Securing User Authentication in Emerging Threat Landscapes

点击翻译按钮获取中文摘要

User authentication-the process of verifying the claimed identity of a user prior to granting access to a system-is a critical first line of defense against unauthorized use of computing systems. While passwords have remained the dominant form of user authentication, the increased sophistication and proliferation of cyberthreats is leading institutions in Canada and internationally to adopt stronger authentication schemes, such as two-factor authentication. However, current approaches to strengthen authentication provide maximum benefit only in limited contexts, such as in organizations with large IT departments that can provide the necessary support and training to enable universal use by all users. Multi-factor authentication and password management are known to be among the most important mechanisms that can prevent most losses caused by security breaches. The long-term objective of this research program is to transform the future of user authentication to allow users to authenticate using methods that are convenient, usable, and accessible, while meeting clearly-defined security goals of all stakeholders including users and online service providers. This will improve people's lives by making it easier for them to protect themselves online, and will reduce the burden imposed on industry and government by an increasingly hostile threat landscape. Toward that end, this research program will (1) Examine, via large-scale data collection, untested assumptions in security literature for their applicability in the real-world deployment and usage of authentication systems; (2) Build novel security mechanisms that address a wider and more sophisticated range of threats than current systems, without requiring additional user effort; (3) Design new authentication schemes that leverage modern technologies, such as trusted execution environments and Internet of Things devices, to achieve benefits that were not previously possible; (4) Develop frameworks that security practitioners can use to compose authentication systems from known components tailored to fulfill security objectives required for specific contexts; and (5) Formulate methods to communicate threat models to users to aid them in decision-making for configuring and using authentication systems. One fifth of Canadian businesses suffered operational consequences due to cybersecurity attacks in 2017; the economic impact of such attacks in Canada is over $3 billion annually. Weak authentication is recognized as a leading cause of breaches. This research program will be instrumental in developing security mechanisms and frameworks that counter a more powerful range of threats and systematically address specific security requirements in different contexts. It will also respond to the shortage of cybersecurity professionals in Canada, which will see a demand for up to 53,000 professionals as early as 2023, by training graduate and undergraduate students to be highly-qualified security experts.