OpenUAT: The Open Source Ubiquitous Authentication Toolkit

Abstract

Authenticating spontaneous interactions between devices and usersis challenging for several reasons: the wireless (and therefore invisible)nature of device communication, the heterogeneous nature of devicesand lack of appropriate user interfaces in mobile devices, and therequirement for unobtrusive user interaction. The most promisingapproach that has been proposed in literature involves the exploitationof so-called auxiliary channels for authentication to bridge thegap between usability and security. This concept has spawned theindependent development of various authentication methods and researchprototypes, that, unfortunately, remain hard to compare and interchangeand are rarely available to potential application developers. Webuilt a system which implements and unifies these approaches. Inthis paper, we present OpenUAT, an open source toolkit that implementsour novel, unified cryptographic authentication protocol (UACAP),and a comprehensive range of specific auxiliary channels. We evaluatedOpenUAT based on a user study in which we compared four authenticationmethods implemented by the toolkit. The user study showed that userstend to prefer the visual channel in spite of its comparatively poorperformance.