# Authentication Securing Methods for Mobile Identity: Issues, Solutions and Challenges
## 3 Results  
Although many studies exist, the research gaps in multi-factor authentication remain open for different combinations. To fill this literature gap, we will further discuss the proposed combination of MFA authentication methods for mobile identity. Depending on the user's mobile phone capability, there are two proposed combination options: mobile phone SIM number with biometric fingerprint or SIM number with geo-location information. Both fingerprint and geo-location will be used as the encryption key to secure the transaction data. In this study, we propose the use of biometric authentication, specifically fingerprint authentication, due to its unique criteria, which between each person. However, not every device can capture biometrics due to its own limitations. Considering the multitype of mobile devices with a probability of not having a biometric recognition module, we take into count the geo-location identification, as we know that every mobile device will have its own built-in GPS module. The strong side of geo-location authentication is that most impersonation attempts are made outside the user's area, and some are even made outside the user's country. At present, limiting the geo-location transaction source is performed on the IP level. However, there are some scenarios where the restriction brings trouble to the legitimate user. For example, some countries have used geo-location to restrict the use of the internet due to internal reasons such as riots. During this time, the internet connection for the whole country was shut down. This led to some civilians trying to reach the internet using a VPN service provider, and their IPs changed to external IPs, which ended up being blocked by the system. Due to this, GPS geo-location sounds a bit promising to counter the issue. Now, back to the proposed authentication. Referring to Figure 7, the authentication system design should require a SIM number representing the user's identity, International Mobile Equipment Identity (IMEI), first and second fingerprints and initial geo-location during registration, and the user's information to create an account. Considering the biometric impacts shown in Table 1, a second fingerprint is needed as a backup authentication key upon authentication failure. Once an account is created, the user can perform the transaction on any platforms that are connected to the authentication server (AS). Whenever the user initiates a transaction that requires authentication, the system will first identify if the user's mobile device can capture the fingerprint or not. If the fingerprint capture module is present on the phone, then the SIM number and fingerprint will be used for authentication. However, if not, the combination of SIM number and geo-location will be used instead. Figure 8 shows the flow for the authentication. The user will need to provide the fingerprint upon authentication for a device that supports fingerprints. The fingerprint will be sent with the SIM number to the AS for verification. Once authorized, the AS will issue an encrypted token used to validate the transaction. The online application server will use the token and cross-check with AS for verification. However, if the fingerprint authentication fails, the user may use the second fingerprint to replace the failed one. On mobile devices that do not support biometric recognition, the user will need to validate their geo-location. Once validated, the SIM number, device IMEI and the validated location will be sent to AS for verification. AS will cross-check if the provided information of mobile number and IMEI are identical with the record, and the provided location is matched with the GPS location or registered location or within a nearby radius. If either  
Figure 8: Biometric-geo mobile identity authentication. Figure 7: Mobile identity registration. SIM number and IMEI, or SIM number and geo-location, are correct, the user then will be authorized and receive the token.