Multi-factor Authentication Scheme Research Articles

Opportunistic Sensor-Based Authentication Factors in and for the Internet of Things

Communication between connected objects in the Internet of Things (IoT) often requires secure and reliable authentication mechanisms to verify identities of entities and prevent unauthorized access to sensitive data and resources. Unlike other domains, IoT offers several advantages and opportunities, such as the ability to collect real-time data through numerous sensors. These data contains valuable information about the environment and other objects that, if used, can significantly enhance authentication processes. In this paper, we propose a novel idea to building opportunistic sensor-based authentication factors by leveraging existing IoT sensors in a system of systems approach. The objective is to highlight the promising prospects of opportunistic authentication factors in enhancing IoT security. We claim that sensors can be utilized to create additional authentication factors, thereby reinforcing existing object-to-object authentication mechanisms. By integrating these opportunistic sensor-based authentication factors into multi-factor authentication schemes, IoT security can be substantially improved. We demonstrate the feasibility and effectivenness of our idea through illustrative experiments in a parking entry scenario, involving both mobile robots and cars, achieving high identification accuracy. We highlight the potential of this novel method to improve IoT security and suggest future research directions for formalizing and comparing our approach with existing techniques.

Lightweight blockchain-based remote user authentication for fog-enabled IoT deployment

The Internet of Things (IoT) seeks to enhance human life by embedding everyday objects with intelligence. As deployed in diverse environments, IoT devices exchange substantial data to offer autonomously smart and innovative services. Cloud computing serves as an effective solution for processing and storing data from IoT devices, enabling remote access for end-users. However, authenticating remote users poses a critical challenge. Although several existing schemes tackle this challenge, they have notable security and performance weaknesses. This paper introduces a lightweight, distributed multi-factor authentication scheme for remote users in IoT. The proposed approach, named Lightchain, integrates blockchain technology and fog computing while incorporating a lightweight cryptographic hash function. The security of Lightchain is rigorously confirmed through formal verification using the well-recognized Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. Additionally, we develop and assess Lightchain’s functionality using the solidity language across diverse use cases. A comparative analysis is presented to evaluate performance costs and security requirements against recent methods. The proposed scheme demonstrates efficiency and robustness, making it well-suited for a range of IoT applications.

Multi-factor authentication scheme based on custom attributes

Multi-factor authentication scheme based on custom attributes

AI-Oriented Two-Phase Multifactor Authentication in SAGINs: Prospects and Challenges

Space-air-ground integrated networks (SAGINs), which have emerged as an expansion of terrestrial networks, provide flexible access, ubiquitous coverage, high-capacity backhaul, and emergency/disaster recovery for mobile users (MUs). While the massive benefits brought by SAGIN may improve the quality of service, unauthorized access to SAGIN entities is potentially dangerous. At present, conventional crypto-based authentication is facing challenges, such as the inability to provide continuous and transparent protection for MUs. In this article, we propose an AI-oriented two-phase multi-factor authentication scheme (ATMAS) by introducing intelligence to authentication. The satellite and network control center collaborate on continuous authentication, while unique spatial-temporal features, including service features and geographic features, are utilized to enhance the system security. Our further security analysis and performance evaluations show that ATMAS has proper security characteristics which can meet various security requirements. Moreover, we shed light on lightweight and efficient authentication mechanism design through a proper combination of spatial-temporal factors.

Smartphone-Key: Hands-Free Two-Factor Authentication for Voice-Controlled Devices Using Wi-Fi Location

