Transient Authentication for Mobile Devices

计算机如何确定用户请求是真实的？目前，用户必须时不时地证明他们的身份，这种身份验证假定对所有用户请求有效，直到它被显式或隐式撤销。这种模式与移动设备不太匹配，因为移动设备很容易丢失或被盗。持有受信任用户的设备的攻击者在身份验证期的剩余时间内拥有该用户的完全权限。需要更频繁身份验证的系统是繁重的；用户禁用或绕过这种保障措施，丧失了他们的保护。这个问题可以通过一种称为临时身份验证的技术来解决。而不是赋予移动设备长期的权威-容易记下或被盗的东西-它保留在用户佩戴的一个小身份验证令牌中。这项研究探索了将身份验证从传统的持久性属性转变为暂时性属性的含义。临时身份验证将应用于进程状态和文件系统状态。将设计一个应用程序编程接口(API)，并向其移植一些应用程序和服务。该系统将通过受控基准进行评估，确定对性能和可用性的要求。由此产生的系统将提供强大的保护，防止丢失或被盗，而不会给授权用户带来不便。

How does a computer determine that user requests are authentic? Currently, users must prove their identity from time to time, and this authentication is assumed to hold for all user requests until it is either explicitly or implicitly revoked. This model is poorly matched to mobile devices, which are prone to loss or theft. An adversary, holding the device of a trusted user, has the full authority of that user for the remainder of the authentication period. Systems that require more frequent authentication are burdensome; users disable or work around such safeguards, forfeiting their protection. This problem is addressed by a technique called transient authentication. Rather than invest long-term authority with a mobile device---something easily set down or stolen---it is retained within a small authentication token worn by the user. This research explores the implications of making authentication, traditionally a persistent property, into a transient one. Transient authentication will be applied to process state and file system state. An application programming interface (API) will be designed, and a number of applications and services ported to it. The system will be evaluated through controlled benchmarking, establishing the claims of performance and usability. The resulting system will provide strong protection against loss or theft without inconveniencing authorized users.