Two-factor Authentication Mechanism Research Articles

A Provably Secure and Lightweight Two-Factor Authentication Protocol for Wireless Sensor Network

Wireless Sensor Networks (WSNs) are rapidly being integrated into various fields, significantly impacting and facilitating many aspects of human life. However, the increasingly prominent security issues associated with WSNs have become a significant challenge. This paper provides an in-depth analysis of the security challenges faced by WSNs in resource constrained and open communication environments. As a key component of the Internet of Things (IoT), a WSN can perceive, collect and transmit physical environmental data in real-time, and is widely used in military, medical, agricultural and other fields. However, the insecurity of communication channels and unauthorized user access pose severe threats to network security and data integrity. To address these challenges, this paper proposes a provably secure two-factor authentication protocol. This protocol utilizes a Chebyshev chaotic map and a two-factor authentication mechanism, which not only enhances security in WSNs but also improves authentication efficiency. The protocol is validated through security proof and performance experiments, demonstrating excellent security, functionality and efficiency. This provides strong support for secure and efficient communication in WSNs across various application scenarios.

E-Authentication System using QR Code and OTP

This paper proposes an authentication system that combines One-Time Password (OTP) and Quick Response (QR) code technologies to enhance security and user experience. The system generates an OTP and a unique QR code for each authentication attempt, which can be scanned using a mobile device to complete the authentication process. The QR code contains encrypted information about the user's identity and the OTP, which is verified by the server. The proposed system provides a secure, convenient, and efficient method for user authentication, which is crucial in today's digital world. An e-authentication system that uses OTP and QR code technology is a secure and efficient method for authenticating users in online transactions. This system combines the benefits of OTP and QR code technology to provide a two-factor authentication mechanism that is convenient for users and effective in preventing unauthorized access. This system aims to address the vulnerabilities of traditional username and password authentication by providing an additional layer of security through two-factor authentication. the system aims to prevent unauthorized access to online services and transactions. The system aims to provide a userfriendly and convenient authentication method that can be easily integrated into existing online platforms. It protect sensitive information and ensure that only authorized users can access online services and transactions

Gesture-Related Two-Factor Authentication for Wearable Devices via PPG Sensors

Verifying the user identity of wearable devices is crucial for system security, especially for sensitive operations like making financial payments. A PPG-based two-factor authentication can be a promising solution with widely deployed PPG (Photoplethysmography) sensors within wearable devices. Our observations find PPG readings reveal a significant relevance to the user’s hand motions, i.e., gestures, while the user’s heartbeat characteristics and wearing habits are also implicitly related, which can be utilized for user authentication. In this paper, we design G-PPG, a gesture-related PPG-based two-factor authentication mechanism that can non-intrusively validate the user’s identity. In G-PPG, a gesture detection and segmentation module and a specific feature set are designed for accurate gesture-related PPG characteristic extraction. Moreover, a user-defined security level and an adaptive update scheme are proposed for the high accuracy of long-term authentication. The experiment results among 15 participants demonstrate that G-PPG can achieve an over 90% accuracy in different scenarios on average. With a carefully designed authentication mechanism, the pass rate for legitimate users can reach up to 96.67%, while the value is only 0.62% for attackers.

Blockchain-Based Services Implemented in a Microservices Architecture Using a Trusted Platform Module Applied to Electric Vehicle Charging Stations

Microservice architectures exploit container-based virtualized services, which rarely use hardware-based cryptography. A trusted platform module (TPM) offers a hardware root for trust in services that makes use of cryptographic operations. The virtualization of this hardware module offers high usability for other types of service that require TPM functionalities. This paper proposes the design of TPM virtualization in a container. To ensure integrity, different mechanisms, such as attestation and sealing, have been developed for the binaries and libraries stored in the container volumes. Through a REST API, the container offers the functionalities of a TPM, such as key generation and signing. To prevent unauthorized access to the container, this article proposes an authentication mechanism based on tokens issued by the Cognito Amazon Web Service. As a proof of concept and applicability in industry, a use case for electric vehicle charging stations using a microservice-based architecture is proposed. Using the EOS.IO blockchain to maintain a copy of the data, the virtualized TPM microservice provides the cryptographic operations necessary for blockchain transactions. Through a two-factor authentication mechanism, users can access the data. This scenario shows the potential of using blockchain technologies in microservice-based architectures, where microservices such as the virtualized TPM fill a security gap in these architectures.

