Privacy-centered authentication: A new framework and analysis

The usage of authentication schemes is increasing in our daily life with the ubiquitous spreading Internet services. The verification of user's identity is still predominantly password-based, despite being susceptible to various attacks and openly disliked by users. Bonneau et al. presented a framework, based on Usability, Deployability, and Security criteria (UDS), to evaluate authentication schemes and find a replacement for passwords. Although the UDS framework is a mature and comprehensive evaluation framework and has been extended by other authors, it does not analyse privacy aspects in the usage of authentication schemes. In the present work, we extend the UDS framework with a privacy category to allow a more comprehensive evaluation, becoming the UDSP framework. We provide a thorough, rigorous assessment of sample authentication schemes, including the analysis of novel behavioural biometrics. Our work also discusses implementation aspects regarding the new privacy dimension and current gaps to be addressed in the future research.& COPY; 2023 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY-NC-ND license ( http://creativecommons.org/licenses/by-nc-nd/4.0/ )

Automated summary

The usage of authentication schemes in our daily life is increasing, but password-based verification is still the dominant method despite its vulnerability and user dislike. Bonneau et al. proposed the UDS framework to evaluate authentication schemes and find alternatives to passwords. However, the UDS framework lacks analysis of privacy aspects. In this study, we extend the UDS framework to include a privacy category, creating the UDSP framework, for a more comprehensive evaluation. We thoroughly assess sample authentication schemes, including novel behavioural biometrics, and discuss implementation aspects and future research gaps regarding the new privacy dimension.