arXiv subjects

Suyun Borjigin

Publications and source records attributed to Suyun Borjigin.

3 recordsLinked to original sources

arXiv2026

Triple-Identity Authentication: The Future of Secure Access

In password-based authentication systems, the username fields are essentially unprotected, while the password fields are susceptible to attacks. In this article, we shift our research focus from traditional authentication paradigm to the establishment of gatekeeping mechanisms for the systems. To this end, we introduce a Triple-Identity Authentication scheme. First, we combine each user credential (i.e., login name, login password, and authentication password) with the International Mobile Equipment Identity (IMEI) and International Mobile Subscriber Identity (IMSI) of a user's smartphone to create a combined identity represented as "credential+IMEI+IMSI", defined as a system attribute of the user. Then, we grant the password-based local systems autonomy to use the internal elements of our matrix-like hash algorithm. Following a credential input, the algorithm hashes it, and then the local system, rather than the algorithm, creates an identifier using a set of elements randomly selected from the algorithm, which is used to verify the user's combined identity. This decentralized authentication based on the identity-identifier handshake approach is implemented at the system's interaction points, such as login name field, login password field, and server's authentication point. Ultimately, this approach establishes effective security gates, empowering the password-based local systems to autonomously safeguard user identification and authentication processes.

cs.CR↗

arXiv2024

An Alternative to Multi-Factor Authentication with a Triple-Identity Authentication Scheme

The existing authentication system has two entry points (i.e., username and password fields) to interact with the outside, but neither of them has a gatekeeper, making the system vulnerable to cyberattacks. In order to ensure the authentication security, the system sets a third entry point and use an external MFA service to guard it. The crux of the problem is that the system has no internal mechanism to guard its own entry points as no identifiers can be defined for the username and password without using any personal information. To solve this problem, we open the hash algorithm of a dual-password login-authentication system to three login credentials. Therefore, the intermediate elements of the algorithm can be used to define an identifier to verify the user identity at each entry point of the system. As a result of the above setup, a triple-identity authentication is established, the key of which is that the readily available user's login name and password are randomly converted into a matrix of meaningless hash elements which are concealed, incommunicable, inaccessible, and independent of personal information. So the identifiers defined using such elements can be used by the system to verify the identities of the user at all the entry points of the system, thereby ensuring the authentication security without relying on MFA services.

cs.CR↗

arXiv2024

Systematic Solutions to Login and Authentication Security Problems: A Dual-Password Login-Authentication Mechanism

Credential theft and remote attacks are the most serious threats to user authentication mechanisms. The crux of these problems is that we cannot control such behaviors. However, if a password does not contain user secrets, stealing it is useless. If unauthorized inputs are invalidated, remote attacks can be disabled. Thus, credential secrets and account input fields can be controlled. Rather than encrypting passwords, we design a dual-password login-authentication mechanism, where a user-selected secret-free login password is converted into an untypable authentication password. Subsequently, the authenticatable functionality of the login password and the typable functionality of the authentication password can be disabled or invalidated to prevent credential theft and remote attacks. Thus, the usability-security tradeoff and password reuse issues are resolved; local authentication password storage is no longer necessary. More importantly, the password converter acts as an open hashing algorithm, meaning that its intermediate elements can be used to define a truly unique identity for the login process to implement a novel dual-identity authentication scheme. In particular, the system-managed elements are concealed, inaccessible, and independent of any personal information and therefore can be used to define a perfect unforgeable process identifier to identify unauthorized inputs.

cs.CR↗