Advancing User Authentication and Access Management

Abstract

In order for online systems to transact business or exchange other sensitive information, there must be an environment where the parties involved can verify that the other is who they claim to be. Authentication mechanisms provide this verification process, thereby, improving confidence in the confidentiality and integrity of communications.

However, attackers can exploit this trust if they are able to successfully impersonate a legitimate user and gain access to the system with all the rights and privileges of that user. One particularly difficult class of attacks of this sort involves an attacker inserting themselves between the end user and the system they are communicating with. This man-in-the-middle (MITM) scenario affords the attacker access to passwords, transaction details and other sensitive information, which they may then modify or use to suit their purposes resulting in identity theft, information compromise and misappropriation of funds via electronic transfer, among other scenarios.

Current solutions are able to mitigate some of this risk, but more work is needed here given the difficulty in detecting MITM attacks. This thesis deals generally with the subject of identity and access management with a specific focus in the area of authentication within an IT system.

The research described here provide new approaches to user-centric and transaction-centric authentication as well as capabilities to improve support for the broader authentication system. The first category of user-centric improvements involves mechanisms which: - leverage a communications side channel so that the user can know with greater certainty that the website they are interacting with is the one they intend, - allow a service provider to detect a MITM by determining the user’s geographical location is consistent across multiple channels, - allow for the detection of a MITM through an out of band voice prompt presented to the user and - improve confidence that a user is who they claim to be by dynamically verifying that they are geographically where they are expected to be even when traveling.

The second category of transaction-centric improvements involves mechanisms which leverage out of band communications to verify transaction details have not been tampered with through: - a voice call in which transaction amounts, accounts, etc. are read aloud to the user for confirmation and - a specially constructed QR code which contains these details and can be verified with a purpose-built mobile app.

The third category of broader authentication system support mechanisms which: - detect a MITM attack by recognizing changes in login traffic patterns, - detect rogue domain name service providers which might attempt to redirect traffic to attacker websites, - allow for non-disruptive, secure migration of users across authentication systems and - allow for a secure means to regain access to a mobile device for which the passcode has been lost.

This research consists of a body of published works, most of which have taken the form of patent filings, which have been peer reviewed and granted by the US Patent and Trademark Office.