Grant: Idea to Innovation

As the easiest and cheapest way of authenticating an end user, password-based authentication methods have been consistently employed by organizations and businesses as the default mechanism of restricting and monitoring access. The fact that employees need to remember multiple login credentials has incurred significant costs for an enterprise due to the increasing number of help desk calls for password reset, is exposing the business to more opportunities for security breaches.Motivated by the urgent need for a secure, cost-effective and user-friendly enterprise authentication solution, the proposed project is to aim for developing a prototype implementation of a password-less authentication system called LOXIN and its threat and risk assessment, which can replace existing password-based authentication systems altogether or can be flexibly deployed to either serve as a two-factor authenticator to enhance security in an enterprise environment. The LOXIN system takes advantage of public-key cryptography and mobile channels by mobile push message services, and authenticates an employee to multiple enterprise services by using pre-owned identities together with few taps on the employee's mobile device. Moreover, one salient feature of LOXIN is that it eliminates the potential risk of leaking users' credentials in the case of enterprise application servers or databases being compromised. The LOXIN system will help relieve the pain for the current enterprise password management practice. The success of the proposed project will strengthen the security of Canada's fundamental cyber systems and aligns well with Canada's Cyber Security Strategy. The successful transfer of the proposed technology to the marketplace will bring a range of economic benefits to Canada. In particular, the availability of the user-friendly and highly secure authentication system will provide strong protection for cloud services in multiple industry sectors in Canada and ensure Canada's position in the forefront of cloud security technologies.