Real-time Internet Authentication Weakness Inspection Service

实时互联网认证漏洞检测服务

• 批准号: 71842
• 金额: $ 4.54万
• 依托单位: THREAT STATUS LIMITED
• 依托单位国家: 英国
• 项目类别: Study
• 财政年份: 2020
• 资助国家: 英国
• 起止时间: 2020 至 无数据
• 项目状态: 已结题
• 来源: https://gtr.ukri.org/projects?ref=71842
• 关键词: Real; time; Internet; Authentication; Weakness

End users often choose poor quality secrets for their passwords, and frequently re-use them across multiple applications. This means that compromise of an application from one system can have knock on impact to other applications through credential stuffing attacks. Technically, this could be mitigated to some degree with two factor authentication, but application providers risk subscriber drop off (particularly when dealing with the public) if they add logon complexity, and are therefore reluctant to enforce additional authentication steps.This project will aim to defuse the potential for credential stuffing / password reuse attacks by delivering a real-time, highly secure leaked credential checking protocol and service which will enhance the security of application authentication systems without the need to add additional verification steps for the user.

最终用户经常选择质量较差的密码作为密码，并经常在多个应用程序中重复使用它们。这意味着对一个系统中的应用程序的危害可能会通过撞库攻击对其他应用程序产生连锁影响。从技术上讲，通过两因素身份验证可以在一定程度上缓解这种情况，但应用程序提供商如果增加登录复杂性，就会面临订阅者流失的风险（特别是在与公众打交道时），因此不愿意执行额外的身份验证步骤。该项目旨在通过提供实时、高度安全的泄露凭证检查协议和服务来化解凭证填充/密码重用攻击的可能性，这将增强应用程序身份验证系统的安全性，而无需 为用户添加额外的验证步骤。