Layering authentication channels to provide covert communication
暂无分享,去创建一个
We argue the need for providing a covert back-channel communication mechanism in authentication protocols, discuss various practical uses for such a channel, and desirable features for its design and deployment. Such a mechanism would leverage the current authentication channel to carry out the covert communication rather than introducing a separate one. The communication would need to be oblivious to an adversary observing it, possibly as a man-in-the-middle. We discuss the properties that such channels would need to have for the various scenarios in which they would be used. Also, we show their potential for mitigating the effects of a number of security breaches currently occurring in these scenarios.
[1] Emil Stefanov,et al. Duress detection for authentication attacks against multiple administrators , 2010, Insider Threats '10.
[2] Jeremy Clark,et al. Panic Passwords: Authenticating under Duress , 2008, HotSec.
[3] Ninghui Li,et al. Dynamic Virtual Credit Card Numbers , 2007, Financial Cryptography.
[4] Ross J. Anderson. Can We Fix the Security Economics of Federated Authentication? , 2011, Security Protocols Workshop.