Securing Web Applications with Improved Multifactor Authentication Using Browser-Based Geolocation
摘要
In the current fast-paced technology-driven cyber world, security is one of the major key challenges. Unauthorized access and identity theft is one of the security concerns and a good authentication mechanism is required to protect from these vulnerabilities. Basic Single Factor Authentication (SFA), username and password, can be easily cracked by various attacks like Dictionary Attack, and Bruteforce Attack. Hence multiple factors are utilized for enhancing security known as MultiFactor Authentication (MFA). It comprises three factors such as Knowledge Factor (like PIN, Password), Possession Factor (like Card, Mobile Phone) and Inherence Factor (like Biometrics). Conjuncture of two or more factors constitutes the multifactor authentication, which increases the security. However, these methods have vulnerabilities, hence, some new factors like location factor added for enhancing the security. Proposed system employs three factors for authentication that are Knowledge Factor, Possession Factor, and Location Factor. A web application is developed by incorporating these factors. Wireshark and Burpsuite tools are used for testing purpose. A browser add on VPN (Virtual Private Network) is used for analyzing the Location factor. Data transmitted over network in encrypted form by enabling HTTPs (Hypertext Transfer Protocol Secure) through Secure Socket Layer (SSL)/Transport Layer Security (TLS) certificates which is verified using Wireshark and if IP address location is mocked by VPN (Virtual Private Network), then also proposed system is working as expected. Since three factors are used, hence, it lowers the risk of various attacks like Man in The Middle Attack (MITM), Social Engineering attacks etc.