# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 3 Proposed Algorithm
#### 1.1.1 Entrolment Phase  
Before enrolling a mobile money \(U_{i}\), the \(U_{i}\)'s \(SIM_{sn}\) and the \(SD_{i}\) must be generated. The mobile money \(A_{a}\) then registers the mobile money \(U_{i}\) by following the steps below Algorithm 1:  
* **Step 1. ** The mobile money \(A_{a}\) must capture the \(U_{i}\)'s \(FN_{i}\), \(LN_{i}\), \(SIM_{sn}\), \(SID_{i}\), \(PN_{i}\), i.e., \(k_{i}=(FN_{i}\), \(LN_{i}\), \(SIM_{sn}\), \(SID_{i}\), \(PN_{i})\). * **Step 2. ** The mobile money \(A_{a}\) then verifies the \(k_{i}\) provided by the \(U_{i}\). If the \(k_{i}\) is wrong, the \(U_{i}\) has three (3) attempts; otherwise, the information is saved in the \(DB_{m}\). * **Step 3. ** The \(U_{i}\) must complete the registration process by entering a five-digit \(PIN_{i}\) and re-enter the five-digit \(PIN_{j}\). * **Step 4. ** If the five-digit \(PIN_{i}\) entered and the re-entered \(PIN_{j}\) do not match, the \(U_{i}\) is required to enter the correct mobile money PIN; otherwise, it is hashed using the SHA-256, \(l_{i}=h(PIN_{i}\), \(PIN_{j})\) and saved in the \(DB_{m}\). * **Step 5. ** The \(U_{i}\) must use the \(SP_{i}\) fingerprint sensor to scan their \(BF_{i}\). If the \(BF_{i}\) is successfully captured, the \(SP_{i}\) creates a new \((P_{i},F_{i})\) pair unique to the \(SP_{i}\) and \(U_{i}\)'s account. The \(P_{i}\) is encrypted using RSA, \(m_{i}=E(P_{i})\), sent to the \(DB_{fd}\) and saved in a Keystore. The \(F_{i}\) and the \(B_{t}\) are encrypted using RSA, \(n_{i}=E(F_{i}),o_{i}=E(B_{t})\) and stored in the \(SP_{i}\) under cryptographic Keystore and \(SP_{i}\), respectively. * **Step 6. ** The \(SP_{i}\) stores \(n_{i},o_{i}\) and sends \(l_{i},~{}m_{i},ID_{i},~{}ID_{sp}\) to the \(DB_{m}\) and \(DB_{fd}\). * **Step 7. ** The \(DB_{m}\) checks whether the \(ID_{i}\) or \(ID_{sp}\) exists. If yes, the \(U_{i}\) is requested to enter a new \(PN_{i}\) and \(SIM_{sn}\) for the registration; otherwise, the \(DB_{m}\) and \(DB_{fd}\) records are encrypted using the Fernet, i.e., \(e_{i}=E_{u}(k_{i},~{}l_{i},~{}m_{i},~{}ID_{i},~{}ID_{sp})\), save it in the \(DB_{m}\) and \(DB_{fd}\), and a notification for successful registration is displayed to the \(U_{i}\). \begin{table}
\begin{tabular}{c c} \hline \hline
**Symbols** & **Meaning** \\ \hline \(B_{t}\) & Biometric template \\ \(P_{i}\) & User’s public key \\ \(F_{i}\) & User’s private key \\ \(SP_{i}\) & User’s smartphone \\ \(ID_{i}\) & User’s ID \\ \(ID_{sp}\) & Smartphone ID \\ \(h(.)\) & One-way hash function—SHA-256 \\ \(E_{u}(.)/D_{u}(.)\) & Fernet Encryption/Decryption with key \(u\) \\ \(E(.)/D(.)\) & Public key Encryption/Decryption—RSA \\ \(DB_{m}\) & Main database \\ \(DB_{fd}\) & FIDO database \\ \(Bal_{i}\) & User’s electronic balance \\ \(A_{a}\) & Agent \\ \(QRcode_{a}\) & Agent QR code \\ \(Amt_{i}\) & Amount \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._```
Input:\(FN_{i},\ LN_{i},\ SIM_{sn},\ SID_{i},\ PN_{i},\ PIN_{j}\) START \(k_{i}\leftarrow\) Take input of the \(\{FN_{i},\ LN_{i},\ SIM_{sn},\ SID_{i},\ PN_{i}\}\). for(\(int\ i=0;\ i\leq 3;\ i++)){
1 if\(\text{IsUserDataValid}\ (k_{i})\)then
2 Save \(k_{i}\) in the \(DB_{m}\)
3\(PIN_{k}\leftarrow\) Take input of the \(\{PIN_{i},\ PIN_{i}\}\)
4 if\(\left(\left(PIN_{i}.length==5\right)\ \textbf{AND}\ (PIN_{j}.length==5)\ \textbf{AND}\ (PIN_{i}== PIN_{j})\right)\)then
5 Hash the \(PIN_{k}\) using SHA-256, \(l_{i}=h(PIN_{k})\) and save in the \(DB_{m}\). 6 else
7 Enter a valid \(PIN_{i}\) and \(PIN_{j}\)
8 endif
9 Retrieve the biometric fingerprint feature, and \(P_{i}/F_{i}\) pairs are created, i.e., \(P_{i}/F_{i}\). \(P_{i}\) is encrypted using RSA, \(m_{i}=E(P_{i})\), sent to the \(DB_{fd}\) and saved in a Keysstore. The \(F_{i}\) and the \(B_{t}\) are encrypted using RSA, \(n_{i}=E(F_{i})\), \(o_{i}=E(B_{t})\) and stored in the \(SP_{i}\) under cryptographic Keysstore and \(SP_{i}\). The \(SP_{i}\) stores \(n_{i},o_{i}\) and sends \(l_{i},\ m_{i},ID_{i},\ ID_{sp}\) to the \(DB_{m}\) and \(DB_{fd}\). The \(DB_{m}\) checks whether the \(ID_{i}\) and \(ID_{sp}\) exists.