Secure Human-Computer Identification against Peeping Attacks (SecHCI): A Survey
Li, SJ and Shum, HY (2003) Secure Human-Computer Identification against Peeping Attacks (SecHCI): A Survey .
Available under License : See the attached licence file.
This paper focuses on human-computer identification systems against peeping attacks, in which adversaries can observe (and even control) interactions between humans (provers) and computers (verifiers). Real cases on peeping attacks were reported by Ross J. Anderson ten years before. Fixed passwords are insecure to peeping attacks since adversaries can simply replay the observed passwords. Some identification techniques can be used to defeat peeping attacks, but auxiliary devices must be used and such devices are also insecure against peeping attacks if they are lost or stolen. Although more and more people get to know risks from peeping attacks, a practical solution has not been found. This paper first gives a comprehensive review on peeping attacks and related issues, and then points out some basic design principles. Two general structures of secure human-computer identification systems are proposed against peeping attacks. A concrete SecHCI protocol and its various implementations are given, and a real Web service is developed for demonstration. The security and usability of the proposed protocol are investigated in detail. Although the usability of the proposed protocol is not yet sufficiently good, we believe that some design skills of the proposed protocol are useful for future work on SecHCI.
|Divisions :||Faculty of Engineering and Physical Sciences > Computing Science|
|Date :||January 2003|
|Related URLs :|
|Depositing User :||Symplectic Elements|
|Date Deposited :||26 Aug 2015 14:20|
|Last Modified :||26 Aug 2015 14:20|
Actions (login required)
Downloads per month over past year