Transient Authentication for Mobile Devices

移动设备的瞬时身份验证

• 批准号: 0208740
• 负责人: Brian Noble
• 金额: $ 18万
• 依托单位: Regents of the University of Michigan - Ann Arbor
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2002
• 资助国家: 美国
• 起止时间: 2002-09-01 至 2004-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0208740&HistoricalAwards=false
• 关键词: Transient; Authentication; Mobile; Devices

How does a computer determine that user requests are authentic? Currently, users must prove their identity from time to time, and this authentication is assumed to hold for all user requests until it is either explicitly or implicitly revoked. This model is poorly matched to mobile devices, which are prone to loss or theft. An adversary, holding the device of a trusted user, has the full authority of that user for the remainder of the authentication period. Systems that require more frequent authentication are burdensome; users disable or work around such safeguards, forfeiting their protection. This problem is addressed by a technique called transient authentication. Rather than invest long-term authority with a mobile device---something easily set down or stolen---it is retained within a small authentication token worn by the user. This research explores the implications of making authentication, traditionally a persistent property, into a transient one. Transient authentication will be applied to process state and file system state. An application programming interface (API) will be designed, and a number of applications and services ported to it. The system will be evaluated through controlled benchmarking, establishing the claims of performance and usability. The resulting system will provide strong protection against loss or theft without inconveniencing authorized users.

计算机如何确定用户请求是真实的？目前，用户必须不时地证明他们的身份，并且假设这种身份验证对所有用户请求都有效，直到它被显式或隐式地撤销。 这种模式与移动的设备匹配不佳，这些设备容易丢失或被盗。 持有受信任用户的设备的攻击者在身份验证期的剩余时间内拥有该用户的全部权限。 需要更频繁身份验证的系统是繁重的;用户禁用或绕过这些保护措施，从而丧失了保护。这个问题可以通过一种称为瞬时身份验证的技术来解决。 与其将长期的权限赋予一个移动终端-一个容易被放下或被盗的东西-它被保存在用户佩戴的一个小的认证令牌中。 这项研究探讨了使认证，传统上是一个持久的属性，到一个短暂的影响。 瞬时身份验证将应用于进程状态和文件系统状态。 将设计一个应用程序接口，并将若干应用程序和服务移植到该接口上，将通过有控制的基准测试对该系统进行评价，确定性能和可用性要求。 由此产生的系统将提供强大的保护，防止丢失或盗窃，而不影响授权用户。