Thesis Defense: Eiji Hayashi

When
June 5, 2015 1:00pm - June 5, 2015 2:30pm

Where
NSH 3305

Description
THESIS DEFENSE UniAuth: Building a Human-Centered Identity Management System Eiji Hayashi COMMITTEE Jason I. Hong (Chair) Anind K. Dey Lorrie F. Cranor Stuart Schechter (Microsoft Research) DOCUMENT AND MATERIALS http://www.cs.cmu.edu/~ehayashi/dissertation/Dissertation_EijiHayashi.p… ABSTRACT Passwords are the most common form of user authentication today. When passwords were first introduced in the 1960s, computers were a scarce resource, and experts had at most a few passwords to manage. However, today, we are surrounded by many computers and services, and passwords are imposing a growing burden on users. As a way of coping, users choose insecure behaviors, such as writing down passwords, choosing weak passwords, or reusing passwords for multiple accounts. One result is that passwords are now a major source of vulnerabilities in computer systems. To address this problem, I designed, implemented and evaluated the Unified Authentication Framework (UniAuth in short). The three core ideas behind UniAuth are 1) a user will have one smart device that manages all of his credentials, 2) the smart device can communicate with online services as well as physical devices via a standardized protocol to handle activities related to user authentication (such as authentication, account creation and password updates), and 3) the smart device can use its on-board sensors to improve the security and usability of user authentication to the device. With the UniAuth Framework, users only need to authenticate themselves to their smart devices a small number of times a day. Then, the smart device can communicate with online services and physical devices to perform tasks related to user authentication on behalf of users. This work consists of three lines of research. The first explored how people used and managed their passwords in their daily life to confirm design of UniAuth. The second investigated how smartphones’ onboard sensors could be utilized to adjust the security level of user authentication to the smartphones. Finally, the third involved the design, implementation, and evaluation of the UniAuth Framework through an expert review and a field study. These pieces of research demonstrated that UniAuth could realize secure and usable user authentication, which is one of the grand challenges in usable security, provide smooth transitional path from password- based user authentication to a better user authentication, and open up new design space in user authentication research in Internet of Things era.