Token based security applications

Abstract

The amount of services both online and in everyday life which require authentication is increasing very rapidly. This is creating a big increase in the amount and the sophistication of attacks against the authentication infrastructure. These factors are inducing dramatic changes in the requirements for authentication systems. The amount of credentials an average person has to manage is becoming unmanageable. This project proposes a new approach, by uniting everyday authorization and identification with online authentication. The proposed authentication system is based on a federated, multi-factor approach which uses ubiquitous hardware such as mobile phones and webcams, making it inexpensive to implement and very convenient to use. The proposed system makes extensive use of QR Codes to implement a secure challenge/response system using open protocols such as OpenID and HTTPS. Furthermore, a new protocol is proposed for identification which uses inexpensive hardware for real world access systems.