Fourth-factor authentication: somebody you know

ABSTRACT

User authentication in computing systems traditionally depends on three factors: something you have (e.g., a hardware token), something you are (e.g., a fingerprint), and something you know (e.g., a password). In this paper, we explore a fourth factor, the social network of the user, that is, somebody you know.Human authentication through mutual acquaintance is an age-old practice. In the arena of computer security, it plays roles in privilege delegation, peer-level certification, help-desk assistance, and reputation networks. As a direct means of logical authentication, though, the reliance of human being on another has little supporting scientific literature or practice.In this paper, we explore the notion of vouching, that is, peer-level, human-intermediated authentication for access control. We explore its use in emergency authentication, when primary authenticators like passwords or hardware tokens become unavailable. We describe a practical, prototype vouching system based on SecurID, a popular hardware authentication token. We address traditional, cryptographic security requirements, but also consider questions of social engineering and user behavior.

REFERENCES

• 1: v-GO SSPR 5.0 product description. Referenced 2006 at www.passlogix.com.
• 2: Simple Distributed Security Infrastructure (SDSI) web page, 2001. Referenced 2006 at http://theory.lcs.mit.edu/~cis/sdsi.html.
• 3: PeopleSoft and Courion deliver integrated password management solution, 27 August 2001. Press release. Referenced 2006 at www.courion.com.
• 4: Matt Blaze , Joan Feigenbaum , Angelos D. Keromytis, KeyNote: Trust Management for Public-Key Infrastructures (Position Paper), Proceedings of the 6th International Workshop on Security Protocols, p.59-63, April 15-17, 1998
• 5: Matt Blaze , Joan Feigenbaum , Martin Strauss, Compliance Checking in the PolicyMaker Trust Management System, Proceedings of the Second International Conference on Financial Cryptography, p.254-274, February 23-25, 1998
• 6: W. Eazel. 'Live phishing' experiment nets consumers hook, line, and sinker. SC Magazine, 8 November 2005. Referenced 2006 at www.scmagazine.com.
• 7: C. Ellison. UPnP security ceremonies design document: For UPnP device architecture 1.0, 3 October 2003. Referenced 2006 at http://www.upnp.org.
• 8: C. Ellison, SPKI Requirements, RFC Editor, 1999
• 9: V. Griffith and M. Jakobsson. Messin' with Texas: Deriving mothers' maiden names using public records. In J. Ioannidis, A. D. Keromytis, and M. Yung, editors, Applied Cryptography and Network Security (ACNS), pages 91--103. Springer-Verlag, 2005. LNCS no. 3531.
• 10: RSA Security Inc. RSA SecurID authenticators, 2006. Product Specification. Referenced 2006 at www.rsasecurity.com.
• 11: J. Jubak. Globalization isn't what's killing GM. MSN Money, 29 November 2005. Referenced 2006 at moneycentral.msn.com.
• 12: D. V. Klein. Foiling the cracker: A survey of and improvements to, password security. In UNIX Security II: USENIX Workshop Proceedings, pages 5--14, Berkeley, CA, 1990.
• 13: J. Leyden. Office workers give away passwords for a cheap pen. The Register, 18 April 2003. Referenced 2006 at www.theregister.co.uk.
• 14: Jonathan M. McCune , Adrian Perrig , Michael K. Reiter, Seeing-Is-Believing: Using Camera Phones for Human-Verifiable Authentication, Proceedings of the 2005 IEEE Symposium on Security and Privacy, p.110-124, May 08-11, 2005 [doi>10.1109/SP.2005.19]
• 15: Kevin D. Mitnick , William L. Simon , William Simon, The Art of Deception: Controlling the Human Element of Security, John Wiley & Sons, Inc., New York, NY, 2002
• 16: T. Pullar-Strecker. NZ bank adds security online. Sidney Morning Herald, 8 November 2004. Referenced 2006 at www.smh.com.au.
• 17: B. Ross, C. Jackson, N. Miyake, D. Boneh, and J. Mitchell. Stronger password authentication using browser extensions. In P. McDaniel, editor, USENIX Security, pages 17--32, 2005.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.m MISCELLANEOUS

General Terms:
Human Factors, Security

Keywords:
authentication, hardware tokens, vouchers