In the last few years, Internet of Things (IoT) devices have evolved at an accelerated rate. Smart technology is leaning towards new human-device interaction interfaces that lack screens or buttons, thus reducing the cost of the devices while offering a more natural user experience. Voice is one of the most extended IoT user interfaces nowadays and has been popularized with the advent of smart assistants. However, with the adoption of voice interfaces, new challenges arise in terms of security. According to our research, the complexity of speaker recognition has led to non-reliable voice authentication on IoT devices. Recent approaches to solve this problem include multi-factor authentication (MFA) schemes, but existing solutions, such as one-time passwords (OTP), virtual/physical buttons, and others, have a significant impact on the user experience that is not suitable for all applications and can negate the hands-free benefits of voice interfaces. In addition, the privacy concerns of voice biometrics hinder the development of personalized voice applications that require user accounting and access control policies. Motivated by this security concern, in this paper, we present a two-factor authentication (2-FA) scheme for voice-activated devices that uses a smartphone as a key to authorize voice commands when the user’s presence is detected. The proposed security model, which makes use of Wi-Fi location for presence detection, was implemented on an Amazon Echo device and an Android smartphone, the results proved that the denominated Smartphone-key model can protect against the most common attack vectors on voice-controlled devices without affecting the user experience.

Lightweight blockchain-assisted intrusion detection system in energy efficient MANETs

This paper focuses on achieving high-level security in Mobile Adhoc Networks (MANET) by incorporating Blockchain technology-based Intrusion Detection systems (IDS). The existing works on MANET security focus on either security prevention or detection. Thus, the security level attained by the prior works is unable to cope with the increasing attacks. To resolve this main issue, this research paper introduces Lightweight Blockchain assisted Intrusion Detection System (LB-IDS) which jointly prevents and detects the attacks held on mobile networks. Initially, the network nodes are authenticated by a lightweight Blockchain-based Multi-Factor Authentication (LBMFA) scheme. This procedure prevents the malicious nodes entry to the network. Then, data packets are transmitted through the optimal route which is selected by Multi-Objective Strawberry Optimization (MOSO) algorithm. The collected data packets are fed into IDS which classifies the data into normal and malicious packets. For IDS, we proposed Deep Q-Learning (DQL) algorithm which takes actions by learning the environment. As the mitigation step, the Blockchain is updated with the trust value according to the data packet classification. For such continuous monitoring, K-Mode Clustering (KMC) algorithm is proposed. On the whole, the proposed work improves the network security in MANET through Prevention, Detection, and Mitigation. The results of the presented work attains better security level, packet delivery ratio (PDR), energy efficiency, delay, and detection accuracy.

Threshold Lattice-Based Signature Scheme for Authentication by Wearable Devices

This paper presents a new threshold signature scheme based on Damgaard’s work. The proposed scheme allows for changing the message signature threshold, thereby improving the flexibility of the original Damgaard scheme. This scheme can be applied as a user authentication system using wearable devices. Based on the hardness of lattice problems, this scheme is resistant to attacks on a quantum computer, which is an advantage over the currently used multi-factor authentication schemes. The scheme’s security relies on the computational complexity of the Module-LWE and Module-SIS problems, as well as the Shamir secret sharing scheme’s security.

MAKA: Multi-Factor Authentication and Key Agreement Scheme for LoRa-Based Smart Grid Communication Services

The Smart Grid (SG) is an emerging technology to maintain an actual balance between energy production and usage by offering quite well tracking and regulation over the SG communication technology. However, SG technology becomes more vulnerable to network attacks since its monitoring and controlling are carried out over standard internet-based protocols or on public communication networks. Thus, without the involvement of an authentication mechanism and lack of privacy preservation attackers easily succeed to tamper with the communication channel and send fabricated messages. Hence, authentication has now become a critical security aspect in smart grid technology. There are some authentication mechanisms implemented in the literature to offer a set of security services, namely confidentiality of the credentials, the secrecy of shared session key, and secure mutual authentication. Most of the existing schemes are inefficient and generate high overhead in the networks. Hence, there is a requirement to implement an efficient and secure session key management scheme. The proposed Multi-factor Authentication and Key Agreement (MAKA) scheme for LoRa-based SG communication services provides anonymity and maintains secrecy of the session keys by introducing multi-factor authentication of the end devices. The proposed scheme uses unique device features and generates a fingerprint of the device that will help to maintain user anonymity. The formal security analysis of the proposed MAKA scheme is carried out by Automated Validation of Internet Security Protocols and Application (AVISPA) and ProVerif tools. The results of both show that the proposed MAKA scheme is safe enough to overcome various security attacks. Moreover, the performance is evaluated concerning the existing scheme in the literature and it is recognized that the proposed MAKA scheme generates competitive communication, computation, and storage overheads. In addition, it maintains the device anonymity and meets the security aspect of the SG communication services.

