A New One Time Password Generation Method for Financial Transactions with Randomness Analysis

OTP(One Time Password) is for user authentication of Internet banking and users should carry their security card or OTP generator to use OTP. If they lost their security card or OTP generator, there is at risk for OTP leak. This paper suggests a new User Authentication Framework using personal health information from diverse technology of u-Health. It will cover the problem of OTP loss and illegal reproduction A User Authentication Framework is worthy of use because it uses various combinations of user`s physical condition which is inconstant. This protocol is also safe from leaking information due to encryption of reliable institutes. Users don`t need to bring their OTP generator or card when they use bank, shopping mall, and game site where existing OTP is used.

Authentication in the login process is an important thing that needs attention. The login process will involve a password that is owned by the user, while the password is private and confidential. If someone uses a weak password, the password is likely to be easily hacked. Authentication security needs to be improved, and hackers will get access to the login system with only a few attack techniques such as SQL Injection or sniffing techniques. Besides, the lack of awareness of users by creating weak passwords is easy to guess. Meanwhile, to create a strong password, consisting of upper- and lower-case letters, a combination of numbers and symbols, it is very difficult to remember. This is a very important problem in the login process. This study discusses the login authentication process that can perform login integration without typing a password, because passwords are generated repeatedly with the One Time Password (OTP) method, and use the Quick Response Code (QR) as its support. To disguise the data in the QR Code, which is applied by the Rivest-Shamir-Adleman (RSA) encryption algorithm, and will be tested on a web-based application. The login integration process, using the QR Code token application that runs on an android phone. Which functions as an OTP token generator, and a web-based application will read information from the QR Code token. The result is that with login authentication, this can increase the security and ease of the authentication process without typing a password.

One Time Passwords (OTPs) are used to increase the security of the authentication process of networked applications. Smartphone based OTP schemes already brought usable and affordable multi-factor authentication to web applications. These schemes are also a promising approach for authentication in industrial applications. This paper introduces an industrial remote maintenance use-case that uses a smartphone based OTP authentication scheme using Quick-Response (QR) codes. In addition to a main communication and password authentication channel, the proposed scheme requires an out-of-band communication channel to transmit OTPs via smartphone. While baseline security for the channels can be achieved with Transport Layer Security (TLS), Out-of-Band Authentication (OOBA) remains vulnerable to Man-in-the-Middle (MitM) attacks in environments where the authenticity of a communicating party cannot be guaranteed. In order to mitigate this problem, it is crucial to establish a secure channel association. The enhancement proposed in this paper thus cryptographically binds successful out-of-band OTP authentications to the previously established data-channel with the help of TLS channel binding. Recommendations include common TLS libraries that support this feature as well as further considerations for a secure implementation.

The DHCP (Dynamic Host Configuration Protocol) protocol is not only convenient for the network administrator to manage IP address and user to use IP address, but also solves some of the problems that the shortage of IPv4 address causes. With the development of information technology and network, the DHCP has been widely used. However, due to the protocol without security mechanism, the potential security vulnerabilities such as illegal DHCP, Mac address disguise, replay attack and DoS attack are becoming more and more prominent. Based on the OTP (One Time Password), a security authentication model that is called OTP_SAM is mainly proposed in this paper. The model combines with the current system time to compute the one-time key, and then use the key to generate the message authentication code by hash algorithm. Finally, the model achieves the objective of the security authentication through the verification of the authentication code in Option180. Experimentation indicates that OTP_SAM ensures the security characteristic, as well has higher efficiency.

In this paper, we present the implementation of a secure OTP(One Time Password) generator for IoT(Internet of Things) devices. Basically, MTM(Mobile Trusted Module) is used and expanded considering secure IoT services. We combine the MTM architecture with a new hardware-based OTP generation engine. The new architecture is more secure, offering not only the security of devices but also that of the OTP service. We have implemented and verified the MTM-based OTP generator on a real mobile platform embedded with the MTM chip. The proposed method can be used as a solution for enhancing security of IoT devices and services.

User data security in mobile applications has become a major challenge in the digital era, particularly due to increasing threats such as identity theft, account hacking, and personal information leaks. Single-factor authentication systems like username and password are no longer sufficient, as they are vulnerable to phishing and brute-force attacks. To address this issue, this study designs a Multi-Factor Authentication (MFA) architecture integrating One Time Password (OTP) and fingerprint recognition as dual-layer security measures. The OTP functions as an ownership-based authentication factor transmitted through a secure channel, while fingerprint verification serves as a biometric factor based on the user’s unique identity. The system architecture includes an OTP verification module connected to an authentication server and a fingerprint module integrated directly with the device’s biometric API. The authentication process is only successful when both factors are validated sequentially, thereby minimizing the risk of unauthorized access. Testing results indicate that the integration of OTP and fingerprint enhances security levels without compromising user convenience. This design is expected to serve as an effective and efficient multilayer security model for modern mobile applications, especially in sectors requiring high data protection such as banking, healthcare, and digital services handling sensitive information.

