Work

FIDO-enabled universal authenticator with Web usability and privacy preservation

Year: 2025

Type: article

Abstract: More and more organizations adopt strong authentication schemes, such as multi-factor authentication (MFA) and hardware-based means, to enhance application security instead of ID/password. When using hardware-based authentication methods, users are required to carry hardware authenticators. Then, application systems communicate with the authenticators to authenticate their owners with the credentials stored in the authenticators or the authenticators themselves. For Web-based applications, people may need to install extra components for application servers to communicate with user authenticators. In this case, W3C and Fido alliances have issued the WebAuthn specifications. Therefore, application servers can communicate with user authenticators with Bluetooth, near-field communication (NFC), or other standard means via Web browsers without additional components. However, the current WebAuthn specification does not consider the scenario of using personal identification cards. While some researchers have proposed enhancements by incorporating additional software, these solutions can decrease usability and increase complexity. This study focuses on the scenario that uses personal identification cards as authenticators to access Web applications. In light of this, this study proposes a means to implement Webauthn and FIDO specifications in personal identification cards, which is called FIDO-enable universal authenticator. With the support of WebAuthn, Web applications adopt strong authentication schemes to authenticate users without installing extra software. However, the existing WebAuthn specification lacks provisions for scenarios involving personal identification cards. To address privacy concerns, the proposed system adopts a one-time verifiable identity for identity providers to preserve user privacy. Additionally, we demonstrate the feasibility of implementing the dedicated authenticator with an NFC-based smart card corresponding with FIDO-supported Web applications.

Source: Computers & Electrical Engineering

DOI: 10.1016/j.compeleceng.2025.110201

Authors: Wen-Wei Li, Kuo-Hui Yeh, Yan-Sing Ji, Shi-Cho Cha

Institutions: National Taiwan University of Science and Technology, National Yang Ming Chiao Tung University, National Dong Hwa University

Language: English

Topic: User Authentication and Security Systems

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Estimated APC paid: $2,880

Funders: National Science and Technology Council, National Taiwan University of Science and Technology, National Science and Technology Council