Online service providers often use challenge questions (a.k.a. knowledge-based authentication) to facilitate resetting of passwords or to provide an extra layer of security for authentication. While prior schemes explored both static and dynamic challenge questions to improve security, they do not systematically investigate the problem of designing challenge questions and its effect on user recall performance. Interestingly, as answering different styles of questions may require different amount of cognitive effort and evoke different reactions among users, we argue that the style of challenge questions itself can have a significant effect on user recall performance and usability of such systems. To address this void and investigate the effect of question types on user performance, this paper explores location-based challenge question generation schemes where different types of questions are generated based on users' locations tracked by smartphones and presented to users. For evaluation, we deployed our location tracking application on users' smartphones and conducted two real-life studies using four different kinds of challenge questions. Each study was approximately 30 days long and had 14 and 15 users respectively. Our findings suggest that the question type can have a significant effect on user performance. Finally, as individual users may vary in terms of performance and recall rate, we investigate and present a Bayesian classifier based authentication algorithm that can authenticate legitimate users with high accuracy by leveraging individual response patterns while reducing the success rate of adversaries.

This paper investigates the feasibility of implementing atmost-once access semantics in a model where a collection of actions is to be performed by failure-prone, asynchronous shared-memory processes. We introduce the At-Most-Once problem for performing a set of n jobs using m processors, and we define the notion of efficiency for such protocols, called effectiveness, that allows the classification of algorithms solving the problem. The effectiveness for an atmost-once implementation is the number of jobs safely completed by the implementation, expressed as a function of the number of jobs n, the number of processes m, and the number of process crashes f . We prove a lower bound of n−f on the effectiveness of any algorithm. We then present two process solutions that offer a trade off between work and space complexity. Finally, we generalize a two-process solution for the multi-process setting using a hierarchical algorithm that achieves effectiveness of n − log m · o(n), coming reasonably close, asymptotically, to the corresponding lower bound.

At-most-once semantics is one of the standard models for object access in decentralized systems. Accessing an object, such as altering the state of the object by means of direct access, method invocation, or remote procedure call, with at-most-once semantics guarantees that the specific instance of access is not repeated more-than-once, enabling one to reason about the safety properties of the object. This paper investigates implementations of at-most-once access semantic for the model with failure-prone, asynchronous shared-memory multiprocessors. The focus here is on the setting, where any processor is able to perform any task on any object, where the total number of tasks is performed is to be maximized while preserving the at-most-once semantics. The paper introduces formal definitions of the At-Most-Once and Do-Exactly-Once problems for performing tasks (including accessing memory) in the assumed model, and defines the notion of efficiency, called effectiveness, that allows for precise characterizations of algorithms solving these problems. Effectiveness for an at-most-once implementation is the number of tasks completed (at-most-once) by the implementation, as a function of the overall number of tasks, the number of participating processors, and the number of processor failures. We show a lower bound on the effectiveness in our model for at-most-once and do-exactly-once implementations that states that at least f tasks cannot be completed, where f is the maximum number of crashes. Following this finding we present two effectiveness-optimal at-most-once algorithms for two-processes (the second improving the space performance of the first) and then we propose an algorithm for the model with n processors. The last algorithm being a hierarchical generalization of a two-processor solution. The algorithms are presented using Input/Output Automata formalism. We prove correctness of the algorithms and analyze their performance in terms of effectiveness.

No abstract

No abstract