Brightness Based Password Safeguard System with Face Recognition in ATM

the importance of security in the authentication process as well as the increase in threat level posed by such malware has attracted many researchers to the field. Many attacks are successful in accessing social network accounts since the current password-based authentication paradigms are not efficient and robust enough as well as vulnerable to automated attacks. The traditional two-factor authentication mechanisms are not applicable to online social networks because physical token or biometric data cannot be easily used to log into users’ profiles. The simplest alternative is complementing the single factor (password-based) authentication process with additional identification elements, such as one-time PIN codes, generated by the user’s own device (e.g. the smart phone) or received via SMS. Proposed a brightness based authentication mechanism (i.e., Bright Pass) capable of enhancing the security of identity confirmation PIN codes without asking the user to memorize an additional secret value or to solve a complex cognitive task. This method introduces a new input value that is changed at every usage combining a something you know element (i.e., the PIN) with an interface element that cannot be captured by spyware, i.e., a bright or dark circle displayed on the phone screen to tell the user when to digit the correct PIN digit and when to digit a fake one. It prevents the malware from correctly inserting the PIN code, thereby disallowing the possibility to perform critical operations without the user’s agreement. Proposed work also focuses on implementing secure face recognition approach for user authentication. This approach will enhance the performance of ATM system

Quantum2FA: Efficient Quantum-Resistant Two-Factor Authentication Scheme for Mobile Devices

Smart-card based password authentication has been the most widely used two-factor authentication (2FA) mechanism for security-critical applications (e.g., e-Health, smart grid and e-Commerce) in the past decades, and it is likely to hold its status in the foreseeable future. Hundreds of this type of 2FA schemes have been proposed, yet to our knowledge, most of them are built on the intractability of conventional hard problems (e.g., discrete logarithm problems and integer factoring problems) which are no longer hard in the quantum era. With the recent advancements in quantum computing, the design of secure and efficient smart-card based password authentication schemes against quantum attacks is becoming increasingly urgent. However, it is not as simple as it seems, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">how to design such a quantum-resistant 2FA scheme is challenging due to the demanding security requirements and the resource-constrained nature of mobile devices</i> . In this work, we take the first step towards this issue by proposing Quantum2FA, a practical quantum-resistant smart-card-based password authentication scheme that employs Alkim <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> ’s lattice-based key exchange and Wang-Wang’s “fuzzy-verifier + honeywords” technique (IEEE TDSC’18). Particularly, Quantum2FA can thwart the newly revealed key-reuse attack (ACISP’18, CT-RSA’19) against lattice-based key exchange schemes in two aspects: signal leakage attacks and key mismatch attacks. Specifically, it restricts the necessary conditions (i.e., the attacker must be the initiator of the key exchange) for an adversary to analyze the signal; It introduces honeywords to detect the key mismatches between the smart card and the server, and thus smart card loss attack can be thwarted. We formally prove the security of Quantum2FA under the random oracle model and demonstrate its efficiency through experiments on a 32 MHz 8-bit AVR Embedded Processor. Comparison results show that Quantum2FA is not only more secure but also offers better computation efficiency than the state-of-the-art conventional 2FA schemes.

Physical Unclonable Function and Hashing Are All You Need to Mutually Authenticate IoT Devices.

Internet of Things (IoT) has become the driving force in modern day technology with an increasing and rapid urge to create an intelligent, efficient, and connected world. IoT is used in manufacturing, agriculture, transportation, education, healthcare and many other business environments as well as home automation. Authentication for IoT devices is essential because many of these devices establish communication with servers through public networks. A rigorous lightweight device authentication scheme is needed to secure its physical hardware from cloning or side-channel attacks and accommodate the limited storage and computational power of IoT devices in an efficient manner. In this paper, we introduce a lightweight mutual two-factor authentication mechanism where an IoT device and the server authenticate each other. The proposed mechanism exploits Physical Unclonable Functions (PUFs) and a hashing algorithm with the purpose of achieving a secure authentication and session key agreement between the IoT device and the server. We conduct a type of formal analysis to validate the protocol’s security. We also validate that the proposed authentication mechanism is secure against different types of attack scenarios and highly efficient in terms of memory storage, server capacity, and energy consumption with its low complexity cost and low communication overhead. In this sense, the proposed authentication mechanism is very appealing and suitable for resource-constrained and security-critical environments.