많은 웹 서비스에서 편리성을 이유로 패스워드 기반 인증 시스템을 주로 사용한다. 패스워드 기반 인증 시스템은 패스워드 추측공격, 사전식 대입공격, 키 로깅 공격 등 다양한 공격에 취약한 것으로 알려져 왔다. 뿐만 아니라 대부분 웹 기반 인증 시스템은 서버가 사용자를 인증하는 단방향 인증만을 제공하므로 사용자는 현재 접속하여 비밀 정보를 남기고자하는 서버가 적합한지 검증 할 수 없다. 따라서 DNS 스푸핑 공격이나 피싱, 파밍과 같은 공격에 대응하기가 어렵다. 이러한 웹 서비스의 보안 취약점을 개선하기 위해 OTP를 사용하거나 패스워드 길이를 증가시키고, 특수기호를 포함하는 패스워드를 생성하게 하는 방안들이 적용되고 있다. 그러나 OTP 장치의 구입비용 발생, 복잡한 패스워드로 인한 사용자의 편리성 저하 등 실용성의 문제가 있다. 무엇보다 단방향 인증 기반에서는 여전히 취약점이 존재한다. 이를 해결하기 위해 본 논문에서는 QR-Code를 활용한 다중채널, 다중요소 인증시스템을 제안한다. 제안하는 시스템은 상호 인증을 제공하여 피싱이나 파밍과 같은 공격에 대응할 수 있다. 또한 휴대용 스마트 기기를 OTP 생성기로 활용하여 사용자의 편리성을 보장하면서 기존 패스워드 공격들에 대응할 수 있다. Password based authentication systems are most widely used for user convenience in web services. However such authentication systems are known to be vulnerable to various attacks such as password guessing attack, dictionary attack and key logging attack. Besides, many of the web systems just provide user authentication in a one-way fashion such that web clients cannot verify the authenticity of the web server to which they set access and give passwords. Therefore, it is too difficult to protect against DNS spoofing, phishing and pharming attacks. To cope with the security threats, web system adopts several enhanced schemes utilizing one time password (OTP) or long and strong passwords including special characters. However there are still practical issues. Users are required to buy OTP devices and strong passwords are less convenient to use. Above all, one-way authentication schemes generate several vulnerabilities. To solve the problems, we propose a multi-channel, multi-factor authentication scheme by utilizing QR-Code. The proposed scheme supports both user and server authentications mutually, thereby protecting against attacks such as phishing and pharming attacks. Also, the proposed scheme makes use of a portable smart device as a OTP generator so that the system is convenient and secure against traditional password attacks.

Two Factor Authentication (2FA) using One Time Password (OTP) codes via SMS messages is widely used. In order to improve user experience, Google has proposed APIs that allow the automatic verification of the SMS messages without the intervention of the users themselves. They reduce the risks of user error, but they also have vulnerabilities. One of these APIs is the SMS Retriever API for Android devices. This article presents a method to study the vulnerabilities of these OTP exchange APIs in a given sector. The most popular API in the sector is selected, and different scenarios of interaction between mobile apps and SMS OTP servers are posed to determine which implementations are vulnerable. The proposed methodology, applied here to the banking sector, is nevertheless simple enough to be applied to any other sector, or to other SMS OTP APIs. One of its advantages is that it proposes a method for detecting bad implementations on the server side, based on analyses of the apps, which boosts reusability and replicability, while offering a guide to developers to prevent errors that cause vulnerabilities. Our study focuses on Spain’s banking sector, in which the SMS Retriever API is the most popular. The results suggest that there are vulnerable implementations which would allow cybercriminals to steal the users SMS OTP codes. This suggests that a revision of the equilibrium between ease of use and security would apply in order to maintain the high level of security which has traditionally characterized this sector.

Telecommunication micropayment (Tele-micropayment) is an alternative of shelling out from traditional electronic commerce with high flexibility. It has been applied to the applications of online software, music, e-book, and game credit, in which the consumers are only charged with petty expense. The verification procedure of this payment relies on OTP(one time password) via SMS(short message service). Obtaining the OTP from smart phone and importing the content into the website is easy for a consumer to complete the transaction. Nevertheless, the SMS Spam Blocker has brought a fatal damage to Tele-micropayment, which could be spread by malicious smart phone Apps(Applications). With the intercepted SMS, an attacker can further learn the content to launch a micropayment scam. As the amount of micropayment is petty, it is hard to be aware of this behavior after the victim receives the bill. In this proposal, we aim to design a brand-new OTP by introducing visual secret sharing technique. According to the experiments, even the attacker can intercept the SMS to get OTP, he cannot learn the content via OCR(Optical character recognition) software. This has proved that our design can greatly help to stop this micropayment scam.