KSDSLD — A tool for keystroke dynamics synthesis & liveness detection

Keystroke dynamics is a behavioral biometrics modality that employs the characteristic typing patterns of users to verify their identity, generally as a part of a multifactor authentication scheme. Naïve implementations of keystroke dynamics verification are susceptible to presentation attacks with synthesized samples, leveraging partial or complete knowledge of the legitimate users’ typing patterns to forge accurate imitations of their behavior. The companion article has presented several novel methods for the synthesis of forged keystroke dynamics samples given one or more authentic samples of free text by the legitimate user, and a liveness detection method that employs the latter as adversaries to train a classification model, which can distinguish human-written samples from synthetic forgeries. Here, we provide the implementation and its source code.

Understanding Failures in Security Proofs of Multi-Factor Authentication for Mobile Devices

Multi-factor authentication is a promising way to enhance the security of password-based authenticated key exchange (PAKE) schemes. It is widely deployed in various daily applications for mobile devices (e.g., e-Bank, smart home, and cloud services) to provide the first line of defense for system security. However, despite intensive research, how to design a secure and efficient multi-factor authentication scheme is still a challenging problem. Hundreds of new schemes have been successfully proposed, and many are even equipped with a formal security proof. However, most of them have been shortly found to be insecure and cannot achieve the claimed security goals. Now a paradox arises: How can a multi-factor scheme that was “formally proven secure” later be found insecure? To answer this seemingly contradicting question, this paper takes a substantial first step towards systematically exploring the security proof failures in multi-factor authentication schemes for mobile devices. We first investigate the root causes of the “provable security” failure in vulnerable multi-factor authentication schemes under the random oracle model, and classify them into eight different types in terms of the five steps of conducting a formal security proof. Then, we elaborate on each type of these eight proof failures by examining three typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 70 representative multi-factor authentication schemes under our extended evaluation criteria. The schemes we select range from 2009 to 2022, and the comparison results suggest that understanding failures in formal security proofs is helpful to design more secure multi-factor authentication protocols for mobile devices.

Lightweight and Secure Multi-Factor Authentication Scheme in VANETs

The idea of a smart city and the utilization of vehicles are emerging rapidly. For inter-vehicular communication, this progression builds Vehicular Ad-Hoc Network (VANET) an extensively used network. The VANET is used to obtain information regarding the road's condition, location of vehicles, speed, and traffic congestion description. The exchange of information in VANET is public which leads to severe security threats. Generally, one of the most crucial tasks in VANET is the security of data. So it becomes one of the urgent tasks of researchers. We have reviewed several authentication schemes for VANETs. Still, most schemes are not secure due to several attacks such as replay, denial of services, impersonation attacks, etc. Furthermore, the existing schemes used higher communication and computational costs, and they are also incompatible with VANET applications that are resource-constrained. This article presents the lightweight and secure multi-factor authenticated key agreement scheme for VANETs to ensure efficient and secure transmission of data via an open channel. Our presented scheme is secure, scalable, and lightweight compared to existing schemes due to its low computation and communication cost. The formal and informal security analysis proved that our scheme is more reliable, practical, and secure against several unknown adversarial attacks in VANETs.

MOBILE CLOUD COMPUTING SERVICES AUTHENTICATION SCHEME

Because of the rapid growth of cloud computing and the expansion of mobile phone users in recent years, mobile cloud computing has attracted wide attention. In the mobile cloud, wireless computing networks are the basics of sharing data between mobile devices and cloud services. Since air is the communication medium, it must be properly protected; otherwise, it will be subject to a variety of security threats, for example, attacks from middle-man, identity tracking, etc... Furthermore, mobile devices are limited in storage, resources, and computing powers. Hence, designing an efficient and secure balance of authentication schemes is extremely important. First of all, a multi-factor authentication scheme based on biometric (fingerprint information), hash function, and fuzzy vault algorithm is presented in that paper. Secondly, the Validation and Analysis tool of AVISPA Security was approved. Thirdly, the security of the scheme proposed is compared to other related schemes.

