I designed an authentication system as a project for a cyber security class. I want you to critique it please. Here is a quick explanation:

Note: Sorry no images but I'll provide links to videos for the create account and login process

Our authentication system consists of four authentication stages with the third stage disabled by default (An explanation will be provided later). Users start by choosing a username and entering their full name. For the first stage, users draw a line pattern by clicking on a grid displayed on the screen at the time of registration. For login into the first stage the same grid is shown but with a character inside each box. Users need to indicate the same line pattern by inputting characters from the set of characters appearing in the grid using a virtual keyboard. Users need to select characters based on their position on the grid so that it matches the pattern drawn at time of account creation. The character set is the ten digits (0 – 9) and the English alphabets (small and capital letters), which makes the total 26 + 26 + 10 = 62 possible entries. Characters appear randomly in the grid boxes, so a person observing the login process will hardly gain any valuable information. Figures 1 & 2 illustrate the first stage.

Figure 1: Pattern creation for 1st stage

Figure 2: Inputting characters in accordance with the pattern

For the second stage, users need to input four characters—using a virtual keyboard—selected from a set of ten characters according to a certain numeric code specified at the time of registration. The order of the ten characters is random and they are provided from the same character set as the first stage (the full alphanumeric set = 62 characters). The numeric code is communicated secretly to the user. Figure 3 shows the second stage at time of registration and login.

Figure 3: Second authentication stage

For the third stage, the system provides users with a seed value they will need to input into their smartphone to generate a passcode and enter it into the system. At time of registration, the authentication system generates a complex mathematical formula and associates it with the user. The mathematical formula is communicated secretly to the user. The user enters the formula in an Excel like program in his smartphone. For login, the user plugs in the randomly generated seed value into the Excel sheet in his smartphone to get the output. Then, the user finally enters the output (the passcode) into the third stage login screen to be authenticated. Figure 4 shows the third stage.

Figure 4: Third authentication stage

For the fourth stage, users will need to answer a security question selected from a set of questions created at the time of registration as shown below in figure 5.

Figure 5: Fourth stage As you can see, and in order to maximize usability, we chose to use factors mainly from the “something you know” category for our solution to lessen disadvantages. Only one factor (third stage) can be regarded as one from the “something you have” category. The reason we used this one factor was to add some diversity to the system, and the fact that the item needed to be carried is a smartphone. A smartphone is not an extra item to carry because the assumption is that every individual is in possession of a smartphone nowadays, so the disadvantage usually accompanied with factors from the “something you have” category is not really applicable here. However, the third stage is disabled by default, again to maximize usability and minimize user effort. We also added some properties to the system to improve its overall performance. Properties are: a. A timeout option of 60 seconds for each stage, after which the user will have to start all over again. b. For the first stage, the minimum number of boxes for pattern creation is 9. c. The maximum number of login attempts is 10. d. The system logs the user out if inactive for 5 minutes. e. Security questions ask about facts about the user. This makes it easier for the user to remember answers for security questions. We also chose to make the system flexible by allowing the user to enable/disable authentication stages with two as the minimum number of stages as per the discussion above. Our proposed method uses variations of shared secrets, and aims to minimize the user effort, but thwart almost all types of attacks.

Here are the videos:

Create account Create account process:

http://sendvid.com/p5peuwl8

http://sendvid.com/i4d03tb0

I know that the proposed system is an overkill. Most people will not like it. A good defense will be to say that the system is targeted toward a sensitive application like those found in the military. But the actual goal is to come up with a system that balances security and usability.

I need to make it two stages at most with good security.

Thanks

– Jeff
Commented Jul 24, 2016 at 19:51
• The second link is the same video. And in the future, please upload it to a website like Youtube, or Vimeo. I got porn-tabs jumping open on this website... And that's the last thing you want your public to see when presenting your project on a big screen/projector at your school. Commented Jul 24, 2016 at 19:57
• Link is fixed. I'm really sorry, I didn't know this site generates NSFW material. I actually didn't see it happen. I chose it because it is the first free video uploader I found when googling. Commented Jul 25, 2016 at 14:00

You already stated, that this is overkill. I suspect you will anoy the user. All your factors are knowledge factors. Drawing a line in a grid. Identifing the numbers according to the known line. Answering known facts about me.

So as far as I understand you are combining several different kind of knowledges. But the idea about two factor or multi factor authentication is not to ask for two or multiple passwords but to required different authentication types. Why? Because an attacker is not good in attacking all different kinds. I like to talk of the skill profile of the attacker. If an attacker can crack your 8 character password he can as well break two 8 character password. But he might not be able to steal a real possession.

You want to create a new formula for each user? Why that? Are you a professional cryptographer? You should use RFC4246 or RFC6238. These are RFC and standardized.

I recommend to take a look at a solution of mine privacyIDEA. I am not a cryptographer so I do not invent new formulas but stick to open standards. Nevertheless the user can use TOTP, HOTP, smartphone, hardware, yubikeys, questionaire...

• There seems to be a disagreement about this and different points of view. When I first started working on this authentication system, I intended to use factors from different categories (Something you know, Something you have/are), but during initial discussions with the instructor, she said that the systems needs to be inexpensive and highly scale-able so that it can be implemented everywhere if need be. That's why I went with "something you know" category only. Her reasoning were logical since users hate to carry extra items and prefer inexpensive options. What do you guys all think? Commented Aug 9, 2016 at 19:49
• Her reasoning aims to the solutions everyone used so far but also everyone realized lately, that it is crap: Using SMS. You may assume, that everyone has a cell phone. Sending a code to the cell phone is not secure - maybe 70%. But sending an email is even worse. You could as well requires the user to use a loooong password. Commented Aug 10, 2016 at 6:03
• What's crap exactly? Using factors from the same category? Or you mean factors from the "something you know" category is crap? There is no easy and direct answer to this authentication problem. There will always be a trade off. That's what I think. Or better stated, I can say that the best we can do is to tailor complex highly secure authentication systems to critical applications and keep less secure and more practical systems for less critical systems. What do you think? Commented Aug 13, 2016 at 7:15
• I was trying to say, that her arguing: "inexpensive, scalable, user has already..." was the same arguing when setting up SMS. Which turned out to be crap. You should step into the shoes of the attacker and see, what additional effort the system is and what additional skills you need. And if the hurdle and skill profile for the attacker is not raised high enough you should not raise the complexity of the user experience. Commented Aug 13, 2016 at 17:00
• cornelinux, going back to RFC4246 and RFC6238, can you please tell me how to implement that? I read a little about them. I can see that for RFC 6238 for example there are appz for most smart phones. So what do you? You make the user install the app in his smart phone and implement the same algorithm in the authentication system? Then when the user logins, he will be given a seed value which he will enter into his smart phone to get the key? But the algorithm is open source so anybody can generate the key if he knows the seed value which he will see when he logins. Can you please clarify this? Commented Aug 22, 2016 at 19:45