Collaborative Authentication Using Threshold Cryptography

Abstract

We propose a collaborative authentication protocol where multiple user devices (e.g., a smartphone, a smartwatch and a wristband) collaborate to authenticate the user to a third party service provider. Our protocol uses a threshold signature scheme as the main building block. The use of threshold signatures minimises the security threats in that the user devices only store shares of the signing key (i.e., the private key) and the private key is never reconstructed. For user devices that do not have secure storage capability (e.g., some wearables), we propose to use fuzzy extractors to generate their secret shares using behaviometric information when needed, so that there is no need for them to store any secret material. We discuss how to reshare the private key without reconstructing it in case a new device is added and how to repair shares that are lost due to device loss or damage. Our implementation results demonstrate the feasibility of the protocol.

IoT-Based Activities of Daily Living for Abnormal Behavior Detection: Privacy Issues and Potential Countermeasures

“…Another promising line of research is called frictionless (a.k.a. seamless or collaborative) authentication that allows users to authenticate themselves towards SPs by just using wearables with minimum human interaction [11][12][13]. The main idea behind frictionless authentication is to deploy multiple user devices (e.g., smartphone, smartwatch, wristband) and use them as multiple collaborating provers towards a verifier in a challenge-response protocol.…”

“…Therefore, every time a user performs an ADL session, the IoT sensor data related to this session will be processed and analysed by the SP, as it comes with a proof that it belongs to a legitimate user, but without revealing the real identity of the user; a session-specific pseudonym is used instead. In addition, to enhance usability and convenience, the user could utilise the IoT sensor data coming from her wearables to perform the authentication in a frictionless way [13].…”

Towards Secure and Usable Certificate-Based Authentication System Using a Secondary Device for an Industrial Internet of Things

“…Abidin et al [12] and Peeters et al [13], respectively, proposed collaborative authentication protocols based on threshold cryptography, where multiple user devices jointly perform user authentication to remote verifiers. These approaches commonly use a secret sharing technique to split a secret key for user authentication into multiple shares and distribute them over multiple user devices.…”

“…Due to the nature of the secret sharing technique in these approaches, the security of the collaborative user authentication process can be improved as the number of user devices sharing the secret key increases. However, the maintenance cost of secret shares over multiple user devices also increases because the maintenance operation requires communication among the user devices; according to [12], the maintenance cost of sharing a secret takes about t 2 to (n − 1) 2 under the assumption of (t, n)-threshold scheme, where at least t out of n user devices are required for user authentication. In this paper, we considered a more realistic and practical deployment achieving a balance between the security and the convenience.…”