TWC: Small: Toward Pronounceable Authentication Strings

TWC：小：走向可发音的身份验证字符串

• 批准号: 1318520
• 负责人: Fabian Monrose
• 金额: $ 50万
• 依托单位: University of North Carolina at Chapel Hill
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2013
• 资助国家: 美国
• 起止时间: 2013-09-01 至 2017-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1318520&HistoricalAwards=false
• 关键词: TWC; Small; Toward; Pronounceable; Authentication

Despite rampant criticism of passwords and an abundance of alternative proposals for user authentication (e.g., biometrics), passwords are not likely to be replaced in the near future due to their ease of deployment and familiarity to users. Indeed, while a number of policies for improving password systems have emerged, the most widely adopted of these is to simply increase the size of the space from which passwords are drawn. Even so, for user-chosen secrets, these policies generally make passwords harder to remember and type, leading to user frustration. Worse, users generally fulfill these policies in predictable ways, impairing the security benefits they are intended to provide.This project leverages linguistic expertise to develop techniques that provide memorable passwords through both user input and automated processes. Specifically, we explore the formation of pronounceable authentication strings that lead to improved system security and a decreased burden on users (by providing memorable, hint-able, easily type-able passwords that are resistant to attack). Our user-influenced, but system-generated, pronounceable strings combine source words to make lexical blends (aka portmanteaus, e.g., flamingo + mongoose - flamongoose), or elicit user-generated blends from system-suggested semantic domains. Additionally, we examine techniques for rating pronounceability of word-like strings, allowing us to quantify pronunciation difficulty and proactively apply rigorous security analysis techniques to the space of pronounceable word-like strings. The broader significance of the work is to increase our collective understanding of the driving forces behind string pronounceability and the complex relationships involved in human and automated formation of lexical blends.

尽管对密码的批评甚嚣尘上，并且有大量的用户认证的替代方案（例如，生物识别技术），由于密码易于部署和用户熟悉，因此在不久的将来不太可能更换密码。 事实上，虽然已经出现了一些改进密码系统的政策，但其中最广泛采用的是简单地增加提取密码的空间的大小。即便如此，对于用户选择的秘密，这些策略通常会使密码更难记住和输入，导致用户沮丧。更糟糕的是，用户通常以可预测的方式履行这些政策，损害了他们打算提供的安全优势。该项目利用语言专业知识开发技术，通过用户输入和自动化过程提供难忘的密码。 具体来说，我们探索形成发音的身份验证字符串，从而提高系统的安全性和减少用户的负担（通过提供难忘的，提示的，容易键入的密码，是抵抗攻击）。我们的用户影响，但系统生成的，可发音的字符串联合收割机源词，使词汇混合（又名portmanteaus，例如，flamingo + mongoose - flamongoose），或者从系统建议的语义域引出用户生成的混合。此外，我们还研究了对单词字符串的可发音性进行评级的技术，使我们能够量化发音难度，并主动将严格的安全分析技术应用于可发音的单词字符串空间。这项工作更广泛的意义是增加我们对字符串发音能力背后的驱动力以及人类和自动形成词汇混合的复杂关系的集体理解。