# Two-Factor Authentication Scheme for Mobile Money: A Review of Threat Models and Countermeasures
## 4 Results and Discussion
[PERSON], [PERSON], and [PERSON] [68] proposed the use of both biometric fingerprint and ECC, [79; 85; 86; 90] used multi-factor authentication, and [56; 67; 70; 71; 73; 74; 76; 102; 103] proposed the use of symmetric encryption and message authentication code. * Salami attack: This is where an employee of a financial institution installs a malware like a Trojan horse on the server hosting the mobile money application to withdraw a small amount of money from the subscribers' accounts and deposit it into their account. To thwart this attack, [18] suggested that there is a need to define an efficient and robust user and security policy that contains different privileges, updates security systems, initiates both SMS and email messages to alert customers regarding any transaction that occurs, and advises the customers to report any unaware money reductions. * Insider attacks: This is where an employee of the MMSP who has enough information about the organisation's security practices, MMS, and data attacks the mobile money application server or MMS. To resist insider attacks, [66; 68; 70] used elliptic curve cryptography. [PERSON] et al. [75] employed identity-based cryptography, and [117] proposed a certificate-based signcryption scheme. * DoS and DDoS attacks: This is where attackers overwhelm mobile money servers with fake traffic to block requests from legitimate users requesting to access the services. The goal is to make mobile money services unavailable to legitimate users. Resiliency against DoS attacks is enhanced by using cryptographic hash functions [56; 67; 68; 70; 71; 77; 87]. [PERSON] [52], [PERSON] et al. [104], [PERSON] and [PERSON] [105], and [PERSON] and [PERSON] [81] proposed the use of biometric fingerprint authentication. On the other hand, to deal with a DDoS attack, [118] introduced a nonlinear control approach that can prevent malicious attack packets. [PERSON], [PERSON], and [PERSON] [119] proposed a hybrid intrusion detection system that utilises anomaly- and signature-based detection methods. * Mobile phone theft: When an attacker steals the mobile money user's or agent's mobile phone, the SIM card that has a wallet account becomes unavailable. [PERSON] et al. [64] proposed technical countermeasures such as remote device wipe, training customers, access blocking, data encryption, online or offline data backup, remote access to built-in cameras, global positioning system (GPS) device tracking, and PIN protection. Table 2 summarises the threat models and countermeasures. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**S/No** & **Threat Models** & **Countermeasure** & **References** \\ \hline \multirow{4}{*}{1} & & A hybrid cryptographic method using the MD5 & \\  & & algorithm and the RSA algorithm. & \\ \cline{3-4}  & & ECDSA for digital signature and ECIES that uses & \\  & & AES-GCM as the encryption algorithm. & \\ \cline{3-4}  & & General data privacy legislation and & \\  & & sector-specific laws. & \\ \hline \multirow{4}{*}{2} & & Fingerprint biometrics. & [81; 105] \\ \cline{3-4}  & & Elliptic curve cryptosystems. & [66; 68; 69] \\ \cline{3-4}  & & Hashing functions. & [56; 67; 70; 77; 87] \\ \cline{3-4}  & & Asymmetric encryption function. & [72] \\ \cline{3-4}  & & Mutual authentication. & [72; 88] \\ \cline{3-4}  & & Use of random values like OTP. & [102; 103] \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Summary of the threat models and countermeasures. \begin{table}
\begin{tabular}{c c l l} \hline \hline
**S/No** & **Threat Models** & **Countermeasure** & **References** \\ \hline \multirow{4}{*}{3} & \multirow{4}{*}{Replay attacks} & Pairing-based cryptography and timestamp in encrypted data. & [66; 68; 69; 102; 103] \\ \cline{3-4}  & & & Hashing functions. & [56; 70] \\ \cline{3-4}  & & & Use of one-time username. & [77] \\ \hline \multirow{4}{*}{4} & \multirow{4}{*}{Masquerade attack} & Elliptic curve cryptosystem. & [66; 68; 69] \\ \cline{3-4}  & & Mutual authentication technique. & [72; 88] \\ \cline{3-4}  & & & Hash functions.