A secure and efficient computation based multifactor authentication scheme for Intelligent IoT-enabled WSNs

In recent years, network-enabled physical devices have emerged as a solution to many problems, such as those involved in transmitting data from the physical world, communicating, and safeguarding information. The process of data transmission is vulnerable to a range of threats and must be secured because an open communication channel is considered for data transmission. One way to eliminate this security risk is by using a reliable and secure mutual authentication method. To accomplish this, a secure and reliable computation-based multifactor authentication approach is proposed for Intelligent IoT-enabled WSNs. To reduce the computational and communication overhead, a physically unclonable function-based secure authentication approach is proposed for sensor node's mutual authentication. In addition, to maintain the confidentiality of session key, a secure session is established among user, basestation, and nodes by using an adaptive session key update procedure. Moreover, formal and informal security analyses are performed for different aspects of security attacks.

CovertSYS: A systematic covert communication approach for providing secure end-to-end conversation via social networks

While encryption can prevent unauthorized access to a secret message, it does not provide undetectability of covert communications over the public network. Implementing a highly latent data exchange, especially with low eavesdropping/discovery probability, is challenging for practical scenarios, such as social and political movements in authoritarian regimes, military operations, and privacy preservation. Moreover, the current literature suffers from a low embedding capacity and monolingual applicability, limiting the amount of hiding secret data within short text messages using state-of-the-art algorithms, e.g., linguistic-based, structural-based, or coverless-based solutions. In this paper, we present a systematic covert communication technique called CovertSYS that enables a multilingual secure end-to-end conversation via messaging or social network platforms. The CovertSYS functions by encrypting a confidential message using a multi-factor authentication scheme and converting the encoded binary data into hidden Unicode symbols to be transmitted under cover of short text messages. We then conduct extensive experiments to confirm the security and validity of the proposed technique against state-of-the-art approaches. Our experimental results show that the CovertSYS provides a superior mean performance of 91.53% by improving the criteria scores: embedding capacity rate of 100%, imperceptibility rate of 76.4%, and distortion robustness rate of 98.2%. Finally, we discuss the practical implications of the proposed technique compared to the existing text steganography methods.

A Collaborative Detection Method of Wireless Mobile Network Intrusion Based on Cloud Computing

In order to improve the communication security of wireless mobile network, a collaborative intrusion detection method based on cloud computing is studied. The mobile terminal and the cloud computing platform are connected by the wireless mobile network. The cloud computing platform authentication server adopts a dual server and multifactor authentication scheme for mobile cloud computing to provide authentication services for mobile terminal users. The web server of the cloud computing platform uses the intrusion node detection protocol of the neighbor classification mechanism to provide a communication security protocol for users; Using the HMM algorithm, the intrusion detection module of the computing platform realizes the intrusion detection of wireless mobile network. Finally, using authentication service, security protocol, and intrusion detection module completes the cooperative detection of mobile network intrusion. The experimental results show that this method can realize the cooperative detection of wireless mobile network intrusion, and the detection accuracy is as high as 98%, which ensures the communication security of wireless mobile network.

Multifactor Authentication for Smart Emergency Medical Response Transporters.

Securing telehealth IoT infrastructure is essential to provide high-level medical care and prevent cyberattacks. A vulnerable stage in IoT telehealth is while the patient is being transported to a healthcare facility, the transporter could be an ambulance or an air ambulance. In this paper, we propose a multifactor authentication scheme to secure the system when the patient is in transit to the healthcare facility. We apply this scheme to an ambulance, using physical unclonable functions (PUFs) embedded in the ambulance to facilitate authentication and secure key exchange. We validated the security of the proposed scheme using formal and informal security analysis. The analysis supports our claim that the proposed scheme protects against many types of attacks.

