An Efficient Generic Framework for Three-Factor Authentication With Provably Secure Instantiation

TLDR

Remote authentication relies on three factors—knowledge, possession, and inherence—and has been extensively studied in distributed systems. The authors propose an efficient generic framework that upgrades existing two‑factor authentication schemes to three‑factor schemes while preserving user privacy. The framework is illustrated by upgrading a secure two‑factor scheme, with implementation analysis, formal proofs, and privacy discussion confirming its practicality. The resulting three‑factor scheme is practical, secure, and privacy‑preserving.

Abstract

Remote authentication has been widely studied and adapted in distributed systems. The security of remote authentication mechanisms mostly relies on one of or the combination of three factors: 1) something users know—password; 2) something users have—smart card; and 3) something users are—biometric characteristics. This paper introduces an efficient generic framework for three-factor authentication. The proposed generic framework enhances the security of existing two-factor authentication schemes by upgrading them to three-factor authentication schemes, without exposing user privacy. In addition, we present a case study by upgrading a secure two-factor authentication scheme to a secure three-factor authentication scheme. Furthermore, implementation analysis, formal proof, and privacy discussion are provided to show that the derived scheme is practical, secure, and privacy preserving.