Privacy-centered authentication: A new framework and analysis

Abstract

The usage of authentication schemes is increasing in our daily life with the ubiquitous spreading Internet services. The verification of user's identity is still predominantly password-based, despite being susceptible to various attacks and openly disliked by users. Bonneau et al. presented a framework, based on Usability, Deployability, and Security criteria (UDS), to evaluate authentication schemes and find a replacement for passwords. Although the UDS framework is a mature and comprehensive evaluation framework and has been extended by other authors, it does not analyse privacy aspects in the usage of authentication schemes. In the present work, we extend the UDS framework with a privacy category to allow a more comprehensive evaluation, becoming the UDSP framework. We provide a thorough, rigorous assessment of sample authentication schemes, including the analysis of novel behavioural biometrics. Our work also discusses implementation aspects regarding the new privacy dimension and current gaps to be addressed in the future research.