A Method of Risk Assessment for Multi-Factor Authentication
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
User authentication refers to user identification based on something a user knows, something a user has, something a user is or something the user does; it can also take place based on a combination of two or more of such factors. With the increasingly diverse risks in online environments, user authentication methods are also becoming more diversified. This research analyzes user authentication methods being used in various online environments, such as web portals, electronic transactions, financial services and e-government, to identify the characteristics and issues of such authentication methods in order to present a user authentication level system model suitable for different online services. The results of our method are confirmed through a risk assessment and we verify its safety using the testing method presented in OWASP and NIST SP800-63.
Abstract
User authentication refers to user identification based on something a user knows, something a user has, something a user is or something the user does; it can also take place based on a combination of two or more of such factors. With the increasingly diverse risks in online environments, user authentication methods are also becoming more diversified. This research analyzes user authentication methods being used in various online environments, such as web portals, electronic transactions, financial services and e-government, to identify the characteristics and issues of such authentication methods in order to present a user authentication level system model suitable for different online services. The results of our method are confirmed through a risk assessment and we verify its safety using the testing method presented in OWASP and NIST SP800-63.
참고문헌 (16)
- Dale Vile, "Freeform Dynamic, User convenience versus system security", ~ (2006)
- Roger Elrod, "Two-factor Authentication" (2005), East Carolina University
- Wikipedia, Definition of Two Factor Authentication,
- Randy Vanderhoof, "Smart Card Alliance, In Smart Card Technology Roadmap for secure ID applications", ~ (2003)
- Tim Hastings, "Multi-factor Authentication and the Cloud", ~ (2010)
- "Introduction of i-PIN" (2010)[URL]
- "Accredited Certificate"[URL]
- "Public Procurement Service"[URL]
- Public Procurement Service(PPS), "Bidder Identification and Fingerprint Registration Process", ~ (2010)
- "OMB M-04-04, E-Authentication Guidance for Federal agencies", ~ (2003)
- NIST, "Special Publication 800-63, Electronic Authentication Guideline" (2006)
- Ministry of Citizens’ Services, "Electronic Credential and Authentication Standard", ~ (2010)
- Bret Hartman, "From Identity Management to Authentication: Technology Evolution to Meet Cyber Threats", ITAA IdentEvent, ~ (2008)
- Fidelity National Information Services, "Multi -Factor Authentication Risk Assessment", ~ (2006)
- OWASP foundation, "OWASP Testing Guide, 2008 v3.0", pp.140~143 (2008)
- "IETF RFC 4683, Internet X.509 Public Key Infrastructure Subject Identification Method (SIM)", ~ (2006)