# A Robust and Effective Two-Factor Authentication (2 FA) Protocol Based on ECC for Mobile Computing
###### Abstract  
The rapid development of mobile computing (e.g., mobile health, mobile payments, and smart homes) has brought great convenience to our lives. It is well-known that the security and privacy of user information from these applications and services is critical. Without the prevention provided by an authentication mechanism, safety vulnerabilities may accumulate, such as illegal intrusion access resulting in data leakage and fraudulent abuse. Luckily, the two-factor authentication (2 FA) protocols can secure access and communication for mobile computing. As we understand it, existing 2 FA authentication protocols weaken security in the pursuit of high efficiency. How efficiency can be achieved while preserving the protocol's security remains a challenge. In this study, we designed a robust and effective 2 FA protocol based on elliptic curve cryptography (ECC) for authentication of users and service providers. We proved the robustness (respectively, the effectiveness) of the presented protocol with the heuristic analysis and security verification provided by the ProVerif tool (respectively, with a performance comparison based on six schemes). Performance comparisons in terms of message rounds, communication, and computation overheads showed that our scheme was superior to the exiting schemes or comparable as a whole, i.e., only two rounds, 1376 bits, and 1.818 ms were required in our scheme, respectively. The evaluation results showed that the proposed 2 FA protocol provides a better balance between security and availability compared to state-of-the-art protocols.  
security and privacy; two-factor authentication (2 FA); elliptic curve cryptography (ECC); mobile computing; ProVerif +
Footnote †: journal: Applied Sciences  
ointment. Given that mobile devices may have constrained resources, many 2 FA protocols sacrifice security for higher efficiency and availability.  
From the perspective of security, the issue is that the network communication entities in 2 FA are subject to diverse attacks, such as impersonation attacks and privileged insider attacks. The schemes in [4; 5] do not apply advanced technical means, such as multi-factor authentication and the technology of custom dictionaries, and cannot resist keypromised user impersonation attacks and password-guessing attacks [6; 7; 8].  
From the perspective of efficiency, to enhance computational efficiency and diminish the communication overhead, earlier researchers tried to design a practical authentication and key agreement (AKA) protocol by using the hash function and symmetric cryptography (e.g., [9; 10; 11]). [PERSON] et al. [9] put forward a lightweight privacy-preserving authentication protocol in which the server does not need to carry out any time-consuming search operations to identify the tag. In addition, it does not need to store a secret key in the tag device. [PERSON] et al. [10] proposed an efficient, perfect forward secrecy-enabled AKA protocol on the basis of a lightweight hash function and XOR operation. [PERSON] et al. [11] developed a remote user authentication protocol based on dynamic ID that allows the user to select and update their passwords randomly and does not maintain a verifier table. Nevertheless, it was found that the scheme in [12] could not provide forward secrecy to secure the session key.  
Public-key cryptography technology can be used to enhance the security of the AKA protocol [12]. These public-key cryptography technologies (such as ECC [13], RSA [14], and bilinear pairings [15]) are becoming widely used in the design of AKA protocols [7; 16; 17], making it possible to enhance the safety of the session key and preserve user's anonymity, etc. However, given the authentication performance, using a large number of public-key cryptography techniques throughout the process often leads to greater communication/storage consumption costs and lacks practicality. Accordingly, designing a 2 FA protocol that balances security and availability is a challenge.