CICI: Secure Data Architecture: Improving the Security and Usability of Two-Factor Authentication for Cyberinfrastructure

密码身份验证是网络基础设施中的一个严重漏洞，因为典型的密码容易记住和容易被猜中，从而容易受到恶意行为者的攻击。一种公认的增强密码安全性的方法是双因素身份验证(TFA)，其中密码由诸如移动电话或专用令牌(例如USB加密狗)的附加身份验证因素来补充。然而，当前的TFA机制不能提供足够的安全性和可用性。这个项目为改善这两个方面开辟了新的天地。它设计、实现和评估了TFA方案，这些方案不仅可以防御在线猜测攻击，还可以在服务器或移动设备受到危害的情况下防御离线词典攻击。此外，该项目的目标是在不降低可用性的情况下，与仅使用密码的身份验证相比。为TFA方案创建正式的安全模型可以更好地理解TFA的安全性。由此产生的研究原型将在未来构建弹性和可用的身份验证服务的研究中具有巨大的价值。该项目以高级课程开发的形式将研究整合到教育活动中，并在身份和访问管理领域对高中和K-12学生进行指导。新TFA协议的设计提供了针对在线猜测和离线词典攻击的安全性。该项目在TFA协议的强大安全模型中正式证明了这些协议的安全性，该模型是对已建立的口令认证密钥交换(PAKE)模型的扩展。目标是以模块化方式设计TFA协议，允许使用独立的设备和服务器组件，并允许将开发的方案与现有密码协议一起使用，而无需修改服务器软件。此外，研究还涉及开发和测试TFA系统，这些系统将实例化所提出的协议。我们的目标是设计一种TFA系统，在移动设备和客户端之间利用自动化和用户透明的数据通道，仅在此类通道不可用时才退回到本地化的无线无线电通信。这种结构将提供高可用性，因为登录过程的用户体验几乎等同于仅使用密码的身份验证。最后，该项目涉及在实验室环境和现场环境中进行严格的可用性研究，以评估所建议方法的性能、可用性和采用潜力。

Password authentication is a critical vulnerability in cyberinfrastructure because typical passwords are memorable and easily guessed, leaving them vulnerable to malicious actors. One well-recognized method for strengthening the password security is Two-Factor Authentication (TFA), in which the password is complemented by an additional authentication factor such as a mobile phone or a dedicated token (e.g., a USB dongle). However, current TFA mechanisms do not offer sufficient security and usability. This project breaks new ground towards improving both of these aspects. It designs, implements and evaluates TFA schemes that not only protect against on-line guessing attacks, but also against off-line dictionary attacks in case of server or mobile device compromise. Moreover, the project aims to do so without degrading usability compared to password-only authentication. The creation of formal security models for TFA schemes allow for better understanding of TFA security in general. The resulting research prototypes will be of immense value in future research on building resilient and usable authentication services. The project integrates research into educational activities in the form of advanced curriculum development as well as high school and K-12 student mentoring in the area of Identity and Access Management.The design of new TFA protocols offers security against on-line guessing and offline dictionary attacks. The project formally proves the security of these protocols in a strong security model for TFA protocols that is being introduced as an extension to well-established password-authenticated key exchange (PAKE) models. The goal is to design the TFA protocols in a modular way, allowing for the use of independent device and server components, and enabling the use of the developed schemes with existing password protocols and without the need to modify the server software. Moreover, the research involves developing and testing TFA systems which will instantiate the proposed protocols. The goal is a TFA systems design that utilizes automated and user-transparent data channel between the mobile device and the client, falling back to localized wireless radio communication only when such a channel is unavailable. Such construction would provide high usability since the user experience of the login process would be almost equivalent to password-only authentication. Finally, the project involves conducting rigorous usability studies in the lab environment and field settings to evaluate the performance, usability, and adoption potential of the proposed approaches.