Chris Finn
Security has always been a delicate balance between difficulty of bypassing and convenience. Think of all the various authentication "tokens" you use throughout the day. House keys, car keys, & numerous passwords to your gadgets & websites. These all provide little in the means of security while also tending to be inconvenient and cumbersome to use/remember. The AuthBand is a wearable open source/hardware token which aims to solve the aforementioned daily authentication problem.
Important features & differentiators from existing products
- Does not require a smartphone
- everything you need for authentication is contained within the KeyRing
- Simple & secure asymmetric authentication
- Possible future applications to mobile payments
- Originally was going to use a Java Smartcard IC so that it would be possible to run apps like Visa PayWave but found them very closed off & hard to get.
- Originally was going to use a Java Smartcard IC so that it would be possible to run apps like Visa PayWave but found them very closed off & hard to get.
System Overview
Communication
A Bluetooth Low Energy module provides low power communication with the authentication systems.
Security
A crypto module is a tamper resistant module that securely & efficiently carries out cryptographic operations. They also usually have secure memory for storing sensitive data such as keys. In this project, a crypto module will be used to generate a public/private key pair & when challenged by an authentication system, use the stored private key to generate the valid response.
User Input
Accelerometers & gryoscopes are used to capture user inputs such as tap gestures or hand waves. These gestures are used to determine if a user wants to do an action (i.e. unlock the door).
Future
I haven't really touched upon the usage case details much in the write up because it is a whole additional project/movement in itself but it is crucial in my opinion. It is important to not only move to a public key cryptography solution but also to take he security critical authentication processes out of the hands of manufacturers, web designers, etc., & move them to one main authentication entity (depicted as Public Key Server in the video below). This serves two purposes: solves the public key infrastructure issue & it remedies the all too often problem of companies implementing security systems incorrectly. Anyway that is my rant for now, more on that later...
Shranav Palakurthi
dhg
matt oppenheim
Vojtech Pavlovsky