Designing challenge questions for location‐based authentication systems: a real‐life study

Abstract

Online service providers often use challenge questions (a.k.a. knowledge-based authentication) to facilitate resetting of passwords or to provide an extra layer of security for authentication. While prior schemes explored both static and dynamic challenge questions to improve security, they do not systematically investigate the problem of designing challenge questions and its effect on user recall performance. Interestingly, as answering different styles of questions may require different amount of cognitive effort and evoke different reactions among users, we argue that the style of challenge questions itself can have a significant effect on user recall performance and usability of such systems. To address this void and investigate the effect of question types on user performance, this paper explores location-based challenge question generation schemes where different types of questions are generated based on users' locations tracked by smartphones and presented to users. For evaluation, we deployed our location tracking application on users' smartphones and conducted two real-life studies using four different kinds of challenge questions. Each study was approximately 30 days long and had 14 and 15 users respectively. Our findings suggest that the question type can have a significant effect on user performance. Finally, as individual users may vary in terms of performance and recall rate, we investigate and present a Bayesian classifier based authentication algorithm that can authenticate legitimate users with high accuracy by leveraging individual response patterns while reducing the success rate of adversaries.

Exclusive Contexts Resolver: A Low-Power Sensing Management System for Sustainable Context-Awareness in Exclusive Contexts

“…Then, the expert system deducts the sensing operation that consumes unnecessary power using the unnecessary sensing search rule defined in this paper. Here are the necessary and sufficient conditions for the unnecessary sensing operation: 1 There are no sensors of the same type used for the exclusive contexts, and the exclusive contexts are inferred at the same time. 2 If the conditions of the sensors that have the same type and which are used for the exclusive contexts are not same, they are not disjointed.…”

“…In order to manage and operate multiple applications for sustainable context-aware service, it is essential to express their context-aware services by using general models. There are various types of general models as described below [13]: 1 Key-value models represent the simplest data structure for modeling contexts by exploiting pairs of two items, namely a key (attribute name) and its value. 2 Markup scheme models use XML-based representations to model a hierarchical data structure consisting of markup tags, attributes, and contents.…”

“…The availability of a mobile device equipped with various sensors allows users to utilize context-aware services [1,2]. The context-aware service senses the physical environment around the user by using various sensors to offer a well-fitted service.…”

Secure Cyber Deception Architecture and Decoy Injection to Mitigate the Insider Threat

“…If the authentication method is not robust, the attacker will intercept the MTD policy. In this regard, recently, Bayesian classifiers using question/response patterns have been studied to authenticate legitimate users [24]. Also, since the authentication server performs an operation similar to the DNS, techniques such as the latest research that provide DNS security based on a public key infrastructure rather than a certificate basis [25] can be applied in the authentication server.…”

“…Table 2 is a description of the function modules constituting the five subsystems of the selfmutation system. The authentication and key management are responsible for authentication and key distribution for all entities [24,25]. The moving server and decoy host have interfaces for interactions by which to receive the mutation strategy from the management system.…”