MoBiSafe: an obfuscated single factor authentication mode to enhance secured USSD channel transaction in Nigeria

Abstract

The flexibility of the unstructured supplementary service data (USSD) across mobile phones has caused its adoption surge as a payment channel. Its usage accommodates financial inclusivity and extends customer reach irrespective of their specific phone capabilities. With data conveyed on the USSD channel in plaintext–this has raised vulnerability issues with shoulder surfing attacks. The use of password yielded extra layer of security as authentication to USSD-based services. But, the rise in password guess attacks has necessitated a new scheme. This study is a randomized-obfuscated single factor authentication (SFA) mode via a 5-digit PIN-entry as requisite for the USSD channel. It yields a list via which users select a key-array that corresponds to their PIN as concealed in a 10-digit array. Expert assess of MoBiSafe’s usability and security against shoulder-surf yielded 10.1 msecs and 2.26 msecs respectively to outperform existing models that utilize direct/indirect PIN-entry as in USSD transactions. And this was found to be both secure, usable and acceptable.