Security in Computing 5th Edition by Shari Lawrence Pfleeger, Charles P Pfleeger, Jonathan Margulies

Exercise 11

Outline the design of an authentication scheme that “learns.” The authentication scheme would start with certain primitive information about a user, such as name and password. As the use of the computing system continued, the authentication system would gather such information as commonly used programming languages; dates, times, and lengths of computing sessions; and use of distinctive resources. The authentication challenges would become more individualized as the system learned more information about the user.

Your design should include a list of many pieces of information about a user that the system could collect. It is permissible for the system to ask an authenticated user for certain additional information, such as favorite book, to use in subsequent challenges. Your design should also consider the problem of presenting and validating these challenges: Does the would-be user answer a true–false or a multiple-choice question? Does the system interpret natural language prose?

Step 1 of 3

Adaptive Authentication System

Implementation of hard core authentication is more prone to risks. Since the point of granting access to the system remains unchanged, by regular analysis and trials the authentication can be broken. The multi-factor authentication is provided to boost the security feature. It uses more than one secure password from the information possessed by the user, as what individual know or what individual have or what individual are. This authentication can be further secured by making the system learns on its own.

The authentication system first prompts the user to enter the user ID and password and then learns on the basis of data provided to it during the processing. The system can learn from the user information without the knowledge of the user or can even prompt the user. With this the system can learn about the user and can detect fraud accesses. For example, if a person regularly logs-in from Melbourne and an access is requested from Los Angeles then the access can be checked to be fraud or not. The data can only be checked if the system learns the user activity.