0EISUA: Zero Effort Indoor Secure User Authentication

Two-factor authentication (2FA) systems implement by verifying at least two factors. A factor can be one or more of something a user knows (password, or phrase), something a user possesses (smart card, or smartphone), something a user is (fingerprint, or iris), something a user does (keystroke), or somewhere a user is (location). In a conventional 2FA system, a user is required to interacts (e.g., typing a passcode) in order to implement the second layer of authentication, which is not very user-friendly. Nowadays, smart devices (phones, laptops, tablets, etc.) can receive signals from different radio frequency technologies within range. As these devices move among networks (Wi-Fi access points, cell phone towers, etc.), they receive broadcast messages, some of which can be used to collect information. This information can be utilized in a variety of ways, such as establishing a connection, sharing information, locating devices, and, most appropriately, identifying users in range. The principal benefit of broadcast messages is that the devices can read and process the embedded information without being connected to the broadcaster. Moreover, the broadcast messages can be received only within a range of the wireless access point sending the broadcast, thus inherently limiting access to those devices in close physical proximity and facilitating many applications dependent on that proximity. In this paper, 0EISUA is proposed, a zero-effort two-factor authentication scheme based on something that is in the user's environment (ambient access points). In our research, data from the broadcast messages are utilized to implement the second authentication factor by determining whether two devices are proximate or not to ensure that they belong to the same user, in a way that requires zero interaction from the user. The new proposed system introduced in this paper is experimentally tested.