mAuth: An Authentication Token Using a Mobile Phone

Abstract

Authentication is one of main requirement in the information security which can be achieved by using something user knows or something user has or something user is. Common way to handle the authentication is the password which belongs to some to some thing user knows. Since password based authentication is vulnerable to many kind of attacks new methods have been introduced like bio matrices, authentication tokens etc... Authentication token is an either a hardware device or a software which use to authenticite of a user. One factor for authentication may not enough for places where information security is critical. Two factor authentication is introduced to fill that gap. With the introduction of two factor authentication popularity of authentication tokens get increased. Authentication token contains an implementation of an authentication protocol like one time password or challenge response. Since the most authentication tokens are based on dedicated devices like USB device, smart card with limited resources they are only capable of implementing a simple authentication protocols like one time password. Another problem of authentication token is the cost. If an authentication token can be implemented on a common device like a mobile it will help to increase the popularity of authentication tokens. Mobile phones have more advantage than dedicated devices like availability, input/output, connectivity and processing power and memory. Using those feature as an advantage we implement an authentication token on mobile phone which implements a challenge -response authentication protocol based on RSA cryptography. The advantage not only the cost of token but also the amount of authenticity the token can provides.