Sökning: id:"swepub:oai:DiVA.org:liu-67274" >
Contributions to We...
Contributions to Web Authentication for Untrusted Computers
-
- Vapen, Anna, 1983- (författare)
- Linköpings universitet,Databas och informationsteknik,Tekniska högskolan,ADIT
-
- Shahmehri, Nahid, Professor (preses)
- Linköpings universitet,IISLAB - Laboratoriet för intelligenta informationssystem,Tekniska högskolan
-
- Fischer-Hübner, Simone, Professor (opponent)
- Department of Computer Science, Karlstad University, Sweden
-
(creator_code:org_t)
- ISBN 9789173931724
- Linköping : Linköping University Electronic Press, 2011
- Engelska 51 s.
-
Serie: Linköping Studies in Science and Technology. Thesis, 0280-7971 ; 1481
- Relaterad länk:
-
https://liu.diva-por... (primary) (Raw object)
-
visa fler...
-
https://liu.diva-por...
-
https://urn.kb.se/re...
-
visa färre...
Abstract
Ämnesord
Stäng
- Authentication methods offer varying levels of security. Methods with one-time credentials generated by dedicated hardware tokens can reach a high level of security, whereas password-based authentication methods have a low level of security since passwords can be eavesdropped and stolen by an attacker. Password-based methods are dominant in web authentication since they are both easy to implement and easy to use. Dedicated hardware, on the other hand, is not always available to the user, usually requires additional equipment and may be more complex to use than password-based authentication.Different services and applications on the web have different requirements for the security of authentication. Therefore, it is necessary for designers of authentication solutions to address this need for a range of security levels. Another concern is mobile users authenticating from unknown, and therefore untrusted, computers. This in turn raises issues of availability, since users need secure authentication to be available, regardless of where they authenticate or which computer they use.We propose a method for evaluation and design of web authentication solutions that takes into account a number of often overlooked design factors, i.e. availability, usability and economic aspects. Our proposed method uses the concept of security levels from the Electronic Authentication Guideline, provided by NIST.We focus on the use of handheld devices, especially mobile phones, as a flexible, multi-purpose (i.e. non-dedicated) hardware device for web authentication. Mobile phones offer unique advantages for secure authentication, as they are small, flexible and portable, and provide multiple data transfer channels. Phone designs, however, vary and the choice of channels and authentication methods will influence the security level of authentication. It is not trivial to maintain a consistent overview of the strengths and weaknesses of the available alternatives. Our evaluation and design method provides this overview and can help developers and users to compare and choose authentication solutions.
Ämnesord
- NATURVETENSKAP -- Data- och informationsvetenskap -- Datavetenskap (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Computer Sciences (hsv//eng)
Nyckelord
- Authentication
- security levels
- identity management
- 2-clickAuth
- information security
- Computer science
- Datalogi
Publikations- och innehållstyp
- vet (ämneskategori)
- lic (ämneskategori)
Hitta via bibliotek
Till lärosätets databas