Hardening Push MFA: A Standards-Based Context Architecture for Number Matching

About this work

Abstract

Push-based multi-factor authentication reduces login friction but remains vulnerable to MFA-fatigue and concurrent-login attacks. This work proposes context-rich number matching (CRNM), a vendor-agnostic policy framework that binds an approval to the relying-party origin and constrains it with a freshness window around the login event. Using anonymized summaries from a prior push-MFA study, the paper reconstructs a conservative trial-level dataset and evaluates no-context, origin-only, and origin-plus-time policies. The results show modest but monotonic reductions in false approvals in the single-origin setting while preserving benign approvals, and provide a framework for evaluating stronger context-aware deployments.