Two-Factor Authentication: Selecting and implementing a two-factor ...

[Pages:81]DEGREE PROJECT IN COMPUTER ENGINEERING, FIRST CYCLE AND DEGREE PROJECT IN INFORMATION AND COMMUNICATION TECHNOLOGY, FIRST CYCLE STOCKHOLM, SWEDEN 2017

Two-Factor Authentication

Selecting and implementing a twofactor authentication method for a digital assessment platform

NIKLAS TELLINI and FREDRIK VARGAS

KTH ROYAL INSTITUTE OF TECHNOLOGY

INFORMATION AND COMMUNICATION TECHNOLOGY

Two-Factor Authentication

Selecting and implementing a two-factor authentication method for a Digital Assessment Platform

Niklas Tellini and Fredrik Vargas

2017-05-31

Bachelor's Thesis

Examiner Gerald Q. Maguire Jr.

Academic adviser Anders V?stberg

KTH Royal Institute of Technology School of Information and Communication Technology (ICT) Department of Communication Systems SE-100 44 Stockholm, Sweden

Abstract | i

Abstract

Two-Factor Authentication (2FA) is a two-step verification process that aims to provide an additional layer of security by requiring the user to authenticate himself/herself using a secondary means (ownership factor or inheritance factor). Without the use of 2FA, an attacker could gain access to a person's devices or accounts solely by knowing the victim's password, while with 2FA knowing only this password is insufficient to pass the authentication check. In this project, we analyze different methods in which 2FA could be implemented by a Digital Assessment Platform. These platforms allow test assessments to be built directly into digital content; therefore, an important requirement of these systems is secure authentication. Moreover, it is important to securely protect teachers' account in order to avoid unauthorized people gaining access to those accounts. We investigate how 2FA could be used to add an extra layer of security to teachers' accounts, focusing on cost, user experience, ease of use, and deployment of the solution. We arrived at the conclusion that 2FA through an ownership factor is a suitable method and we implemented a solution based upon One-Time Passwords. This thesis project will hopefully benefit Digital Assessment Platforms who wish to implement 2FA by providing broader knowledge regarding this subject. The project should also benefit society by increasing the general knowledge of 2FA, hence leading to more secure services.

Keywords

Two-Factor Authentication, Security, One-Time Passwords, Access control, Digital Assessment Platform

Sammanfattning | iii

Sammanfattning

Tv?faktorsautentisering (2FA) ?r en tv?stegs verifieringsprocess som syftar att ge en extra niv? av s?kerhet, i och med att den kr?ver anv?ndaren att autentisera sig sj?lv genom en sekund?r faktor (n?got man ?ger eller har ?rvt). Utan anv?ndning av 2FA, kan en f?r?vare f? ?tkomst till en persons mobila enhet eller konto endast genom att kunna offrets l?senord. Att enbart kunna l?senordet ?r inte tillr?ckligt f?r att en autentiseringsprocess ska vara godk?nd om 2FA ?r implementerad. I det h?r projektet analyseras olika 2FA som skulle kunna implementeras av en digital utv?rderingsplattform. S?dana plattformar f?rvandlar tester och prov till digitalt inneh?ll och kr?ver d?rf?r en s?ker autentisering. Dessutom ?r det viktigt att s?kra l?rarnas konton f?r att undvika att icke auktoriserade personer loggar in p? deras konton. Vi unders?ker hur 2FA kan anv?ndas f?r att l?gga till en extra niv? av s?kerhet p? l?rarnas konton, med fokus p? kostnad, anv?ndarupplevelse, l?ttanv?ndlighet och utplacering av l?sningen. Vi kom fram till att 2FA via en faktor man ?ger ?r en passande metod och vi implementerade sedan en l?sning grundad p? eng?ngsl?senord. Detta projekt kan f?rhoppningsvis vara till f?rm?n f?r digitala utv?rderingsplattformar som vill implementera 2FA, genom att ge en bredare kunskap inom detta omr?de. Projektet skulle kunna gynna allm?nheten genom att bidra till ?kad generell kunskap om 2FA, och d?rav leda till s?krare tj?nster.

Nyckelord

Tv?-stegs autentisering, S?kerhet, Eng?ngsl?senord, ?tkomst kontroll, Digital bed?mningsplattform

Acknowledgments | v

Acknowledgments

We would like to thank examiner Gerald Q. Maguire Jr. and supervisor Anders V?stberg for their help. Also, we would like to thank Robin Andersson at DigiExam as well as the other employees for their support and help throughout this project.

Stockholm, May 2017 Niklas Tellini Fredrik Vargas

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download