Secure Authentication System based on Multifactor Authentication

In today’s digital landscape, access to various online platforms has become ubiquitous, and so has the risk associated with information security. Traditional username and password-based authentication systems have become increasingly vulnerable to brute force attacks. The proposed project, “Secure Authentication System Based on Multi-Factor Authentication (MFA),” aims to address this pressing concern. MFA, which requires users to provide multiple forms of authentication such as a combination of knowledge-based factors (e.g. One-Time Passwords) and inherence-based factors (e.g. biometrics), significantly enhances the security of user accounts and digital assets. The key objectives of this project are to enhance security, reduce unauthorized access, prevent data breaches, improve user trust, mitigate credential stuffing attacks, comply with regulations, provide flexibility, enable secure remote access, and continuously improve security. To achieve these objectives, the project will leverage a combination of technologies and methods like One-Time Passwords (OTP), Biometric Authentication, Security Tokens, and Push Notifications. Each of these technologies contributes uniquely to the security of the system. For instance, OTPs provide a dynamic and time-sensitive second layer of security, while biometric authentication offers a highly personalized and difficult-to-replicate third layer. In designing and implementing this secure authentication system, the project will prioritize user experience, scalability, and compliance with security best practices and regulations. The system will be developed using Python, MySQL database, and Django framework. The aim is to design a system that is not only secure but also user-friendly and scalable, capable of adapting to growing user bases and evolving security threats. Implementing such a system is critical for enhancing the security of user accounts and sensitive data, as MFA adds an extra layer of protection by necessitating multiple forms of verification before granting access.

The proposed system consists of three main modules; the first module is the sign up module where the user registers his main information and password and email id regarding predefined conditions. The second module is the login module which is used for password comparison. The third module is responsible for generating QR code for synchronizing the generated OTP between the application server and authenticator (on a mobile device).

There is an additional module for generating the TOTP. After successful registration (sign up), the QR code is generated regarding the generated OTP in our system. The user can use an authenticator application on his mobile device, such as Google Authenticator, for scanning the QR code and obtaining the synchronized OTP code. For the authentication process, if the user enters the valid password for login, the system will forward him to the OTP verification page to enter the valid OTP code displayed on the authenticator application and after that user should enter the valid OTP received in their mail id The results demonstrate the effectiveness of our proposed system.