Sparse coding-based feature extraction for biometric remote authentication in Internet of Things

In recent years, Internet of Things (IoT) has attracted lots of attention. However, the security related issues such as authentication remain a challenge. The heterogeneity of IoT in terms of devices and communication makes most existing authentication mechanisms inapplicable. So, there is a need for a two-factor authentication mechanism to obtain an end-to-end authentication between IoT devices/applications. In this paper, we propose a sparse coding based feature extraction for biometric remote user authentication. The proposed scheme makes use of sparse codes hash operations and overcomplete dictionary to store/retrieve the biometric data efficiently. The performance analysis proves that the proposed method is robust against noise and able to obtain the accuracy of 0.97.

Round Trip Latency Based Authentication Scheme in Fog-Enabled Cloud Computing System

In fog-enabled cloud computing framework, one of the most challenges is security promises due to the compromised passwords. To overcome this issue, different multifactor authentication schemes have been developed that requires additional authentication credentials along with the standard password to authenticate the login. Among those schemes, Communication Latency-based Authentication Scheme (CLAS) increases the protection of conventional web authentication schemes by leveraging the Round Trip network communication Latency (RTL) between clients and authenticators together with standard password. It uses RTL of clients to secure against password compromise. On the other hand, it can support compromise of either the password or the profiled location of a user. This makes it susceptible to same location attacks. As a result, an integration of additional profiling features is needed to attain more robust and flexible defense against password compromise. Hence in this paper, an extended CLAS is proposed that mainly investigates the mobility and same location challenges in CLAS. Initially, the legitimate login failures are solved by handling both selective and arbitrary mobility of users. For selective mobility case, CLAS generates an individual profile for each location and the user may be granted access if his/her real-time login profile matches any of the stored reference profiles. For arbitrary mobility case, CLAS is integrated with two-factor authentication mechanism to authenticate the user. In addition, the defense against Mimic attacks is improved by utility metric-based location anonymization and obfuscation of RTL algorithms. By using these algorithms, the user’s locations are anonymized and the values of RTL are obfuscated to defend against user compromise attempts for impersonating the RTL by getting nearer to the user location. Moreover, a keystroke dynamics measure is introduced with obfuscated RTL measures to effectively defend the same location attacks. This technique alleviates the potential impacts of network instabilities on RTL measurements. As well, it increases the authentication sample space and so improves the security guarantee of CLAS. Finally, the simulation outcomes illustrate that an extended CLAS has the ability to reduce both false positive and false negative rates.

The implementation of two-factor web authentication system based on facial recognition

AbstractThe security of the web is a very important issue, because every day we make a variety of operations in it, for different reasons, during the day. Apart from protecting the information, contacts, accounts and data on the web, such data should be inaccessible to third-party persons. This in turn depends on the success of the authentication process performed on the individual web. With authentication, it is possible for users to protect their information and make their transactions only for themselves. However, the authentication mechanism used at this point must have a high level of safety. With the purpose to damage a person's privacy and access account information and gain profit in this way, many malicious persons have developed various methods of attacks to bypass authentication mechanisms. These methods sometimes succeed on a variety of authentication mechanisms, and put users and relevant websites into a difficult situation, and may even damage them in a variety of aspects. In order to protect personal information on the web system and provide the security of transactions carried out at a high level, in this study, we propose a two-factor authentication mechanism based on facial recognition. Besides, we discuss some implementation details about the proposed method. The proposed method aims to bring a new approach to the authentication system to perform our online process with the highest security. In addition to the standard authentication systems, using face recognition as a secondary level of security will contribute to the emergence of a new authentication mechanism.

