Implicit authentication: idea exchange whisper suites
Conferences & Talks

• Elaine Shi, Co-Chair
• Richard Chow, Co-Chair

RSA Conference 2010

1 March 2010
San Francisco, California, USA

description

Idea Exchange Whisper Suites

These suites featured interactive, thought-provoking discussions with a diverse lineup of labs researching the latest in information security technology. Many attendees scheduled appointments on-site with these futuristic thinkers and were able to catch a glimpse of what’s to come:

Implicit Authentication

With mobile devices becoming the next major target for malicious attacks due to their ubiquity, PARC is developing a new authentication paradigm that reduces operating complexity and minimizes power consumption.

Smartphones, netbooks, and other mobile devices are projected to be the most ubiquitous computing platform and, as such, are becoming an emerging category for malicious attacks such as theft of device and theft of credentials. Despite this general consensus, there is also recognition that traditional security methods are not effective for mobile devices.

The form-factor of a mobile device makes robust security requirements cumbersome – this often compromises security by forcing users to opt for ease of use with passwords like “2222”. The question that PARC wants to answer is how to design a mobile device authentication paradigm that takes advantage of existing data without causing user inconvenience.

PARC’s Implicit Authentication solution harnesses the unique capabilities of mobile devices and user behavior to its advantage. The goal of its deployment is to:

• Minimize required user operation without compromising security
• Enable different/new service providers (from the network operator to authentication services) to participate in this market

People are by and large creatures of habit, and Implicit Authentication (IA) recognizes you through observed behavior—for example, where you are, whom you call, etc. By incorporating user behavior data collected in normal operation, IA can enhance device security and reduce onerous data entry. Moreover, since IA decouples data processing and policy decisions from the device to the cloud, this allows players in the various parts of the mobile device ecosystem to participate—ranging from infrastructure to value-added services.

PARC is currently building prototype systems and extending the core capabilities.