved MFA solutions, says Roger Grimes of KnowBe4.

Blockchain Based MFA Solution: the use of hydro raindrop MFA for information security on WordPress websites

Goal: The present work aims to present how the use of a blockchain two-factor authentication solution 2FA on a page developed on WordPress can contribute to the information security regarding user authentication.
 Design/Methodology/Approach: The research method employed is characterized as an exploratory research, since all the analysis is based on the theoretical reference data available on the subject. A field research was carried out in relation to the implementation of the multi-factor authentication plugin Hydro Raindrop MFA, which uses blockchain technology offered by The Hydrogen Technology Corporation and the Project Hydro platform over the Ethereum network. Thus, this paper sought to present and conceptualize some of the technologies used, pointing out their contribution to information security.
 Results: The main results showed that the use of decentralized technology, such as blockchain and the Hydro Raindrop Plugin, can contribute considerably in the process of user authentication, which may strengthen the safeguard of the information and assets of individuals and organizations by inhibiting or reducing the possibility of successful a hacker attack. This solution is at the forefront of innovation with regard to data security because it uses advanced blockchain technology. It might contribute in a satisfactory way to the preservation of critical data and information that are the core value of many organizations of the industry 4.0.
 Limitations of the investigation: This research was limited to analyzing how the implementation of the Hydro Raindrop multi-factor authentication solution on a WordPress page can be beneficial to ensure information security.
 Practical implications: This study’s findings can contribute to entities interested in cybersecurity. As a suggestion for future works, analyses of plugins or similar solutions available on the market in distinct types of websites, or performance comparisons between them, may be relevant to contribute to scientific research.
 Originality/Value: This work can contribute in an innovative way to scientific research, since it addresses a recently created solution that uses blockchain technology as its basis for a safer method of authentication.

Fishbone model and universal authentication framework for evaluation of multifactor authentication in mobile environment

The trend of rapid evolutionary development of mobile technologies and the existence of different user's priorities are creating new challenges with regard to selection of multifactor authentication (MFA) solutions. This becomes even more challenging by creating a universal authentication framework (UAF). In order to cope with these challenges, this paper has proposed a Fishbone model and developed in form of the UAF which is based on a larger number of linguistic variables and a wider set of user's priorities such as security, usability, accessibility, pricing, complexity, privacy and convenience (SUAPCPC). In comparison to all other papers available in the literature, the Fishbone model provides numerical evaluation of MFA with the possibility of changing weighted criteria for the selected user priorities. In addition, the contributions of this model are twofold. For user's, to enable easier choice of MFA solution, for developers, to identify spots where a method or solution could be improved. For development of the Fishbone model, fuzzy methodology is used in form of a Fuzzy Expert System (FES) tool. Also, the block diagram and the basic modules of the Fishbone model architecture are given. The results of implementation of the Fishbone model in form of the UAF have showed that this model is applicable and very efficient in practice. Finally, the Fishbone model gives an ideal template in UAF at which user's priorities satisfy the best individual users’ solutions. The realization of this template presents challenge for all future developers of MFA solutions.

TDAS: a touch dynamics based multi-factor authentication solution for mobile devices

Purpose The use of mobile devices in handling our daily activities that involve the storage or access of sensitive data (e.g. on-line banking, paperless prescription services, etc.) is becoming very common. These mobile electronic services typically use a knowledge-based authentication method to authenticate a user (claimed identity). However, this authentication method is vulnerable to several security attacks. To counter the attacks and to make the authentication process more secure, this paper aims to investigate the use of touch dynamics biometrics in conjunction with a personal identification number (PIN)-based authentication method, and demonstrate its benefits in terms of strengthening the security of authentication services for mobile devices. Design/methodology/approach The investigation has made use of three light-weighted matching functions and a comprehensive reference data set collected from 150 subjects. Findings The investigative results show that, with this multi-factor authentication approach, even when the PIN is exposed, as much as nine out of ten impersonation attempts can be successfully identified. It has also been discovered that the accuracy performance can be increased by combining different feature data types and by increasing the input string length. Originality/value The novel contributions of this paper are twofold. Firstly, it describes how a comprehensive experiment is set up to collect touch dynamics biometrics data, and the set of collected data is being made publically available, which may facilitate further research in the problem domain. Secondly, the paper demonstrates how the data set may be used to strengthen the protection of resources that are accessible via mobile devices.

Multi factor authentication as a necessary solution in the fight with information technology security threats

In the publication multi factor authentication solutions are offered as a necessary tool for decrease of information technology security risks. The work includes description of authentication process from the viewpoint of information technology security aspect, as well as authentication factors are described, which can be used in authentication process modules. Some recommendations for decrease of security risks are given using multi factor authentication solutions. In the work a multi-factor authentication security testing experiment is described, which involves use of Linux remote console - SSH service. Analysis of data of unauthorised access efforts obtained during tests is described: it is determined from which countries or regions, as well as in which days there is the highest threat to information technology security.