Memory-Enhanced User Authentication Systems

内存增强型用户身份验证系统

• 批准号: RGPIN-2019-05803
• 负责人: Thorpe, Julie
• 金额: $ 2.99万
• 依托单位: University of Ontario Institute of Technology
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2019
• 资助国家: 加拿大
• 起止时间: 2019-01-01 至 2020-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=688305
• 关键词: Memory; Enhanced; User; Authentication; Systems

User authentication is the first line of defense for most computer systems, ranging from mobile devices to critical systems (e.g., for utilities and health care). Knowledge-based authentication systems are the most common, based on a secret that you know (e.g., passwords and passphrases). These systems typically protect our confidential information (e.g., emails and documents), finances (e.g., online banking), and even our homes (e.g., through smart home services). Knowledge-based authentication systems, particularly passwords, are widely popular due to their low-cost and lack of specialized hardware requirements. Currently, passwords are important alone or in combination with other approaches such as password managers (as the master password), biometrics (for backup authentication when legitimate users are rejected), or multi-factor authentication (e.g., with physical tokens). Unfortunately, password security has become a serious concern, due to recent advances in password attacks using publicly leaked password and personal information. These attacks call into question the viability of existing password systems and demonstrate the need for new approaches to improve security. People are frustrated with the difficulty to remember a secure password. However, to date, no new authentication proposal has been widely adopted to replace traditional text passwords. Major barriers to widespread adoption include cost, security, and usability issues (e.g., frequency of errors and memorability). ******This research program will design, develop, and evaluate knowledge-based authentication approaches to help users create and remember secure secrets, with a focus on usable systems that enhance memorability. Specific objectives include the development of: (a) authentication systems that harness implicit memory; and (b) authentication systems that support explicit memory. Explicit and implicit memory are differentiated by whether or not an individual is consciously aware of his/her recollection. ******The outcomes of this program are anticipated to help improve the security and user experience of people in a wide variety of authentication environments (e.g., mobile, web, workplace, and home). It is expected that a number of the authentication systems created through the research will undergo large-scale studies with the goal of eventual deployment. Our findings and systems we design will help Canadians (and others) protect their sensitive information in a variety of environments, including web, mobile, financial, healthcare, home, and critical systems. The research program will also investigate foundations for designing new authentication systems that empower human memory capabilities, which can be used by other researchers in the field. **

用户认证是从移动的设备到关键系统（例如，用于公用事业和医疗保健）。基于知识的身份验证系统是最常见的，基于您知道的秘密（例如，密码和密码短语）。这些系统通常保护我们的机密信息（例如，电子邮件和文档），财务（例如，网上银行），甚至我们的家（例如，智能家居（Smart Home）基于知识的认证系统，特别是密码，由于其低成本和缺乏专门的硬件要求而广受欢迎。目前，密码单独或与其他方法组合是重要的，所述其他方法诸如密码管理器（作为主密码）、生物识别（用于在合法用户被拒绝时的备份认证）或多因素认证（例如，物理令牌）。 不幸的是，由于使用公开泄露的密码和个人信息的密码攻击的最新进展，密码安全性已经成为一个严重的问题。这些攻击令人质疑现有密码系统的可行性，并表明需要新的方法来提高安全性。人们对记住安全密码的困难感到沮丧。然而，到目前为止，还没有新的认证建议被广泛采用来取代传统的文本密码。广泛采用的主要障碍包括成本、安全性和可用性问题（例如，错误的频率和可记忆性）。该研究计划将设计，开发和评估基于知识的身份验证方法，以帮助用户创建和记住安全的秘密，重点是增强可记忆性的可用系统。具体目标包括开发：（a）利用内隐记忆的认证系统;（B）支持外显记忆的认证系统。外显记忆和内隐记忆的区别在于个体是否有意识地意识到他/她的回忆。****** 预计该计划的成果将有助于提高人们在各种身份验证环境中的安全性和用户体验（例如，移动的、web、工作场所和家庭）。预计通过研究创建的一些认证系统将进行大规模研究，最终部署。我们的研究结果和我们设计的系统将帮助加拿大人（和其他人）在各种环境中保护他们的敏感信息，包括网络，移动的，金融，医疗保健，家庭和关键系统。该研究计划还将研究设计新的认证系统的基础，这些系统可以增强人类的记忆能力，并可供该领域的其他研究人员使用。**