# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 3 Proposed Algorithm
#### 1.1.1 Entrolment Phase
If yes, the \(U_{i}\) is requested to enter a new \(PN_{i}\) and \(SIM_{sn}\) for the registration, else, the \(DB_{m}\) and \(DB_{fd}\) records are encrypted using the Ferret, i.e., \(e_{i}=E_{u}(k_{i},\ l_{i},\ m_{i},\ lD_{i},\ ID_{sp})\); save it in the \(DB_{m}\) and \(DB_{fd}\). A notification for successful registration is displayed to the \(U_{i}\). else
10 Invalid user data endif
11\(\  
```
Input:\(PIN_{i}\), \(OTP_{i}\), \(BF_{i}\) START
1\(PIN\)\(\leftarrow\) Take input of the \(U_{i}^{\prime s}\)\(PIN_{i}\). for(int i = 0; i \(\leq\) 3; i ++){
3 if IsPINValid (\(PIN\)) then
4 Request for the generation of \(OTP_{i}\)
5 Send \(OTP_{i}\) to the \(U_{i}^{\prime s}\)\(SP_{i}\). Hash the sent \(OTP_{i}\) using the SHA-256, \(y_{i}=h(OTP_{i})\) and store \(y_{i}\) in the \(DB_{m}\)
6 Display the \(OTP_{i}\) for the \(U_{i}\) to read. 7 else
8 Invalid \(PIN_{i}\) and transaction terminated
9 endif
10\(OTP\)\(\leftarrow\) Take input of the \(U_{i}^{\prime s}\)\(OTP_{i}\). 11 if IsOTPValid (\(OTP\)) then
12 Scan the \(BF_{i}\) for recognition using the \(SP_{i}\)
13 else
14 Invalid \(OTP_{i}\) and transaction terminated
15 endif
16\(BF\)\(\leftarrow\) Take input of the \(U_{i}^{\prime s}\)\(BF_{i}\) using the \(SP_{i}\) fingerprint sensor. 17 if IsBFValid (\(BF\)) then
18\(P_{i}/F_{i}\) pair are created. The \(E_{u}(E(P_{i}))\) is decrypted, \(d_{p}=D_{u}(D(P_{i}))\), and compared with \(P_{i}\). The \(E_{u}(E(F_{i}))\) and \(E_{u}(E(B_{i}))\) are also decrypted, \(d_{f}=D_{u}(D(F_{i}))\) and \(d_{t}=D_{u}(D(B_{t}))\) and compared with \(F_{i}\) and \(B_{t}\), respectively. if(\((P_{i}==d_{p})\) AND \((F_{i}==d_{f})\) AND \((B_{t}==d_{t})\)) then  The \(U_{i}\) is authenticated successfully and can proceed to transaction. else  Invalid \(P_{i}\), \(F_{i}\), and \(B_{t}\) endif
14 else
15 Invalid \(BF_{i}\) and transaction terminated endif
18 } Return STOP
```  
**Algorithm 2** Authentication Phase  
Figure 3(a),b summarizes the proposed mobile money enrolment and authentication phase. 3. _Transaction Phase_ To withdraw money, the mobile money \(U_{i}\) must follow the steps below Algorithm 3:  
* **Step 1. ** The mobile money \(U_{i}\) begins the money withdrawal transaction by signing in to the application by entering their \(PIN_{i}\), \(OTP_{i}\), and \(BF_{i}\). * **Step 2. ** If the \(PIN_{i}\), \(OTP_{i}\), and \(BF_{i}\) match, the \(U_{i}\) is logged in, and the system displays the available \(Bal_{i}\) the mobile money \(U_{i}\) has. * **Step 3. ** If the \(Bal_{i}\) is greater than or equals to 5000 and the mobile money \(U_{i}\) wants to withdraw money, they can enter an \(Amt_{i}\) less than or equal to the available \(Bal_{i}\). * **Step 4. ** The system then requests the \(U_{i}\) to scan their \(BF_{i}\) using the \(SP_{i}\) fingerprint sensor. * **Step 5. ** If the scanned \(BF_{i}\) matches, the system requests the \(U_{i}\) to scan the secure \(QRcode_{i}\) of the mobile money \(A_{a}\) using the smart scanner for confirmation purposes. * **Step 6. ** If the scanned secure \(QRcode_{i}\) matches, the system displays a successful withdrawal message seeking the \(U_{i}\) to collect money from the mobile money \(A_{a}\). Figure 4: (**a**) The flowchart for the enrolment phase. (**b**) The flowchart for the authentication phase. Figure 5 illustrates how a mobile money user can withdraw money from their account. Figure 5: The algorithm for the transaction phase.