S3AS: uma solução de autenticação e autorização através de aplicativos de smartphones

Abstract

The increasing adoption of mobile applications as a means of user authentication is revealing new security challenges and opportunities. In order to modernize their physical authentication and authorization procedures (e.g., access turnstile), some institutions have been adopted static QR Codes generated using simple and static user data, as the Individual Taxpayer Registration (CPF, in Brazil). This procedure is easy to implement and verify, but it represents a critical security vulnerability. Aiming to mitigate this vulnerability, this paper proposes an Authentication and Authorization Solution based on Smartphone Applications, named S3AS. The proposed solution consists of two main protocols, one for binding user credentials to the mobile device (i.e., identification) and another one for generating one-time authentication codes (OTACs). Both protocols have been formally verified using the automatic verification tool named Scyther. Based on the automated analysis done with the Scyther tool, the results show that the S3AS protocols are robust and safe. A prototype to simulate access control using electronic turnstiles was also developed to demonstrate how the solution works and its deployment viability. The numbers of experimental runs indicate that the cost of using and generating OTACs is quite low. An OTAC can be generated and verified in less than 1 millisecond using the Python programming language.