Intelligent two-factor authentication – Deciding authentication requirements using historical context data
Year: 2014
Type: dissertation
Abstract: This thesis is a case study of designing and implementing a more secure authentication service for Futurice Ltd., which is a medium-sized software consulting company. Majority of its employees are located in various client offices and need to access internally developed web services over the Internet. In this environment, single password authentication does not provide a sufficient level of security. The standard solution is to require a second authentication factor, such as one-time code in addition to the password. At Futurice, the old authentication service requested authentication once every 12 hours. These unnecessary interruptions annoy users, thus reducing their satisfaction with the tools. Furthermore, when performing complicated tasks, recovering from small interruptions may take several minutes. Deploying two-factor authentication has not been possible because of the increased negative effects of the interruptions. Therefore, the goal of this thesis is to minimize the number of authentication prompts the user encounters, while increasing the security by enabling two-factor authentication. The new two-factor authentication service presented in this thesis uses historical activity data to decide when the user should be reauthenticated. With the new system, reauthentication was requested approximately once per two weeks (on average), resulting in 90% reduction in the number of authentication prompts, without compromising security. Two-factor authentication is not required when there is other evidence from the context data that the user is authentic. A brief inspection of the EU and Finnish laws indicated that the data collection and processing for context based authentication is acceptable. Our results show that the time and effort spent on authentication processes can be reduced with relatively small effort. Similar results should be achievable in other companies and organizations. Thresholds for various algorithms may require tuning, and future work is needed to automate this.
Source: Aaltodoc (Aalto University)
Author: Olli Jarva
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W2600487097