RMIT to tackle single sign-on issues by developing continuous authentication

RMIT University is conducting research into overcoming security issues with single-sign on by developing continuous authentication as part of a partnership with CA Technologies.

The research – which has received about $1 million in funding from CA Technologies, the Australian Research Council and the university itself – will focus on continuous user authentication and identifying user behaviour patterns that indicate high risk of a company’s valuable assets being stolen or manipulated by hackers.

Machine learning and modelling will be used to create different user profiles and the level of risk associated with an asset or resource.

Read: Machine learning and predictive modelling 101

The research will be conducted over three years with CA Labs, with associate professor Serdar Boztas leading the project.

Single sign-on – where users use their social media accounts to log in to other websites, for example – are convenient but introduce risk.

“For users, this consolidates their credentials and avoids the inconvenience of continuously re-authenticating; however, the security risks are altered by single sign-on. If the credentials are compromised, or if a session is hijacked, the attacker now has access to all of the services tied to the single-sign on,” Boztas said.

“The problem is that we also use our devices, ranging from tablets to mobile phones to laptops, to work and play on the Internet, while being logged in to both work-related and personal accounts.

“Surveys have shown that current single sign-on authentication techniques have led to losses of up to $1 billion a year.”

The team aims to develop a robust hierarchical, multifactor authentication system. This involves continuous profile checking and monitoring of user behaviour in an automated way.

Dynamic risk assessment will also be developed so the system can give a confidence that the user at the end of the device asking for access is truly that person, while also taking into account the type of asset or resource and how valuable it is to an organisation.

“When the authentication confidence level is less than the risk level of the requested resource, a higher level of authentication would be needed,” explained Boztas.

“In addition to the continuous authentication of the user, whenever there is a mismatch of the authentication confidence and risk assessment of the resource request, the user will be required to provide additional authentication.”

The research team will leverage CA’s AuthMinder and RiskMinder for 1-, 2-, and 3-factor authentication, and improve biometric authentication such as users providing their finger print.

“The security inherent in each method will be quantified so that increasingly more secure inputs will be requested of the user as they access higher-risk assets.”

CA Technologies wants to use the research to add to its Risk Authentication product with continuous user authentication that aligns with user behaviour and risk indicators.

Boztas and his team at RMIT’s School of Mathematical and Geospatial Sciences will also publish their research in international journals and papers for the community to read and learn from.

The team members lead the Information Security and Network Science Research Group at the School, doing research in anomaly detection, biometrics, cryptography, communications sequence design, network science and more.

Read: Mind controlled game developer from RMIT University’s Games Experimental Entertainment Lab taps into users’ brains for feedback