Abstract:A significant percentage of security research that is conducted suffers from common issues that prevent wide-scale adoption. Common snags of such proposed methods tend to include (i) introduction of additional nodes within the communication architecture, breaking the simplicity of the typical client-server model, or fundamental restructuring of the Internet ecosystem; (ii) significant inflation of responsibilities or duties for the user and/or server operator; and (iii) adding increased risks surrounding sensitive data during the authentication process. Many schemes seek to prevent brute-forcing attacks; they often ignore either partially or holistically the dangers of other cyber-attacks such as MiTM or replay attacks. Therefore, there is no incentive to implement such proposals, and it has become the norm instead to inflate current username/password authentication systems. These have remained standard within client-server authentication paradigms, despite insecurities stemming from poor user and server operator practices, and vulnerabilities to interception and masquerades. Besides these vulnerabilities, systems which revolve around secure authentication typically present exploits of two categories; either pitfalls which allow MiTM or replay attacks due to transmitting data for authentication constantly, or the storage of sensitive information leading to highly specific methods of data storage or facilitation, increasing chances of human error. This paper proposes a more secure method of authentication that retains the current structure of accepted paradigms, but minimizes vulnerabilities which result from the process, and does not inflate responsibilities for users or server operators. The proposed scheme uses a hybrid, layered encryption technique alongside a two-part verification process, and provides dynamic protection against interception-based cyber-attacks such as replay or MiTM attacks, without creating additional vulnerabilities for other attacks such as bruteforcing. Results show the proposed mechanism outperforms not only standardized methods, but also other schemes in terms of deployability, exploit resilience, and speed.

Reducing Usefulness of Stolen Credentials in SSO Contexts

Robust Multi-Factor Authentication for WSNs With Dynamic Password Recovery

A Passwordless MFA Utlizing Biometrics, Proximity and Contactless Communication

Strengthening Security: Implementation of Multi-Factor Authentication (MFA) in Data Center Environment

SMS Goes Nuclear: Fortifying SMS-Based MFA in Online Account Ecosystem

How effective is multifactor authentication at deterring cyberattacks?

Excavating Vulnerabilities Lurking in Multi-Factor Authentication Protocols: A Systematic Security Analysis

"We've Disabled MFA for You": An Evaluation of the Security and Usability of Multi-Factor Authentication Recovery Deployments

Choosing the right MFA method for online systems: A comparative analysis

ROSTAM: A Passwordless Web Single Sign-on Solution Mitigating Server Breaches and Integrating Credential Manager and Federated Identity Systems

A Hybrid Dynamic Encryption Scheme for Multi-Factor Verification: A Novel Paradigm for Remote Authentication

CamAuth: Securing Web Authentication with Camera

Social Engineering Resistant 2FA

Simple But Not Secure: An Empirical Security Analysis of Two-factor Authentication Systems

PROTECT: Efficient Password-Based Threshold Single-Sign-On Authentication for Mobile Users against Perpetual Leakage

On the Usability of Two-Factor Authentication.

Defending Against Identity Threats Using Risk-Based Authentication

Systematic Solutions to Login and Authentication Security Problems: A Dual-Password Login-Authentication Mechanism

Opportunistic Sensor-Based Authentication Factors in and for the Internet of Things

An Alternative to Multi-Factor Authentication with a Triple-Identity Authentication Scheme

Building Low-Interactivity Multifactor Authenticated Key Exchange for Industrial Internet of Things