Chapter 7. Two-Factor Authentication with Blockchain

Every organization has hundreds of applications and databases, and its employees access them every day using their credentials (that is, their username and password). An attacker with such valid credentials can bypass existing security solutions, as they look like a legitimate user. As per the Verizon Data Breach report in 2016, more than 63% of successful breaches involved compromised credentials. Two-factor authentication (2FA) provides an added layer to the existing credential-based system protection as a solution to this drastically growing problem.

In this chapter, we will cover the following topics:

• What is 2FA?
• Blockchain for 2FA
• Lab

What is 2FA?

With several data breach incidents, we've witnessed a massive increase in the number of social and professional website accounts being hacked. Sometimes, even a simple human error can cause huge trouble globally. Sometimes, it's easy to predict the password of a user based on their daily activity, behavior, or even name. Users still tend to use plain text passwords to protect their account, and among the worst are password, 123456, and abcde.

2FA is an extra layer of security that's used to ensure that only the legitimate owner can access their account. In this method, the user will first enter a combination of a username and password, and, instead of directly getting into their account, the user will be required to provide other information. This other piece of information can come in one of the following forms:

• Something that the user knows: This could be information such as a password, an answer to a secret question, or maybe a personal identification number (PIN).
• Something...

Blockchain for 2FA

Blockchain is being hailed as one of the most revolutionary and disruptive technologies out there. Blockchain has been disrupting the cybersecurity solutions-based CIA security triad principle. 2FA has been critical in security measures for several years; however, attackers sometimes manage to compromise these systems. We will understand how blockchain can transform the 2FA system to achieve an improved security method.

How can blockchain transform 2FA?

By design, blockchain is a decentralized technology that allows transactions of any kind of value among multiple participants without the involvement of a third party. By leveraging blockchain, we can ensure that this sensitive information never remains on one database; instead, it can be within blockchain nodes that have immutability and can't be modified or deleted. The following diagram shows a blockchain-based 2FA.

In this system, user devices will be authenticated by a third-party 2FA provider through the blockchain network...

Lab

To turn up the entire project, we will have to deploy the sub-component of this project. The source has been taken from GitHub, which can be found at the following link: https://github.com/hoxxep/Ethereum-2FA.

This has the following files in it:

The files in the preceding screenshot are explained as follows:

• contracts: This folder includes our smart contract, TwoFactorAuth.sol
• migrations: This folder consists of migration files to deploy the contract to the blockchain
• test: This folder consists of server.js, which is responsible for event authentication in our contract
• node_modules: This folder includes all the libraries
• truffle.js: This configuration file consists of a set of configurations to connect to the blockchain
• package.json: This is where we specify a configuration of our project, such as name and scripts

Components

The following are the three core components of this project, shown in the following diagram:

• A blockchain network (which we will develop with the Ganache CLI)
• A smart contract...

Summary

In this chapter, you learned how 2FA is one of the most vital security measures. However, the central repository can be at risk of being compromised by sophisticated cyber attacks. We studied how blockchain helps decentralize the database between multiple nodes and reduces the risk of falling victim to a data breach. The Ethereum smart contract is a truly great component for accomplishing a 2FA system, which provides the flexibility to program the entire system.

Questions

We have topics regarding 2FA, types, and methods to authenticate, and a lab to demonstrate how Ethereum can be used to create a 2FA infrastructure. There are some questions that are important to explore, such as these:

1. Can we also achieve MFA with Ethereum, and if so, how?
2. How can we integrate SMS-based 2FA with an Ethereum smart contract?

Further reading

To explore more about the NIST multi-factor authentication (MFA) guidelines, check out the following link: https://www.nist.gov/itl/tig/back-basics-multi-factor-authentication.