TY  - CHAP
U1  - Konferenzveröffentlichung
A1  - Unsel, Vincent
A1  - Wiefling, Stephan
A1  - Gruschka, Nils
A1  - Lo Iacono, Luigi
T1  - Risk-Based Authentication for OpenStack: A Fully Functional Implementation and Guiding Example
T2  - 13th ACM Conference on Data and Application Security and Privacy (CODASPY '23) (April 2023), Charlotte, NC, USA
N2  - Online services have difficulties to replace passwords with more secure user authentication mechanisms, such as Two-Factor Authentication (2FA). This is partly due to the fact that users tend to reject such mechanisms in use cases outside of online banking. Relying on password authentication alone, however, is not an option in light of recent attack patterns such as credential stuffing.
Risk-Based Authentication (RBA) can serve as an interim solution to increase password-based account security until better methods are in place. Unfortunately, RBA is currently used by only a few major online services, even though it is recommended by various standards and has been shown to be effective in scientific studies. This paper contributes to the hypothesis that the low adoption of RBA in practice can be due to the complexity of implementing it. We provide an RBA implementation for the open source cloud management software OpenStack, which is the first fully functional open source RBA implementation based on the Freeman et al. algorithm, along with initial reference tests that can serve as a guiding example and blueprint for developers.
KW  - Risk-based Authentication
KW  - Implementation Challenges
KW  - OpenStack
UN  - https://nbn-resolving.org/urn:nbn:de:hbz:1044-opus-66425
SN  - 979-8-4007-0067-5
SB  - 979-8-4007-0067-5
U6  - https://doi.org/10.1145/3577923.3583634
DO  - https://doi.org/10.1145/3577923.3583634
SP  - 237
EP  - 243
PB  - Association for Computing Machinery
CY  - New York, NY, United States
ER  -