Secure Web Authentication with Mobile Phones

As computing becomes pervasive, people increasingly rely on public computers to do business over the Internet. But accessing today's web-based services invariably requires typing a username and password to authenticate – a significant vulnerability, since the password can be captured by the public computer and later reused by a hostile party. We introduce a solution to this problem using a mobile phone as a hand-held authentication token and a security proxy which allows the system to be used with unmodified third-party web services. Our goal is to create an authentication system that is both secure and highly usable. Figure 1 illustrates the authentication process. A user who wishes to use an Internet kiosk to access a remote service requiring authentication would instead connect to a trusted security proxy (step 1). The proxy stores the user's passwords and can use them to log in to the remote service. It also stores a mobile phone number for each user, to which a short text message (SMS) is sent to complete the authentication. Once the user responds to this message, the user’s connection from the kiosk is authenticated (step 2). The proxy then operates as a traditional web proxy and mediates all aspects of the user's communication with the remote service, but preventing long-term authenticators (e.g., cookies) from touching the kiosk (step 3).