Detecting and Preventing Credential Misuse in OTP-Based Two and Half Factor Authentication Toward Centralized Services Utilizing Blockchain-Based Identity Management

   - Centers For Services,
   - Identity Management,
   - Blockchain-based Identity Management,
   - Privacy,
   - Service Providers,
   - Secret Key,
   - User Identification,
   - Smart Contracts,
   - Authentication Scheme,
   - Mnemonic,
   - Types Of Attacks,
   - Public Key,
   - Malware,
   - Authentication Process,
   - Merkle Tree

This paper focuses on the problem of detection and prevention of stolen and
misused secrets (such as private keys) for authentication toward centralized
services. We propose a solution for this problem, based on SmartOTPs, the
two-factor authentication scheme against the blockchain, which is intended for
smart contract wallets and utilizes one-time passwords (OTPs). We modify
SmartOTPs for our purposes and utilize them in the setting of
two-and-a-half-factor authentication against a centralized service provider. Out
of two and a half factors of our solution, the first factor stands for the
private key, and the second and a half factor stands for OTPs and their
precursors (a.k.a., pre-images), where OTPs are obtained from the precursors by
cryptoaraphically secure hashing. We describe the protocol for bootstrapping our
approach as well as the authentication procedure. In the case of stolen
creden-tials from the client, we show that our solution enables the user to
immediately detect it and proceed to re-initialization with fresh credentials. We
utilize blockchain-based identity management and decentralized identities of
users to simplify the overhead of the registration process and reinitialization.