A proof of concept implementation of a mobile based authentication scheme without password table for cloud environment

Abstract

Cloud computing is a fast growing technology offering a wide range of software and infrastructure services on a pay-per-use basis. Many small and medium businesses (SMB's) have adopted this utility based Computing Model as it contributes to reduced operational and capital expenditure. Though the resource sharing feature adopted by Cloud service providers (CSP's) enables the organizations to invest less on infrastructure, it also raises concerns about the security of data stored at CSP's premises. The fact that data is prone to get accessed by the insiders or by other customers sharing the storage space is a matter of concern. Regulating access to protected resources requires reliable and secure authentication mechanism, which assures that only authorized users are provided access to the services and resources offered by CSP. This paper proposes a strong two-factor authentication mechanism using password and mobile token. The proposed model provides Single Sign-on (SSO) functionality and does not require a password table. Besides introducing the authentication scheme, the proof of concept implementation is also provided.

D-FAP: Dual-Factor Authentication Protocol for Mobile Cloud Connected Devices

“…In ref. [24], the authors proposed an authentication mechanism using an encrypted password and mobile phone token stored within a mobile phone as the authentication factors. In this mechanism, the registration and the management of the user identity information processes are undertaken by an identity provider (IdP).…”

“…Several authentication approaches have been considered for authenticating users across many different computing platforms, including MCC. Some approaches considered the cryptographic based methods [24,25], where the authentication process is based on exchanging security keys or by using session tickets with trusted third-party entities. Other approaches focus on biometric authentication [26,27], which recognizes the user through physiological or behavioral characteristics unique to the user such as voice recognition, iris scanning, or finger prints.…”

Two Factor Vs Multi-factor, an Authentication Battle in Mobile Cloud Computing Environments

“…A two factor authentication scheme using an encrypted password and mobile phone token stored on the mobile device was introduced in 2015 [13]. In this scheme, an identity provider (IdP) undertook the tasks of registering, storing and managing the user identity information and issuing the user with a token to access the services of the Cloud Service Provider (CSP).…”

“…If the device is stolen, user information can be extracted from the device 4. No mechanism employed to protect against attacks Password & phone token [13] 1. Provides mutual authentication 2.…”