# Two-Factor Authentication Scheme for Mobile Money: A Review of Threat Models and Countermeasures
## 2 Related Work
### Countermeasures
#### 2.8.1 Cryptographic Functions  
[PERSON] and [PERSON] [65] defined cryptographic functions as cryptographic algorithms in conjunction with the modes of operation. In the 2 FA scheme for mobile money, cryptographic functions help in achieving the security goals of confidentiality, authenticity, and integrity. The most common cryptographic functions used in the mobile money's 2 FA scheme are asymmetric encryption function, symmetric encryption function, and hash function.  
1. Asymmetric Encryption Function: The examples of asymmetric encryption functions used in the 2 FA scheme for mobile money are elliptic curve cryptography (ECC) and the Rivest-Shamir-Adleman (RSA) encryption algorithm. The mobile money authentication schemes [66; 67; 68; 69; 70] use ECC. The scheme proposed by [PERSON] and [PERSON] [66] uses SMS, elliptic curve integrated encryption scheme (ECIES), and elliptic curve digital signature algorithm (ECDSA) to ensure user authentication, data confidentiality, and nonrepudiation, thereby reducing computation complexity in mobile banking. Using the elliptic curve Menezes-qua-Vanstone (EC-MQV) key agreement protocol in [67] gave resistance against MITM attacks, SIM cloning and swapping attacks, DoS attacks, and message modification. The scheme in [68] used biometric fingerprints or retinal images on the basis of ECC to provide strong security against MITM attacks, replay attacks, DoS attacks, spoofing attacks, and repudiation. Furthermore, the scheme is effective in terms of  
Figure 6: Countermeasures against attacks in mobile money’s 2 FA schemes.  
computation and communication. [PERSON] and [PERSON] [69] employed biometric, IMEI number, and SIM serial number, colour encryption with ECC to improve the security of mobile banking. The scheme [70] integrated secure ECC to provide data confidentiality, data integrity, and user authentication in mobile banking. The scheme proposed by [PERSON] and [PERSON] [71] employed a hybrid cryptographic authentication method using the quick response (QR) code and OTP to improve user authentication and confidentiality in online banking. Additionally, using the encrypted QR code with RSA in the scheme in [72] ensured the legitimacy of the user, information confidentiality, integrity, and accuracy in mobile payment.
2. Symmetric Encryption Function: The examples of symmetric encryption functions used in mobile money authentication include data encryption standard (DES) and advanced encryption standard (AES). Using triple-DES (3 DES) in [73] provided more security in a cashless transaction than DES. The scheme proposed by [74] used a PIN, SIM card, and face recognition with a DES/3 DES encryption algorithm to enforce the security between the mobile payment application and the virtual private ad hoc network. [PERSON] et al. [75] employed identity-based cryptography in securing mobile money wallets to resist insider attacks, and it consumed less computational cost in token generation. The scheme proposed by [76] used a dynamic mobile phone token, SSL protocol, and AES to encrypt the transaction information and combat MITM attacks, replay attacks, and transactions repudiation. The scheme in [56] used a QR code with AES-128 bit encryption-decryption and secure hash algorithm 1 (SHA-1) for securing Android smartphones from attacks.
3. Secure Hash Function: The MD5, SHA-1, and SHA-2 are common examples of hash functions used in mobile money authentication. [PERSON] et al. [77] proposed an authentication scheme for online banking using a one-time-username and SHA-1 hash function to calculate the ticket's hash value. Using a vehicle's identity and the SIM to secure the mobile money authentication system in [78] offered higher security against the increasing identity thefts, SIM cloning, and other cybercrimes.