MuFASA: A Tool for High-level Specification and Analysis of Multi-factor Authentication Protocols

Abstract

In recent years, the usage of online services (e.g., banking) has considerably increased. To protect the sensitive resources managed by these services against attackers, Multi-Factor Authentication (MFA) has been widely adopted. To date, a variety of MFA protocols have been implemented, leveraging different designs and features and providing a non-homogeneous level of security and user experience. Public and private authorities have defined laws and guidelines to guide the design of more secure and usable MFA protocols, but their influence on existing MFA implementations remains unclear.

We present MuFASA, a tool for high-level specification and analysis of MFA protocols, which aims at supporting normal users and security experts (in the design phase of an MFA protocol), providing a high level report regarding possible risks associated to the specified MFA protocol, its resistance to a set of attacker models (defined by NIST), its ease-of-use and its compliance with a set of security requirements derived from European laws.

This work has been partially supported by the EU Horizon 2020 projects FINSEC (grant agreement No 786727) and SPARTA (grant agreement No 830892), by the IMT PAI (Programma di Attività Integrata) project VeriOSS, and by the activity 19183 Teîchos of the action line Digital Finance of the AT Digital.

A Example Input

Here we provide an example of how the user fills the questionnaire to obtain protocol (2). Notice that the sequence of the reported questions only represent a specific path in the interpretation tree.

• 1. What is your 1st operation?

  • I insert some secret credentials (e.g., a password on a website)

  • I use a device (e.g., a card reader)

  • I use a software (e.g., an app on my smartphone)

  • I send/receive something on my mobile phone (e.g., an SMS)

  • None, I am authenticated

  • (a) Where are the secret credentials stored?

    • On a physical support (e.g., a piece of paper)

    • Nowhere, I remember them

• 2. What is your 2nd operation?

  • I insert some secret credentials (e.g., a password on a website)

  • I use a device (e.g., a card reader)

  • I use a software (e.g., an app on my smartphone)

  • I send/receive something on my mobile phone (e.g., an SMS)

  • None, I am authenticated

  • (a) Is the device personal? Can you use others’ devices?

    • Yes, it is personal

    • No, they are all exchangeable

  • (b) Among the followings, what do you need to use the device?

    • I must insert a secret code/pin

    • I must scan a part of my body (e.g., my fingerprint)

    • Nothing

  • (c) Is your device connected to something?

    • Yes, to my PC (e.g., through a USB cable)

    • Yes, to the internet (e.g., through the WiFi)

    • No, it is isolated

  • (d) Does it read some sort of input code?

    • Yes, it scans an optic code (e.g., barcode or QR code)

    • Yes, I personally digit it (e.g., a code displayed on a website)

    • No

  • (e) Does it recap the ongoing operation and ask for your confirmation?

    • Yes (e.g., “Your are paying x$ to y. Confirm?”)

    • No

  • (f) Does it return some code that you have to copy somewhere?

    • Yes

    • No

• 3. What is your 3rd operation?

  • I insert some secret credentials (e.g., a password on a website)

  • I use a device (e.g., a card reader)

  • I use a software (e.g., an app on my smartphone)

  • I send/receive something on my mobile phone (e.g., an SMS)

  • None, I am authenticated.