Multi-factor Authentication Scheme Using Mobile App and Camera

Abstract

Phishing attacks are one of the most serious threats faced by the users on the internet the attackers try to steal sensitive information such as login details, credit card details, etc. by deceiving the users to enter sensitive information on the phishing websites and thus leading to huge financial losses. Many schemes have been proposed to detect phishing attacks but the amount of such attacks has not decreased. New attacks like Active Man-In-The-Middle (MITM) phishing attacks have emerged which include Real-Time Man-In-The-Middle (RT MITM) and Controlled Relay Man-In-The-Middle (CR MITM) phishing attacks. These attacks allow the attackers to obtain the users’ account details and relay them in real-time. Similarly, the attacker can lure the user to enter details on a spoofed app and thus gain access to the user’s account. The existing popular authentication schemes fail to address these attacks. In this paper, we propose a novel user authentication scheme that enables the user to log into his/her account without memorizing any password or any other authentication token. In the proposed scheme, the user has to scan a dynamically generated QR-code using the smartphone app and then verify the image, captured by the webcam and sent it on the smartphone via push notification. Thus, the complete authentication procedure requires minimal user involvement and implements automatically. We have implemented and evaluated the proposed scheme in terms of usability, deployability, and security parameters and the results depict that the proposed authentication scheme performs well and can be used as a secure user authentication scheme.