FIDO-enabled universal authenticator with Web usability and privacy preservation

Abstract

More and more organizations adopt strong authentication schemes, such as multi-factor authentication (MFA) and hardware-based means, to enhance application security instead of ID/password. When using the hardware-based authentication methods, users are required to carry hardware authenticators. Then, application systems communicate with the authenticators to authenticate their owners with the credentials stored in the authenticators or the authenticators themselves. For Web-based applications, people may need to install extra components for application servers to communicate with user authenticators. In this case, W3C and Fido alliances have issued the WebAuthn specifications. Therefore, application servers can communicate with user authenticators through the Bluetooth, near-field communication (NFC), or other standard means via web browsers without additional components. However, the current WebAuthn specification does not consider the scenario of using personal identification cards. While some researchers have proposed enhancements by incorporating additional software, these solutions can decrease usability and increase complexity. This study focuses on the scenario that uses personal identification cards as authenticators to access Web applications. In light of this, this study proposes a means to implement WebAuthn and FIDO specifications in personal identification cards called FIDO-enabled universal authenticator. With the support of WebAuthn, Web applications adopt strong authentication schemes to authenticate users without installing extra software. However, the existing WebAuthn specification lacks provisions for scenarios involving personal identification cards. To address privacy concerns, the proposed system adopts a one-time verifiable identity for identity providers to preserve user privacy. Additionally, we demonstrate the feasibility of implementing the dedicated authenticator with an NFC-based smart card corresponding with FIDO-supported Web applications.