Authentication Beyond Passwords

A strong password contains capital and lowercase letters, numbers and some special characters. Done properly, the result is a password that grants access to computer systems to the proper user. The only problem is the password is hard to remember, and it’s not supposed to be written on yellow sticky notes that can sometimes be found on the bottom of keyboards. And don’t get comfortable with this long password; it has to be changed every 90 days or so.

With DARPA’s new Active Authentication program, program manager Richard Guidorizzi would like to change that. Instead of current authentication systems that force humans to adapt to computers, Guidorizzi wants to make computers adapt to the humans that built them in the first place. He wants researchers who will work in the Active Authentication program to investigate innovative software approaches that determine a computer user’s identity through activities a user normally performs.

This changes how things are currently done by removing the secret a human holds, a cumbersome and hard to remember password, and focuses on making the user the actual password. Guidorizzi puts it a different way.

“My house key will get you into my house, but the dog in my living room knows you’re not me. No amount of holding up my key and saying you’re me is going to convince my dog you’re who you say you are.  My dog knows you don’t look like me, smell like me or act like me. What we want out of this program is to find those things that are unique to you, and not some single aspect of computer security that an adversary can use to compromise your system,” Guidorizzi said.

While these identifying aspects of a person are what we hope to use to grant levels of access to computer systems as appropriate, Active Authentication seeks to make you the key to your access, not to track aspects of who you are. Guidorizzi expects researchers to take special care to ensure this program doesn’t violate privacy laws or allow information about a user’s identity to be misused by others.  He doesn’t want to capture user aspects in a database; he only wants to use this information as the key to user access of their computer systems.

Examples of existing research include work with fingerprints, although deployment of sensors makes this more challenging so this program focuses more on software-based solutions. Mouse tracking has received attention as a tool that can validate a person’s identify while sitting at a computer, suggesting this as a possible candidate for further research. In addition, forensic authorship is a field where people are able to identify an author by language usage.

Guidorizzi hosts Active Authentication’s performers day Nov. 18. Those interested in attending can find additional information here.

Featured

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.