A Novel Protocol Using Captive Portals for FIDO2 Network Authentication-Reference-Cited by-同舟云学术

A Novel Protocol Using Captive Portals for FIDO2 Network Authentication

Published:2024-04-24 Issue:9 Volume:14 Page:3610
ISSN:2076-3417
Container-title:Applied Sciences
language:en
Short-container-title:Applied Sciences

Author:

Rivera-Dourado Martiño¹²^ORCID,Gestal Marcos¹²³^ORCID,Pazos Alejandro¹²³⁴^ORCID,Vázquez-Naya Jose¹²^ORCID

Affiliation:

1. Grupo RNASA-IMEDIR, Facultade de Informática, Universidade da Coruña, Campus de Elviña, 15071 A Coruña, Spain

2. Centro de Investigación CITIC, Universidade da Coruña, Campus de Elviña, 15071 A Coruña, Spain

3. IKERDATA S.L., ZITEK, University of Basque Country UPV/EHU, Rectorate Building, 48940 Leioa, Spain

4. Biomedical Research Institute of A Coruña (INIBIC), University Hospical Complex (CHUAC), 15006 A Coruña, Spain

Abstract

FIDO2 authentication is starting to be applied in numerous web authentication services, aiming to replace passwords and their known vulnerabilities. However, this new authentication method has not been integrated yet with network authentication systems. In this paper, we introduce FIDO2CAP: FIDO2 Captive-portal Authentication Protocol. Our proposal describes a novel protocol for captive-portal network authentication using FIDO2 Authenticators as security keys and passkeys. For validating our proposal, we have developed a prototype of FIDO2CAP authentication in a mock scenario. Using this prototype, we performed a usability experiment with 15 real users. This work makes the first systematic approach for adapting network authentication to the new authentication paradigm relying on FIDO2 authentication.

Funder

Xunta de Galicia

Publisher

MDPI AG

Link

https://www.mdpi.com/2076-3417/14/9/3610/pdf

Reference30 articles.

1. Thomas, K., Li, F., Zand, A., Barrett, J., Ranieri, J., Invernizzi, L., Markov, Y., Comanescu, O., Eranti, V., and Moscicki, A. (November, January 30). Data Breaches, Phishing, or Malware? Understanding the Risks of Stolen Credentials. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.

2. (2024, April 01). Fido Alliance—Open Authentication Standards More Secure Than Passwords. Available online: https://fidoalliance.org/.

3. (2024, April 01). Web Authentication: An API for Accessing Public Key Credentials Level 1. Available online: https://www.w3.org/TR/webauthn-1/.

4. (2024, April 01). Web Authentication API—Web APIs|MDN. Available online: https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API.

5. Rivera-Dourado, M., Gestal, M., Pazos, A., and Vázquez-Naya, J.M. (2021). An Analysis of the Current Implementations Based on the WebAuthn and FIDO Authentication Standards. Eng. Proc., 7.