User Authentication and Authorization for Next Generation Mobile Passenger ID Devices for Land and Sea Border Control

Abstract

Despite the significant economic benefits derived from the continuously increasing number of visitors entering the European Union through land-border crossing points or sea ports, novel solutions, such as next generation mobile devices for passenger identification for land and sea border control, are required to promote the comfort of passengers. However, the highly sensitive information handled by these devices makes them an attractive target for attackers. Therefore, strong user authentication and authorization mechanisms are required. Towards this direction, we provide an overview of user authentication and authorization requirements for this new type of devices based on the NIST Special Publication 500-280v2.1.

Risk-Based Adaptive User Authentication for Mobile Passenger ID Devices for Land/Sea Border Control

“…In this section, we explore the possibility of incorporating both security and usability in user authentication for mobile passenger identification devices for land and sea border control. In order to meet the objectives for secure and usable user authentication for land and sea border passenger identification mobile devices, it is of utmost importance to conduct research to understand the land and sea border control officers' needs, key characteristics, tasks, and environments [4], [11]. Due to the fact that this kind of mobile devices falls into the category of public safety [4], [11], we began our work with qualitative research, which focuses on the information provided by NIST about public safety mobile authentication.…”

“…Consequently, while digitalization brings enormous opportunities and economic benefits providing solutions for the challenges Europe is currently facing, it also exposes the society and economy to cyber threats. Critical sectors such as transport become increasingly dependent on digital technologies to perform their core operations and develop novel efficient transport services and infrastructure to exploit the economic strengths of the EU, and to empower cohesion both at economic and social level [3], [4]. For instance, although the continuously increasing number of visitors entering the European Union through land-border crossing points or seaports brings tremendous economic benefits, novel border control solutions, such as mobile devices for passenger identification for land and sea border control, are essential to accurately identify passengers "on the fly" while ensuring their comfort [4].…”

“…Nevertheless, these devices are expected to become an appealing target for malicious actors in terms of data misuse, data loss and data theft as it is anticipated that they will handle highly sensitive and confidential personal data [4], [5]. Consequently, strong user authentication mechanisms are required to ensure high level of device security to protect sensitive data handled by this kind of devices [6], [7], [8], [9], [10].…”

“…NIST Special Publication 8080 [11] stated that most of the current authentication methods are practically not convenient for the first responders such as the land and sea border control officers, and thus they become infeasible for public safety use in the field. Therefore, it is of utmost importance research effort to be put in the design and implementation of novel secure and usable user authentication mechanisms that will increase the level of device security of the passenger identification mobile devices and will ensure that border control officers at land and sea borders are able to successfully complete their missions [4].…”

“…However, security and usability are often thought of as being contradictive [4]. To deal with this security vs. usability challenge, risk-based and adaptive user authentication types have been proposed to dynamically authenticate a legitimate user throughout their entire interaction with the mobile device, based on a risk score computed in real-time, and adapt the user authentication method based on this risk score, enhancing the reliability of the whole authentication process without interrupting the user's normal activity [12].…”