Affiliations: [a] University of California, Davis, CA, USA | [b] Google Inc., Mountain View, CA, USA
Correspondence:
[*]
Corresponding author: Hao Chen, Department of Computer Science, University of California, Davis, CA 95616-8562, USA. Tel.: +1 530 754 5375; Fax: +1 530 752 4767; E-mail: hchen@cs.ucdavis.edu.
Abstract: Web authentication that is both secure and usable remains a challenge. Passwords are vulnerable to phishing attacks, while physical tokens face deployment obstacles. We propose to leverage the authentication infrastructure of cellular networks to enhance Web authentication. We design WebCallerID, a Web authentication scheme that uses cell phones as physical tokens and uses cellular networks as trusted identity providers. Since WebCallerID requires no user participation during authentication, it prevents security mistakes by users. WebCallerID also prevents rogue websites from replaying authentication assertions or stealing users' identities. We have implemented a prototype of WebCallerID using the OpenID framework. The prototype shows that WebCallerID seamlessly integrates into OpenID-capable Web authentication while avoiding phishing problems in OpenID and simplifying user participation.
Keywords: Authentication, cellular networks, mobile authentication, OpenID, phishing, single sign on, usable security, Web authentication