The implementation of two-factor web authentication system based on facial recognition

The security of the web is a very important issue, because every day we make a variety of operations in it, for different reasons, during the day. Apart from protecting the information, contacts, accounts and data on the web, such data should be inaccessible to third-party persons. This in turn depends on the success of the authentication process performed on the individual web. With authentication, it is possible for users to protect their information and make their transactions only for themselves. However, the authentication mechanism used at this point must have a high level of safety. With the purpose to damage a person's privacy and access account information and gain profit in this way, many malicious persons have developed various methods of attacks to bypass authentication mechanisms. These methods sometimes succeed on a variety of authentication mechanisms, and put users and relevant websites into a difficult situation, and may even damage them in a variety of aspects. In order to protect personal information on the web system and provide the security of transactions carried out at a high level, in this study, we propose a two-factor authentication mechanism based on facial recognition. Besides, we discuss some implementation details about the proposed method. The proposed method aims to bring a new approach to the authentication system to perform our online process with the highest security. In addition to the standard authentication systems, using face recognition as a secondary level of security will contribute to the emergence of a new authentication mechanism.&#x0D; &#x0D; Keywords: Web authentication, two-factor authentication, web security, facial recognition.&#x0D; &#x0D; The security of the web is a very important issue, because every day we make a variety of operations in it, for different reasons, during the day. Apart from protecting the information, contacts, accounts and data on the web, such data should be inaccessible to third-party persons. This in turn depends on the success of the authentication process performed on the individual web. With authentication, it is possible for users to protect their information and make their transactions only for themselves. However, the authentication mechanism used at this point must have a high level of safety. With the purpose to damage a person's privacy and access account information and gain profit in this way, many malicious persons have developed various methods of attacks to bypass authentication mechanisms. These methods sometimes succeed on a variety of authentication mechanisms, and put users and relevant websites into a difficult situation, and may even damage them in a variety of aspects. In order to protect personal information on the web system and provide the security of transactions carried out at a high level, in this study, we propose a two-factor authentication mechanism based on facial recognition. Besides, we discuss some implementation details about the proposed method. The proposed method aims to bring a new approach to the authentication system to perform our online process with the highest security. In addition to the standard authentication systems, using face recognition as a secondary level of security will contribute to the emergence of a new authentication mechanism.&#x0D; Keywords: Web authentication, two-factor authentication, web security, facial recognition.&#x0D;

Two Birds with One Stone: Two-Factor Authentication with Security Beyond Conventional Bound

As the most prevailing two-factor authentication mechanism, smart-card-based password authentication has been a subject of intensive research in the past two decades, and hundreds of this type of schemes have wave upon wave been proposed. In most of these studies, there is no comprehensive and systematical metric available for schemes to be assessed objectively, and the authors present new schemes with assertions of the superior aspects over previous ones, while overlooking dimensions on which their schemes fare poorly. Unsurprisingly, most of them are far from satisfactory-either are found short of important security goals or lack of critical properties, especially being stuck with the security-usability tension. To overcome this issue, in this work we first explicitly define a security model that can accurately capture the practical capabilities of an adversary and then suggest a broad set of twelve properties framed as a systematic methodology for comparative evaluation, allowing schemes to be rated across a common spectrum. As our main contribution, a new scheme is advanced to resolve the various issues arising from user corruption and server compromise, and it is formally proved secure under the harshest adversary model so far. In particular, by integrating “honeywords”, traditionally the purview of system security, with a “fuzzy-verifier”, our scheme hits “two birds”: it not only eliminates the long-standing security-usability conflict that is considered intractable in the literature, but also achieves security guarantees beyond the conventional optimal security bound.

ECCO Mnemonic Authentication—Two-Factor Authentication Method with Ease-of-Use

Not very long ago, organizations used to identify their customers by means of one-factor authentication mechanisms. In today's world, however, these mechanisms cannot overcome the new security threats at least when it comes to high risk situations. Hence, identity providers have introduced varieties of two-factor authentication mechanisms. It may be argued that users may experience difficulties at time of authentication in systems that use two-factor authentication mechanisms for example because they may be forced to carry extra devices to be authenticated more accurately. This is however the tradeoff between ease-of-use and having a secure system that may be decided by the users and not the security providers. In this paper we present a new two-factor authentication mechanism that secures systems and at the same time is easier to use. We have used mnemonic features and the cache concept to achieve ease-of-use and security, respectively. Also, we have tested our method with almost 6500 users in real world using The Mechanical Turk Developer Sandbox. Index Terms—Security, authentication, identification, privacy, cache-based, mnemonic.

