Transient Authentication for Mobile Devices

计算机如何确定用户请求是真实的？目前，用户必须不时地证明他们的身份，并且假定此身份验证对所有用户请求都有效，直到显式或隐式地撤销它。这种模式不太适合移动设备，因为移动设备容易丢失或被盗。攻击者持有受信任用户的设备，在剩余的身份验证期间拥有该用户的全部权限。需要更频繁身份验证的系统是繁重的；用户禁用或绕过这些保护措施，从而丧失其保护。这个问题可以通过一种称为瞬态身份验证的技术来解决。与其将长期权限投资于移动设备（很容易放置或被盗的东西），不如将其保留在用户佩戴的小身份验证令牌中。本研究探讨了将身份验证（传统上是一个持久属性）变为一个瞬时属性的含义。对进程状态和文件系统状态进行暂态认证。将设计一个应用程序编程接口（API），并将许多应用程序和服务移植到该接口。该系统将通过控制基准进行评估，建立性能和可用性要求。由此产生的系统将提供强大的保护，防止丢失或被盗，而不会给授权用户带来不便。

How does a computer determine that user requests are authentic? Currently, users must prove their identity from time to time, and this authentication is assumed to hold for all user requests until it is either explicitly or implicitly revoked. This model is poorly matched to mobile devices, which are prone to loss or theft. An adversary, holding the device of a trusted user, has the full authority of that user for the remainder of the authentication period. Systems that require more frequent authentication are burdensome; users disable or work around such safeguards, forfeiting their protection. This problem is addressed by a technique called transient authentication. Rather than invest long-term authority with a mobile device---something easily set down or stolen---it is retained within a small authentication token worn by the user. This research explores the implications of making authentication, traditionally a persistent property, into a transient one. Transient authentication will be applied to process state and file system state. An application programming interface (API) will be designed, and a number of applications and services ported to it. The system will be evaluated through controlled benchmarking, establishing the claims of performance and usability. The resulting system will provide strong protection against loss or theft without inconveniencing authorized users.