Usable comprehensive-factor authentication for a secure time attendance system

Abstract

In information security, it is widely accepted that the more authentication factors are used, the higher the security level. However, more factors cannot guarantee usability in real usage because human and other non-technical factors are involved. This paper proposes the use of all possible authentication factors, called comprehensive-factor authentication, which can maintain the required security level and usability in real-world implementation. A case study of an implementation of a secure time attendance system that applies this approach is presented. The contribution of this paper is therefore to provide a security scheme seamlessly integrating all classical authentication factors plus a location factor into one single system in a real environment with a security and usability focus. Usability factors emerging from the study are related to a seamless process including the least number of actions required, the lowest amount of time taken, health safety during the pandemic, and data privacy compliance.

Development of a secure multi-factor authentication algorithm for mobile money applications

“…These are the things that a user knows, like usernames & passwords, PINs, and answers to secret questions (Ali et al, 2020a;Vorakulpipat et al, 2021). They are typically used for single-factor authentication and offer little security when implemented alone.…”

“…These are the things that a user has, including a SIM card, mobile phone, Smart card, OTP token, or FIDO2 security key (Ali et al, 2020a;Vorakulpipat et al, 2021).…”

“…They are unique physical and behavioural traits of the user. Examples of the inherence factor are biometric fingerprints, face, iris, retina, and voice (Ali et al, 2020a;Vorakulpipat et al, 2021).…”

“…verification process where the authenticating party requires users seeking access to the system to present multiple authentication credentials linked to their identity to ensure the security of the account. The primary purpose is to increase the safety of the authentication systems, services, information, and privacy so that it is challenging for attackers to compromise (Ometov et al, 2018;Devasena, 2018;Vorakulpipat et al, 2021). For MFA to be successfully implemented, one of the verification factors must be kept away from the device for accessing the system or resources (Australian Cyber Security Centre [ACSC], 2019).…”

“…For MFA to be successfully implemented, one of the verification factors must be kept away from the device for accessing the system or resources (Australian Cyber Security Centre [ACSC], 2019). The MFA provides a higher security level through multiple user login credentials to protect the devices, systems, and resources from intruders (Taher et al, 2019;Ibrokhimov et al, 2019;Vorakulpipat et al, 2021;Chishti et al, 2021;Kebande et al, 2021). It also helps achieve consistency in organisations (Lone & Mir, 2021).…”