Two-factor authentication system based on extended OTP mechanism

The recent increase in smartphone supply drives more users to utilize mobile financial services and it magnifies the importance of mobile security solutions. But it is not easy to defend cyber-attacks against financial services because the attacks get more diverse every year. The recent solution, OTP (one time password), is the most commonly used financial security measure to defend session attacks, but the downside is that it is hard to implement differentiated OTP creation mechanism to it. This research intends to solve the problem by suggesting Two-Factor authentication mechanism that utilizes graphical OTP. It is an extension of OTP mechanism which implements the graphical one time password to mobile financial security to reinforce mobile's way of authenticating with only ID and Password or digital certificate from banks; and it will defend against more diverse mobile hackings.

A simple and robust anonymous two-factor authenticated key exchange protocol

Recently two-factor authenticated key exchange (AKE) protocols have been widely used in various networks to ensure communication security. In 2009, Sun et al. proposed an improved password authenticated key agreement scheme based on smart cards. It is efficient in two-factor authentication key exchange protocols. However, we found that the scheme of Sun et al. was vulnerable to a password-guessing attack and a key compromise impersonation (KCI) attack. We made an improvement on the scheme of Sun et al. by using an elegant but simple trick to eliminate the security vulnerabilities. The improved scheme possesses untraceability, which is absent in the scheme of Sun et al. but important in anonymous communication. Moreover, the new scheme can also resist KCI attack, which is a strong secure property in AKE protocol. We proved the security of our protocol in the random oracle model provided that the Elliptic Curve Gap Diffie–Hellman assumption holds. The trick used in this paper can provide a new way for designing authenticated key agreement in two-factor authentication mechanism. Copyright © 2012 John Wiley & Sons, Ltd.

A Trusted Portable Computing Device

Abstract A trusted portable computing device and its security mechanism were presented to solve the security issues, such as the attack of virus and Trojan horse, the lost and stolen of storage device, in mobile office. It used smart card to build a trusted portable security base, virtualization to create a secure virtual execution environment, two-factor authentication mechanism to identify legitimate users, and dynamic encryption to protect data privacy. The security environment described in this paper is characteristic of portability, security and reliability. It can meet the security requirement of mobile office.

A Novel Two-Stage Approach in Rectifying BioHash's Problem under Stolen Token Scenario

Over recent years, much research attention has been devoted to a two-factor authentication mechanism which integrates both tokenized pseudorandom numbers with user specific biometric features for biometric verification, known as Biohash. The main advantage of Biohash over sole biometrics is that Biohash is able to achieve a zero equal error rate and provide a clean separation of the genuine and imposter populations, thereby allowing elimination of false accept rates without imperiling the false reject rates. Nonetheless, when the token of a user is compromised, the recognition performance of a biometric system drops drastically. As such, a few solutions have been proposed to improve the degraded performance but such improvements appear to be insignificant. In this paper, we investigate and pinpoint the basis of such deterioration. Subsequently, we propose a two-level approach by utilizing strong inner products and fuzzy logic weighting strategies accordingly to increase the original performance of Biohash under this scenario.

Two-factor mutual authentication based on smart cards and passwords

One of the most commonly used two-factor user authentication mechanisms nowadays is based on smart-card and password. A scheme of this type is called a smart-card-based password authentication scheme. The core feature of such a scheme is to enforce two-factor authentication in the sense that the client must have the smart-card and know the password in order to gain access to the server. In this paper, we scrutinize the security requirements of this kind of schemes, and propose a new scheme and a generic construction framework for smart-card-based password authentication. We show that a secure password based key exchange protocol can be efficiently transformed to a smart-card-based password authentication scheme provided that there exist pseudorandom functions and target collision resistant hash functions. Our construction appears to be the first one with provable security. In addition, we show that two recently proposed schemes of this kind are insecure.

Implementing CAP

As the increase in pharming, phishing and Trojan attacks leaves bank accounts vulnerable to online fraud, banks continue to search for ways to reduce the impact on their customer base. Separately, the rollout of Chip & PIN is causing card fraud to migrate away from point-of-sale terminals towards cardholder-not-present transactions, which can be conducted online, over the phone or via mail order. Although a variety of approaches exist to address these issues, two-factor authentication mechanisms are emerging as a favourite, with the Chip Authentication Program (CAP) the clear front-runner in the field. Dr Jonathan Tuliani, UK technical director of Cryptomathic, tells CTT how CAP works and details the steps issuers need to take in order to deploy a successful