Loxin: A Password-Less Universal Login System - Enabling Bring-Your-Own-Device for Authentication in Enterprise

作为对最终用户进行身份验证的最简单、最廉价的方法，基于密码的身份验证方法一直被组织和企业用作限制和监控访问的默认机制。由于越来越多的服务台电话要求重置密码，员工需要记住多个登录凭据的事实给企业带来了巨大的成本，使企业面临更多的安全漏洞。受对安全、经济高效和用户友好的企业身份验证解决方案的迫切需求的推动，拟议的项目旨在开发名为LOXIN的无密码身份验证系统的原型实现及其威胁和风险评估，该系统可以完全取代现有的基于密码的身份验证系统，也可以灵活部署为双因素身份验证器，以增强企业环境中的安全性。LOXIN系统通过移动推送消息服务利用公钥加密和移动渠道，并通过使用预先拥有的身份以及员工移动设备上的少量点击来向多个企业服务验证员工的身份。此外，LOXIN的一个显著特征是，它消除了在企业应用程序服务器或数据库受到危害的情况下泄漏用户凭据的潜在风险。LOXIN系统将有助于缓解当前企业密码管理实践的痛苦。拟议项目的成功将加强加拿大基本网络系统的安全，并与加拿大的网络安全战略很好地结合起来。拟议技术的成功转让将为加拿大带来一系列经济利益。特别是，用户友好、高度安全的认证系统的可用将为加拿大多个行业部门的云服务提供强有力的保护，并确保加拿大在云安全技术方面的领先地位。

As the easiest and cheapest way of authenticating an end user, password-based authentication methods have been consistently employed by organizations and businesses as the default mechanism of restricting and monitoring access. The fact that employees need to remember multiple login credentials has incurred significant costs for an enterprise due to the increasing number of help desk calls for password reset, is exposing the business to more opportunities for security breaches.Motivated by the urgent need for a secure, cost-effective and user-friendly enterprise authentication solution, the proposed project is to aim for developing a prototype implementation of a password-less authentication system called LOXIN and its threat and risk assessment, which can replace existing password-based authentication systems altogether or can be flexibly deployed to either serve as a two-factor authenticator to enhance security in an enterprise environment. The LOXIN system takes advantage of public-key cryptography and mobile channels by mobile push message services, and authenticates an employee to multiple enterprise services by using pre-owned identities together with few taps on the employee's mobile device. Moreover, one salient feature of LOXIN is that it eliminates the potential risk of leaking users' credentials in the case of enterprise application servers or databases being compromised. The LOXIN system will help relieve the pain for the current enterprise password management practice. The success of the proposed project will strengthen the security of Canada's fundamental cyber systems and aligns well with Canada's Cyber Security Strategy. The successful transfer of the proposed technology to the marketplace will bring a range of economic benefits to Canada. In particular, the availability of the user-friendly and highly secure authentication system will provide strong protection for cloud services in multiple industry sectors in Canada and ensure Canada's position in the forefront of cloud security technologies.