| Identity authentication systems for computerized systems have been traditionally based upon three independent concepts which are best described as "What You Know" (passwords, PINs), "What You Have" (smart card, ID badge), and "What You Are", (biometric and natural behavior based systems). A fourth dimension to authentication is also possible: the deliberate perturbation of natural behavior in an authentication test. Conceptually, the use of active behavior could provide an inexpensive addition to existing authentication processes to make them more secure.; In this research, this fourth dimension of active behavior is developed theoretically and then tested experimentally to determine its practical applicability in a real world environment. Aspects that were examined include usability, acceptability, effectiveness, and administration requirements. A critical question was whether the use of active behavior could be used to advantage in effectiveness and acceptability, without incurring an excessive penalty on overall system usability.; The results of the research indicate that while active behavior can be used effectively as an authentication process, there are several disadvantages associated with its use. Active behavior overlays on conventional systems impart an additional level of isolation between valued information assets and compromise at the hands of would be attackers. Disadvantages include those associated with increased memory requirements on behalf of the user. Testing using the password-based active behavior test bed system revealed the existence of a practical entropy significantly lower than the authentication system entropy that would be calculated based upon mathematical probability alone. Future research could explore how the practical entropy and its limits might be extended closer to those of the theoretical entropy. |
