An Alternative to Multi-Factor Authentication with a Triple-Identity Authentication Scheme

Every user authentication scheme involves three login credentials, i.e. a username, a password and a hash value, but only one of them is associated with a user identity. However, this identity is actually not robust enough to protect the whole system, while the login entries (i.e., the username and password forms) have not been effectively protected. Furthermore, the extra factor in a system adding multi-factor authentication is transmitted in cyberspace and operated by users. If more identities can be employed for the two login forms to associate with all login credentials, and if the corresponding identifiers are not transmitted in cyberspace and operated by users, such a system can be more robust even without relying on a third-party service. To this end, a triple-identity authentication scheme is designed within a dual-password login-authentication system, which defines identities for the username and the login password, respectively. Therefore, in addition to the traditional server verification, the system can verify the identifiers at the username and password forms in succession. In the triple-identity authentication, the identifiers are entirely managed by the system without involvement of users or a third-party service, and they are concealed, incommunicable, inaccessible and independent of personal information. Thus, they are useless in online attacks.