Memory-Enhanced User Authentication Systems

用户身份验证是从移动设备到关键系统(例如，公用事业和医疗保健)的大多数计算机系统的第一道防线。基于知识的身份验证系统是最常见的，它基于您知道的秘密(例如，密码和口令)。这些系统通常保护我们的机密信息(例如，电子邮件和文档)、财务(例如，在线银行)，甚至我们的家庭(例如，通过智能家居服务)。基于知识的认证系统，特别是口令认证系统，由于其低成本和不需要专门的硬件要求而广泛流行。目前，密码单独或与其他方法结合使用很重要，例如密码管理器(作为主密码)、生物测定(在合法用户被拒绝时用于备份身份验证)或多因素身份验证(例如，使用物理令牌)。不幸的是，由于最近使用公开泄露的密码和个人信息进行密码攻击的进展，密码安全已成为一个严重的问题。这些攻击使现有密码系统的可行性受到质疑，并表明需要新的方法来提高安全性。人们对记住安全密码的困难感到沮丧。然而，到目前为止，还没有新的认证方案被广泛采用来取代传统的文本密码。广泛采用的主要障碍包括成本、安全性和可用性问题(例如，错误频率和可记忆性)。这项研究计划将设计、开发和评估基于知识的身份验证方法，以帮助用户创建和记住安全秘密，重点是增强记忆性的可用系统。具体目标包括：(A)利用内隐记忆的认证系统；(B)支持外显记忆的认证系统。外显记忆和内隐记忆的区别在于个体是否有意识地意识到他/她的记忆。预计该计划的结果将有助于提高人们在各种身份验证环境(例如移动、网络、工作场所和家庭)中的安全性和用户体验。预计通过研究创建的一些认证系统将进行大规模研究，以期最终部署。我们的发现和我们设计的系统将帮助加拿大人(和其他人)在各种环境中保护他们的敏感信息，包括网络、移动、金融、医疗保健、家庭和关键系统。该研究计划还将调查设计新的身份验证系统的基础，这些系统增强了人类的记忆能力，可以被该领域的其他研究人员使用。

User authentication is the first line of defense for most computer systems, ranging from mobile devices to critical systems (e.g., for utilities and health care). Knowledge-based authentication systems are the most common, based on a secret that you know (e.g., passwords and passphrases). These systems typically protect our confidential information (e.g., emails and documents), finances (e.g., online banking), and even our homes (e.g., through smart home services). Knowledge-based authentication systems, particularly passwords, are widely popular due to their low-cost and lack of specialized hardware requirements. Currently, passwords are important alone or in combination with other approaches such as password managers (as the master password), biometrics (for backup authentication when legitimate users are rejected), or multi-factor authentication (e.g., with physical tokens). Unfortunately, password security has become a serious concern, due to recent advances in password attacks using publicly leaked password and personal information. These attacks call into question the viability of existing password systems and demonstrate the need for new approaches to improve security. People are frustrated with the difficulty to remember a secure password. However, to date, no new authentication proposal has been widely adopted to replace traditional text passwords. Major barriers to widespread adoption include cost, security, and usability issues (e.g., frequency of errors and memorability). This research program will design, develop, and evaluate knowledge-based authentication approaches to help users create and remember secure secrets, with a focus on usable systems that enhance memorability. Specific objectives include the development of: (a) authentication systems that harness implicit memory; and (b) authentication systems that support explicit memory. Explicit and implicit memory are differentiated by whether or not an individual is consciously aware of his/her recollection. The outcomes of this program are anticipated to help improve the security and user experience of people in a wide variety of authentication environments (e.g., mobile, web, workplace, and home). It is expected that a number of the authentication systems created through the research will undergo large-scale studies with the goal of eventual deployment. Our findings and systems we design will help Canadians (and others) protect their sensitive information in a variety of environments, including web, mobile, financial, healthcare, home, and critical systems. The research program will also investigate foundations for designing new authentication systems that empower human memory capabilities, which can be used by other researchers in the field.