Knowledge-Based Authentication: Evaluating and Improving

身份验证是计算机安全和几乎所有计算机化系统使用的核心。随着在线电子商务、银行、社交网站和政府服务的爆炸式增长，寻找安全、可用和高效的认证系统的问题比以往任何时候都更加紧迫。安全故障的风险是显而易见的，而且不可用或效率低下的系统还可能失去客户，或者管理密码恢复的支持服务过于昂贵。尽管日常身份验证具有明显的重要性，并且广泛采用了诸如挑战问题之类的改进机制，但令人惊讶的是，这些方法缺乏已发表的基础研究。目前都缺乏比较研究、可用性和可恢复性成本的衡量标准、科学合理的有效实施指南。本研究建议理解和评估使用“已知信息”（如挑战问题）的认证系统的现有实践，并提出改进建议。我们预计，这一结果将对英国境内外的许多行业产生广泛影响。这项研究将由爱丁堡大学的首席研究员David Aspinall博士和访问研究员Michael Just博士共同承担。Michael Just博士是世界知识认证（KBA）领域的领导者，负责加拿大政府在线电子政务解决方案中使用的KBA机制，为300万个账户提供服务。我们预计，我们的研究结果将有助于许多应用程序的安全性和可用性，无论是在英国内外。

Authentication is central to computer security and almost every use of computerised systems. With the explosion of online e-commerce, banking, social web sites and governmental services, the problem of finding secure, usable and efficient authentication systems is more acute than ever. The risks of security failure are obvious, and unusable or inefficient systems additionally risk loss of customers or overly expensive support services managing password recovery.Despite the obvious importance of everyday authentication and the widespread adoption of improved mechanisms such as challenge questions, there is a surprising lack of underpinning published research for these methods. Comparative studies, measures of usability and recoverability costs, scientifically justified guidelines for efficient implementation, are all lacking.This research proposes to understand and assess existing practice with authentication systems using 'known information' such as with challenge questions, and make recommendations for improvement. We expect that the results will have a widespread impact across many sectors, both inside and outside of the UK. The research will be undertaken by Principal Investigator Dr. David Aspinall of the University of Edinburgh, and Visiting Fellow Dr. Michael Just who is the world leader in Knowledge-Based Authentication (KBA), and responsible for the KBA mechanism used in the Government of Canada's online e-government solution, serving 3 million accounts. We anticipate that the results of our research will contribute positively to the security and usability of many applications, both inside and outside of the UK.