Two-Factor Distributed Authentication Scheme for Cloud Storage

Distributed authentication plays a crucial role in cloud storage, requiring users to authenticate their identity to a set of key management servers. This process guarantees that only authenticated users gain access to cryptographic keys stored in these servers for decrypting outsourced data. How-ever, existing distributed authentication schemes rely solely on passwords, posing a critical weakness due to the recent surge in password-based attacks. Once passwords are compromised, adversaries can impersonate users, gaining unauthorized access to key management servers and acquiring cryptographic keys. To address this vulnerability, a recent multi-factor scheme has been proposed that introduces a distributed authentication mechanism for each popular factor such as passwords, Universal 2nd Factor (U2F), and email. Users could select multiple factors and utilize their corresponding mechanisms when authenticating to servers. Nevertheless, a simple combination of these authentication mechanisms incurs substantial overheads. In this paper, we propose a combined verification mechanism for passwords and U2F, allowing servers to efficiently verify both factors. Based on the mechanism, we present a two-factor distributed authentication for cloud storage, dubbed TDAC. In TDAC, users could authenticate to key management servers through a single password entry and a touch on their U2F. Experiments show that TDAC is efficient in terms of computation and communication overhead.