1. On Community-based Authentication Factor
By Khalid Alkhattabi
Master Thesis Proposal
Committee Members
Dr. C. Edward Chow Dr. Chuan Yue Dr. Jia Rao
Advisor Member Member

2. OUTLINE OF THE TALK INTRODUCTION MULTI-FACTOR AUTHENTICATION
RELATE WORK
RESEARCH QUESTIONS
EVALUATE THE SUCCESS OF PROPOSED RESEARCH
REFERENCES
Community Authentication/Khalid Alkhattabi
3/10/15

3. INTRODUCTION
The demand of security and authentication has been rising these days
The current authentication systems suffers from many drawbacks:
- Username and password can be forgotten, disclosed, lost, or stolen
- Passwords can be guessed based on :
- GPU
- Brute force algorithm
- looking for a dictionary
In Oct 14, 2014, Dropbox was compromised by a hacker who posted usernames and passwords on pastebin.com
- To remedy the vulnerabilities, Dropbox has enabled two-factor authentication
Community Authentication/Khalid Alkhattabi
3/10/15

4. MULTI-FACTOR AUTHENTICATION
Multi-Factor Authentication requires more steps than traditional authentication
Basically it comes down to these factors:
Knowledge - something you know ( Password, PIN, Someone you know)
Possession - something you have ( home address, phone number, Credit Card, Key )
Biometrics something you are (face, fingerprint and iris)
Community relationship - who know me ( identified by trust group people)
Challenges:
How to weigh and choose a combination of factors for effective authentication.
The use of community relationship in authentication is new and not much software implementation is available.
Community Authentication/Khalid Alkhattabi
3/10/15

5. RELATE WORK 1 Group authentication :
It can be applied to authenticate group members in group communication
It considered as a new type of authentication
Most of group authentications that proposed [L. Harn and C. Lin ; L. Harn] are for group-oriented applications , but it is not meant for Multifactor Authentication
[Harn 2013] proposed “ Group authentication” design which is much close to my thesis idea.
Group Manager (GM) is responsible to register all group members to a group.
After all the members are registered, GM will generate a token (Shamir's secret sharing scheme) for each user.
The group members’ will used this token to authenticate him by other group members’ base on that token
Community Authentication/Khalid Alkhattabi
3/10/15

6. RELATE WORK 2
[Haya2013] “CASA: Context- Aware Scalable Authentication”, which talking about how can chooses an appropriate form of active authentication based on the combination of multiple passive factors.
The most weight passive factor was users’ location.
84.3% of logins took place at home (59.2%) and work (25.1%).
My Research question: Can we take location of my friends or group members location’s as a factor ?
Oauth is open authentication protocol which allows applications to access remote resources on web server [Yang2013; RFC ] :
Oauth is widely used on smartphone with client apps
58% of American adults have smartphones
Facebook, Google, twitter, Instagram, yahoo and Flickr are supported Oauth 2.
40% of people use their smartphones to login to theirs social networking site
Community Authentication/Khalid Alkhattabi
3/10/15

7. RELATE WORK 3
[Chau 2011] proposed multi-layer multi-factor authentication for webmail application based on intranet, Internet , extranet users [4].
Single Layer Single Factor authentication (password) ((Internal)
Single Layer Multi factor authentication (userID/password , and OPT) (Intranet)
Multilayer multifactor authentication scheme implementation (OpenID , and (userID/password , and OPT) ) (Public Network)
Research question:
How can we weight the trustworthiness of multi-factor authentication?
Community Authentication/Khalid Alkhattabi
3/10/15

8. RESEARCH QUESTIONS
Can a community based authentication be effective as a key technology for multi-factor authentication?
How can we weight the trustworthiness of multi-factor authentication?
How we can add factor for Multi-factor authentication from social networking ?
Can we take location of my friends or group members location’s as a factor ?
Community Authentication/Khalid Alkhattabi
3/10/15

