# A Secure and Efficient Multi-Factor Authentication Algorithm for Mobile Money Applications
## 2 Related Work
### Problem Statement  
Many algorithms have been developed to boost mobile money authentication security. However, to date, there are no strong security controls to suit all mobile money authentication security challenges. However, the existing proposed algorithms, though promising, require more work because they are vulnerable to impersonation attacks; USSD technology vulnerabilities; replay attacks; spoofing attacks; Trojan horse attacks; brute-force attacks; shoulder-surfing attacks; MITM attacks; insider attacks; identity theft; social engineering attacks; SIM-swapping attacks; malware attacks; agent-driven fraud; and privacy attacks [8; 9; 11; 22; 23; 24; 25; 26]. Therefore, there is a need to develop a secure and efficient multi-factor authentication algorithm for mobile money applications where mobile money subscribers are authenticated using a PIN, OTP, and biometric fingerprints. It also uses a biometric fingerprint and QR code to confirm mobile money withdrawal. The authentication identifiers are protected using different mechanisms, such as SHA-256 for PIN and OTP, FIDO that uses RSA for Biometric fingerprint, and Fernet encryption for a QR code and the records in the databases.  
The proposed algorithm implements FIDO, which uses a public-key cryptography technique (RSA encryption) to secure biometric fingerprints. There are two main phases in FIDO, i.e., registration and authentication. A mobile money user is requested to pick an available FIDO authenticator (e.g., smartphone) that matches the online service acceptance policy during the registration phase. While during the authentication phase, the user unlocks the smartphone by scanning the fingerprint using a fingerprint reader of the smartphone. A new public/private key pair unique to the smartphone, mobile money service, and user's account is created. The public key is encrypted and sent to the online FIDO database, associated with the user's mobile money account, and saved in a Keystore. The private key and biometric templates are encrypted and stored in the user's smartphone in a cryptographic Keystore. The G-MoMo applications challenge the users to log in with previously registered smartphones that match the service's acceptance policy and unlock the smartphones using biometric fingerprints. The smartphones use the users' account identifier to select the correct key and sign the service's challenge. The user's smartphone sends the signed challenge to the service, verifying it with the stored public key, and the user is logged in. In the proposed algorithm, the user's encrypted biometric template is not stored in the database but instead in the user's smartphone. Besides, the mobile money agent's serial number is encrypted using Fernet encryption to generate a mobile money agent code, which is then encoded in a QR code for the user to scan during money withdrawal. This helps to confirm the authenticity of the mobile money agents. The proposed algorithm helps to ensure secure and efficient authentication and provides data confidentiality, integrity, non-repudiation, user anonymity, privacy, and improved performance. It is resistant to shoulder-surfing attacks, social engineering attacks, phishing attacks, PIN-guessing attacks, and brute-force attacks. Likewise, it prevents replay attacks, insider attacks, impersonation attacks, identity fraud, and MITM attacks.