Mobile Token-Based Authentication e t u p m On a Budget o C - - PowerPoint PPT Presentation

▶
mobile token based authentication
SMART_READER_LITE
LIVE PREVIEW

Mobile Token-Based Authentication e t u p m On a Budget o C - - PowerPoint PPT Presentation

Aug 29, 2023 881 likes •1.21k views

b a L y t i r u c e S r Mobile Token-Based Authentication e t u p m On a Budget o C d r o f Hristo Bojinov Dan Boneh n a Stanford Computer Security Lab t S Tuesday, March 1, 2011 The future of keys? Motivation #1

slide-1
SLIDE 1

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Mobile Token-Based Authentication

On a Budget

Hristo Bojinov Dan Boneh Stanford Computer Security Lab

Tuesday, March 1, 2011

slide-2
SLIDE 2

The future of keys?

Motivation #1

Tuesday, March 1, 2011

slide-3
SLIDE 3

Versatility of smartphones

Motivation #2

Tuesday, March 1, 2011

slide-4
SLIDE 4

Smartphones vs. keys

$100 arbitrary apps use all day palm-size fragile

Tuesday, March 1, 2011

slide-5
SLIDE 5

Smartphones vs. keys

$100 arbitrary apps use all day $1 unlock doors a few times daily palm-size fragile tiny tough

Tuesday, March 1, 2011

slide-6
SLIDE 6

Talk overview

General theme: Unlocking smartphones

Tuesday, March 1, 2011

slide-7
SLIDE 7

Talk overview

General theme: Unlocking smartphones Part 1: About this work

  • Compass as a receiver
  • Microphone as a receiver
  • Cost and power

Tuesday, March 1, 2011

slide-8
SLIDE 8

Talk overview

General theme: Unlocking smartphones Part 1: About this work

  • Compass as a receiver
  • Microphone as a receiver
  • Cost and power

Part 2: On-going and future work

Tuesday, March 1, 2011

slide-9
SLIDE 9

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Compass

Tuesday, March 1, 2011

slide-10
SLIDE 10

Permanent magnets

Tuesday, March 1, 2011

slide-11
SLIDE 11

Permanent magnets (continued)

Poor resolution: distance to magnets is too great!

Tuesday, March 1, 2011

slide-12
SLIDE 12

Magkey prototype

Tuesday, March 1, 2011

slide-13
SLIDE 13

Magkey circuit

Tuesday, March 1, 2011

slide-14
SLIDE 14

MagLock app

up to ~5 baud (N1) about 1 inch range

Tuesday, March 1, 2011

slide-15
SLIDE 15

MagLock app

Tuesday, March 1, 2011

slide-16
SLIDE 16

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Microphone

Tuesday, March 1, 2011

slide-17
SLIDE 17

Mickey prototype

Tuesday, March 1, 2011

slide-18
SLIDE 18

Mickey circuit

Magkey, minus the coil, plus:

Tuesday, March 1, 2011

slide-19
SLIDE 19

MicLock app

up to ~100 baud (N1) about 1 foot range

Tuesday, March 1, 2011

slide-20
SLIDE 20

MicLock app

Tuesday, March 1, 2011

slide-21
SLIDE 21

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Cost and Power

Tuesday, March 1, 2011

slide-22
SLIDE 22

Cost

Component Unit cost Magkey Mickey Timer IC $0.20 $0.20 $0.40 Shift Register IC $0.25 $0.50 $0.50 Discrete varies $0.37 $0.38 Total (Prototype) $1.07 $1.28 PIC IC $0.38 $0.38 $0.38 Total (PIC) $0.75 $0.76

Tuesday, March 1, 2011

slide-23
SLIDE 23

Current and longevity

Current Mode Magkey Mickey Average 6.91mA 0.23mA Peak 16.00mA 0.25mA Continuous 210 hrs 6500 hrs On-demand >5 yrs >10 yrs

Tuesday, March 1, 2011

slide-24
SLIDE 24

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

What’s Next?

Tuesday, March 1, 2011

slide-25
SLIDE 25

Low-power wireless

Contactless cards (e.g. NFC)

  • No batteries required in token
  • Off-the-shelf tokens: today
  • Short practical range

Tuesday, March 1, 2011

slide-26
SLIDE 26

Low-power wireless

Contactless cards (e.g. NFC)

  • No batteries required in token
  • Off-the-shelf tokens: today
  • Short practical range

Bluetooth 4.0 (Low-energy)

  • Might be more pervasive than NFC: laptops, PCs
  • Designed for long-term, synchronous operation
  • A decent alternative we might consider

Tuesday, March 1, 2011

slide-27
SLIDE 27

So, what is next?

Prove token authentication viability (mobile devices)

  • Analyze more [proprietary] technologies
  • Influence NFC security agenda

Tuesday, March 1, 2011

slide-28
SLIDE 28

So, what is next?

Prove token authentication viability (mobile devices)

  • Analyze more [proprietary] technologies
  • Influence NFC security agenda

Develop end-to-end token authentication theme

  • Authentication on the web, multi-tenant tokens
  • PC authentication... keychains, PAM, Windows?

Tuesday, March 1, 2011

slide-29
SLIDE 29

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Conclusion

Tuesday, March 1, 2011

slide-30
SLIDE 30

Conclusion

Massive opportunity to redo user authentication:

  • Phones are the most versatile computers to date

★ Rapid, on-going evolution, diverse inputs

  • Momentum to standardize light-weight wireless
  • Threats are more abundant than ever before

Address local, mobile app, and web authentication. Drive the security agenda into standards efforts.

Tuesday, March 1, 2011

slide-31
SLIDE 31

S t a n f

  • r

d C

  • m

p u t e r S e c u r i t y L a b

Time for Q&A.

http://seclab.stanford.edu

Tuesday, March 1, 2011