Abstract:Industrial Internet of Things (IIoT) brings together computers, devices, advanced analytics, and people in industries such as transportation, oil plant and power grid, that leads to major efficiency and productivity gains for almost any industrial procedures. Due to the interconnection of devices in IIoT, communication security has become a critical issue to address in many emerging industry standards which require the authentication and key exchange procedure to be done to guarantee the authorized machine access (e.g., from users) and secure the data transmission between machines. To overcome the shortcoming (i.e., low entropy) of the memorable password in user authentication, it is rightfully recommended by industry standards (such as IEC-62443 family) to use multi-factor authentication for higher security levels. Notably, latency is one of the main sources of inefficiency when a device is communicating with other machines on IIoT. To mitigate latency, smooth projective hash function (SPHF) built from wellstudied standard assumptions is used to achieve low-interactivity multi-factor authenticated key exchange protocol (MFAKE), because SPHF allows each party to prove to the others that he knows the right authentication factor(s). In this paper, we are therefore motivated to build a new MFAKE named "secure remote multifactor (SRMF)" to achieve the human involved "machine-to-machine" secure communication in IIoT. That is, SRMF leverages multiple user-centric authentication factors (such as password, biometric fingerprints, and PIN), and it can synergistically support multi-factor registration (MFR), multi-factor authentication (MFA) and multifactor key exchange (MFKE). Further, to prevent authentication factors stored at the server exposing to attackers, the password-harden service (i.e., Pythia-PRF, USENIX'15) inspires us to develop a multifactor hardening service (MFHS) -tilizing an oblivious pseudorandom function (OPRF). The balanced security of the proposed protocol is proved under the model of Bellare-Pointcheval-Rogaway (EUROCRYPTO' 00) along with theoretical and experimental evaluations.

Strengthening Security: Implementation of Multi-Factor Authentication (MFA) in Data Center Environment

Excavating Vulnerabilities Lurking in Multi-Factor Authentication Protocols: A Systematic Security Analysis

Choosing the right MFA method for online systems: A comparative analysis

Evaluating User Perception of Multi-Factor Authentication: A Systematic Review

"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments

Evaluation of System Access Security in The Implementation of Multi-Factor Authentication (MFA) in Educational Institutions

Privacy preserving multi factor authentication using trust management

How effective is multifactor authentication at deterring cyberattacks?

A review of multi-factor authentication in the Internet of Healthcare Things

A Passwordless MFA Utlizing Biometrics, Proximity and Contactless Communication

Two-Layered Multi-Factor Authentication Using Decentralized Blockchain in IoT Environment

VFA: A Variable-Factor Authentication Framework for Mobile Users.

MFA is a Waste of Time! Understanding Negative Connotation Towards MFA Applications via User Generated Content

On the Security of Multi-Factor Authentication: Several Instructive Examples

Reducing Usefulness of Stolen Credentials in SSO Contexts

Password based authentication for web based graphics computing services retrieval in cloud

M2auth: A multimodal behavioral biometric authentication using feature-level fusion

Building Low-Interactivity Multifactor Authenticated Key Exchange for Industrial Internet of Things

Securing Remote Access to Information Systems of Critical Infrastructure Using Two-Factor Authentication

Design and Analysis of a Secure Three Factor User Authentication Scheme Using Biometric and Smart Card

Simple But Not Secure: An Empirical Security Analysis of Two-factor Authentication Systems