9. COMMUNITY BASED AUTHENTICATION
Fact : We live in groups :
My wife and me are group, my friends are group, my classmates are group , … etc
E.g., Inheritance court in Saudi Arabia, a person is identified by
Your social security number
Two or more “witness” and their social security number as proofs
Family card which shows all family members.
Ideas for new community based authentication
Create website or app for register users.
Every user can declare the trust of one person or a group.
After the trust group members are created, the system will use them to authenticate a member.
Community Authentication/Khalid Alkhattabi
3/10/15

10. COMMUNITY BASED AUTHENTICATION
Scenario:
Register to website CAFProejctCs700.com to create group of trust people.
Whenever a user wants to use this service, he will login.
All his trust group members will receive SMS on their mobile devices containing a link, they open that link.
If a group member knows the user , It approves and notify the server. The server will allow the user to login. Otherwise , will waiting for a period of time until condition is satisfied (Depending on the situation, it could require one vote or all votes).
Community Authentication/Khalid Alkhattabi
3/10/15

11. TRUSTWORTHINESS OF MULTI-FACTOR AUTHENTICATION
Study how it can weigh numbers of factors in multi- factors authentication based on one or more factors:
Current Location or History of Locations
Time (normal time login or not normal)
Kind of requests
Community Authentication/Khalid Alkhattabi
3/10/15

12. EVALUATE THE SUCCESS OF PROPOSED RESEARCH
Correctness
Trustworthiness of the authentication
- Location
- Current Time (normal time ,or midnight or not normal time )
- Kind of request ( what kind of operation you try to do)
Performance
- Execution time
- Storage requirements.
Community Authentication/Khalid Alkhattabi
3/10/15

13. RESEARCH PLAN Phase One One or Two Weeks (Completed)
Find techniques and tools that I need to start my work :
- Swift Programming language
- Web development languages (HTML5, CSS3, Javascript, PHP)
- Database platform (MySQL)
Phase Two
Three Weeks (Completed)
Installation and learning the new tools
Phase Three
Three Weeks to Four Weeks (In progress)
Implement the group authentication module (done)
Integrate with a set of multi-factor authentication modules
Phase Four
One Week (Future work)
Evaluate the performance
Phase Five
Two Weeks
(Future work)
Writing report
Analysis the result
Community Authentication/Khalid Alkhattabi
3/10/15

14. DELIVERABLES Thesis report documents the research results
A working prototype which demonstrates the basic concepts
Community Authentication/Khalid Alkhattabi
3/10/15

15. REFERENCES
[Haya2013] E. Hayashi, S. Das, S. Amini, J. Hong, and I. Oakley, “Casa: context-aware scalable authentication,” in Proceedings of the Ninth Symposium on Usable Privacy and Security, 2013, p. 3.
[2] F. Yang and S. Manoharan, “A security analysis of the OAuth protocol,” in Communications, Computers and Signal Processing (PACRIM), 2013 IEEE Pacific Rim Conference on, 2013, pp. 271–276.
[3] “RFC The OAuth 2.0 Authorization Framework.” [Online]. Available: [Accessed: 05-Dec-2014].
[4] S. Chaudhari, S. S. Tomar, and A. Rawat, “Design, implementation and analysis of multi layer, Multi Factor Authentication (MFA) setup for webmail access in multi trust networks,” in Emerging Trends in Networks and Computer Communications (ETNCC), 2011 International Conference on, 2011, pp. 27–32.
[5] “Facebook Boosts Security with Encryption, ‘Social Authentication’ | News & Opinion | PCMag.com.” [Online]. Available: [Accessed: 05-Dec-2014].
Community Authentication/Khalid Alkhattabi
3/10/15

16. [6] (L. Harn) , “Group Authentication,” IEEE Trans. Comput. , vol
[6] (L. Harn) , “Group Authentication,” IEEE Trans. Comput., vol. 62, no. 9, pp. 1893– 1898, Sep [7] (L. Harn and C. Lin) , “An Efficient Group Authentication for Group Communications,” Int. J. Netw. Secur. Its Appl., vol. 5, no. 3, pp. 9–16, May 2013.
Community Authentication/Khalid Alkhattabi
3/10/15

17. Community Authentication/Khalid Alkhattabi
3/10/15

18. Community Authentication/Khalid Alkhattabi
3/10/15