Security to enter a system has a very important role because as the main entrance to access data sources. But often lack the attention of the owners and managers of information systems. To reduce these weaknesses, one method that is widely used today is to use One-Time password, which is where the password we have becomes dynamic, meaning that at a certain time the password is always changing, the positive side is that it makes it difficult for others to steal our passwords because besides representative passwords that are difficult to understand and passwords are always changing. This study discusses One-Time Password installed on a mobile device where the password is randomized using a combination of two algorithms, namely SHA256 and Time-based One Time Password. The development of this login method can reduce the level of theft of passwords owned by users who are entitled to access information sources.

A physical security is best described as securing the perimeter of an area. Most organisation tends to focus on securing their data over the wires and overlooked threats coming from inside their premises. Servers are protected with maximum security configurations and firewall, however the server room are accessible by unauthorized personnel, access card often left behind, broken or missing main door entrance although secured with access card system, vendors, consultants and visitors were not accompanied by staff during visitation, piggy-backing, tailgating, shoulder surfing and keylogging cases are common scenario that can be seen inside an organization. To minimize or/and to overcome the mentioned problems, an enhanced type of physical security method is proposed which is authentication using Random Number Generated (RNG) Keypad based on One Time Pad Concept. It is a computational physical device designed to generate a sequence of numbers or symbols that will appear randomly using Pseudo-random numbers algorithm each time One Time Password (OTP) is keyed in. It is typically generated by a token possessed by the user and it is the input to the authentication system. The input OTP is compared to an OTP generated by the system. If it matches, the user is allowed to access the system. It is hoped that by having this prototype system, common physical security countermeasure weaknesses can be minimized while assuring confidentiality, integrity and availability of the data stays protected with minimum cost and minimal configurations.

In the development of advanced mobile technologies, the historic balloting method can be replaced to a modernistic and potent scheme titled as mobile voting. The mobile voting system affords an uncomplicated, beneficial, powerful way to vote wipe out the drawback of traditional approach. In this paper we urge a mobile voting system which is in essence an online voting system over which users can cast their vote through their smartphones or by applying an e-voting network page. To bring out the security, OTP accession is used which is most generally on the network to confess the variation between a human using a network services automated bot thus effecting the network page more guarded against spam-bot attacks. If the consequence of the matching algorithm is three-point match then audits whether this person possess voter ID after that it will authorizes with AADHAAR ID, if he has the right to vote then a balloting form is granted to him and the third level of attestation is carried out by using One Time Password (OTP) and then the biometric recognition of fingerprint sensor is used for an authentication. Nowadays technology is being utilized progressively as a key to contribution voters to cast their ballots. In order to utilize the rights, approximately all voting system around the world embodies the steps: balloter identification and authentication, voting and documenting of votes expulsion, vote toll, notification of election results.

Authentication has been a cornerstone of computer security for decades. A considerable number of authentication protocols have been specified and implemented. This paper compares most common families of client-server authentication protocols and shows the benefits of the combined use of One Time Password (OTP) with Password Authenticated Key Exchange (PAKE) protocols. Then, the paper addresses a particular issue inherited from this combination which consists in the synchronization between the client and the server. We propose an optimized implementation for a synchronization mechanism based on the use of a synchronization window. The optimized synchronization has been implemented and the simulation results show that our proposal significantly reduces the computations needed at the client side to select the current password.

Providing security to bank customers is the prime responsibility of banking institutions. These institutions upgrade their services to provide convenience-based banking exposure. Automatic Teller Machines (ATMs) assist the bank's customers to operate independently. ATMs verify the authenticity of the user through a 4-digit personal identification number (PIN) only. The State Bank of India (SBI) has initiated a double security check system to minimize the probabilities of banking frauds through ATMs. SBI customers must provide a one-time password (OTP) along with a PIN to complete the cash withdrawal transaction through the SBI ATM. The objective of the study is to analyze the impact of financial security enhancement in ATMs cash transactions through one-time password on the probabilities of banking frauds through ATMs. The study has used primary data collected through a questionnaire from 422 respondents. The study resulted that one-time password has enhanced the financial security function of ATMs and now the probabilities of ATM frauds has been reduced substantially.

Something you know based authentication method is the most classical authentication technique on the computer system, and is performed more easily and successfully than other methods even it is a vulnerable method against attacks such as eavesdropping or replay attack. To solve this problem, OTP (Onetime Password) technique is used. OTP is delivered from one side to the other in two approaches. In the first approach, OTP is generated on server side and sent to clients, for example, by SMS. In the second approach, OTP is generated on both sides at one time based on shared counter, such as, HOTP. In most cases, one-way hash functions are used in both approaches to generate OTP. As resent researches show the weakness of the hash functions, we need new a new OTP generation algorithms to solve this problem. In this paper, we propose a method of creating one time password based on pseudorandom number generators (PRNG), which they are exist on many systems and programming languages as native.