Uma prova de conceito em identidade organizacional móvel

Abstract

Among the most common forms of organizational identification, the use of passwords, ids and specialized access devices stand out. Although quite widespread, they present some inefficiencies discussed is this paper. Simultaneously, modern security systems reach for a new authentication model known as two-factor authentication. Nevertheless, even recent organizational solutions for two-factor authentication often require specialized hardware. This work offers a solution for organizational identification with two-factor authentication without specialized hardware, through an almost ubiquitous tool: smartphones. Smartphones are already considered multi-purpose devices because of their resourcefulness and portability. However, the ease of manipulation of such devices concerns organizations, keeping them potentially underused. A second challenge for smartphones relates to their moderate computational power when compared to the requirements of modern asymmetric cryptography. This challenge becomes even more evident with the high demands of performance from users. The architecture implemented in this paper addresses these challenges and few others. While related works use symmetric cryptography, other communication channels, require special hardware platforms, enforce strong deployment requirements, or simply target other scenarios, the solution presented here stands out by using the latest technology to operate a simple and complete public key infrastructure, specifically designed for the organizational environment and for mobility. The system is implemented following the recommendations of the National Institute of Standards and Technology and the Internet Engineering Task Force, without thereby giving up the simplicity of use. Its main goal is to implement mobile organizational identification with two-factor authentication through smartphones. The architecture is designed to support two deployment modes, two modes of operation of off-line time windows, adapting to organizational needs in a transparent manner. The solution aims to be further extended by other applications, striving to bring two-factor authentication to many organizational sectors. The methodological process was composed of macrocycles and microcycles of development. Each macrocycle includes requirement analysis, prototyping, modeling, validation, planning, implementation and feedback activities. Using mobile parallel processing techniques, asymmetric encryption, visual communication with QR codes and the latest advancements of the Android platform, the architecture was successfully implemented into a working prototype. A comparison between the architecture implementations using RSA and Elliptic Curves is performed, with elliptic encryption getting better performance even with higher security levels. Regardless of the asymmetric algorithm used, the architecture is resistant to attacks such as man in the middle and replay, carrying strategies for dealing with the case in which devices are compromised.