Privacy-preserving multi-factor authentication and role-based access control scheme for the E-healthcare system

E-healthcare assists medical specialists in remotely collecting patient health data and providing remote health diagnoses. The roles are distributed among the system's users, contrasted between admin to data entry within certain rules and policies. Role-based access control (RBAC) is a technique of advanced access control that restricts key operations of users (addition, deletion and modification) access based on a user's role within a healthcare system. This paper proposes a privacy-preserving using RBAC and smart multi-factor authentication for the healthcare system to overcome the limitation flaw in previous schemes such as security risk tolerance, scalability and dynamism. This work relies on low-complexity cryptographic hash functions and symmetric operations to authenticate users while using an asymmetric cryptosystem based on the Schnorr digital signature lightweight operation to authenticate the administrator to provide multi-factor authentication. The administrator represents the system's core, and any his information leak could attack the entire system and its components. The proposed scheme conducted two thorough formal security proofs for the proposed work based on informal analysis and the Scyther tool. Furthermore, comparisons with other schemes reveal that the proposed scheme provides greater security features, and resisting attacks than the others while also being efficient in computing and communication costs.

Multi-Factor Authentication for Online Security of Android Devices

Digitalization decisively penetrates all the sides of modern society. One of the critical enablers to maintaining this process secure is using Authentication. It spreads many different areas of a hyper-connected world, including online payments, communications, access-right management, and others. This paper sheds light on the evolution of authentication systems toward Multi-Factor Authentication (MFA). Multi-factor Authentication is expected to be utilized for human-to-everything interactions by enabling fast, user-friendly, and reliable Authentication when accessing a service. This paper surveys how multi-factor authentication schemes can be used to secure online-android devices. Keywords: Multi-Factor Authentication, Online Security, Android Devices, Cybercrimes

Secure Multifactor Authentication and Access Control Mechanism for Electronic Bill Service in a 5G Cloud-Fog Hybrid Architecture

The electronic bill service was greatly encouraged by electronic commerce and paperless bills. However, the massive authentication and authorization access requests from users in the electronic bill services cannot be efficiently processed by a conventional client/server-based scheme during the 5G era. This paper proposes a secure multifactor authentication and access control scheme tailored for electronic bill service in a 5G cloud-fog hybrid architecture. The proposed scheme can realize many security properties, including mutual authentication, privacy protection, batch authentication, authorization and revocation of authority, and resistance to multiple protocol attacks. Moreover, the scheme has the desired performance compared to similar schemes. Finally, we used BAN logic and Scyther to analyze and verify the proposed protocol, and the result shows that the proposed scheme is stable and can achieve the previous security goals.

Zero-Trust-Based Protection Scheme for Users in Internet of Vehicles

At present, the Internet of Vehicles technology is developing rapidly, but in the process of networking it may be attacked by hackers. In view of the tampering attack on the user’s device and identity, we establish a multifactor authentication scheme to achieve dual identity authentication through device fingerprint authentication and PKI authentication. In response to the attack by hackers in the application of data transmission, we use the SM series of state secret algorithms for data encryption and take advantage of the immutable and decentralized characteristics of blockchain to ensure the security and integrity of data collection and transmission. Through the zero-trust security network architecture, the security level of the system in the process of data transmission is effectively improved, the identity-centered dynamic access control is carried out, the user’s behavior is monitored in real time, and the malicious nodes are screened and eliminated, which improves the stability and security of the Internet of Vehicles data transmission system. By adopting the identity authentication pass rate, fingerprint authentication pass rate, API authentication pass rate, and SPA packet transmission acceptance rate as the factor set, the evaluation level of the vehicles is calculated. The experimental results show that compared with the traditional boundary-centered security protection, our scheme can protect a wider range of application security, even if there are security problems, the loss is less. Through the training simulation of the convolutional neural network, the classification accuracy of the trust level is improved.