Dynamic combination of authentication factors based on quantified risk and benefit

Abstract

By combining multiple factors during authentication, a service can provide better assurance of security. However, the users are likely to feel inconvenient, or even discard the service. This paper, therefore, addresses this issue and introduces a novel method, referred to as the Quantified riSk and Benefit adaptive Authentication Factors combination (QSBAF). QSBAF balances the requirements for both security and usability in the authentication of an information system and improves the system's ability to respond quickly to emerging risky events. In QSBAF, the authentication factors can be dynamically combined on the basis of quantified risk, benefit measurements, and combination policies. Furthermore, QSBAF provides an adaptive mechanism, which is driven by history data to justify the measurements of risk and benefit. In this paper, we use the online banking system as a typical scenario to demonstrate the usage of QSBAF. We also implement a prototype of QSBAF to evaluate the performance of its feasibility in real application scenarios.

Dynamic counter-measures for risk-based access control systems: An evolutive approach

“…An analysis about risks in cloud environments is also presented in [46] which considers business level objectives (BLOs) of the organizations to make decisions about treatment of identified risks. Furthermore, in [47] a method to combine multiple authentication factors in an online banking system is proposed. That method called QSBAF (Quantified riSk and Benefit adaptive Authentication Factors) considers quantified risk and benefit of access, which are measured according to historical data.…”

RLAuth: A Risk-Based Authentication System Using Reinforcement Learning

“…In recent years, some domain-specific risk-based user authentication systems were proposed to secure various applications. The authors in [4] proposed a risk engine based on a fuzzy inference system for online banking that considers the cost and benefits of each action. The authors of [7] proposed a risk engine based on fuzzy logic applicable to energy management tasks in smart homes.…”

“…Other works rely on static components like reauthentication methods or methods based on static contextual values [8], [18], [28]. Finally, most authors did not integrate mobile deployment in their design, leading to greater delays of authentication and privacy issues added by network communication [4], [27].…”

A Critical appraisal on Password based Authentication

“…Han et Al. [50] also combined different authentication factors based on risk and benefit policies. An adaptive mechanism was followed which is ordered with historical data to measure risk and benefit.…”

“…Browser extensions such as PwdHash is an example of such types[33]. ,[47][48][49][50][51][52][53][54][55][56][57][58][59][60][61] of third party attacks[58]. Password meters transmit the password information to the third party websites via JavaScript.…”