Hi, I'm Argyris Constantinides and I'm a PhD student in the Department
of Computer Science at the University of Cyprus.
In this talk, I'm interested in the design and development
of a Patient-centric user authentication system.
This work is partially supported by the EU Horizon 2020 SERUMS project,
which is a project about Securing Medical Data in Smart
Patient-centric Healthcare Systems.
Advancements in computer and communication technology
enabled the rapid growth of electronic health systems,
which nowadays provide various electronic methods,
such as obtaining online consent or exchanging medical data.
In this context, user authentication is an essential security task
within modern healthcare systems, which is performed
daily by millions of patients and medical staff across the globe.
Based on a literature review on the healthcare domain,
we can conclude that the majority of current healthcare organizations
apply traditional text-based user authentication solutions.
However, studies indicate that the text-based user authentication
within the healthcare domain is not adequate due to known security and
usability issues. Furthermore, a high number of research
projects and works propose new alternative user
authentication solutions that embrace multiple factors for
authentication.
One of the objectives of the SERUMS project is to deliver a viable,
personalized, and flexible user authentication solution,
that is based on state-of-the-art practices in the healthcare domain,
and in parallel applicable within the consortiums' end-user organizations.
The SERUMS' user authentication system, coined FlexPass,
is based on a flexible, personalized, and multi-factor user
authentication paradigm, that combines knowledge-based user
authentication, along with token-based user
authentication utilizing push notifications on
smartphones and smartwatches.
Our approach attempts to provide a new user authentication paradigm
that leverages upon theories from Cognitive Psychology,
such as episodic and semantic memory, and dual coding, which suggest that
humans' episodic and semantic memories represented as verbal and visual
information can be transformed into memorable and personal authentication secrets.
Such secrets can be semantically similarly reflected
on both textual and graphical password keys
and accordingly used complementary based on user preference and individual characteristics.
Hence, the paradigm relies on a single, user-selected secret
that can be reflected as a textual key and as a graphical key.
However, such an approach introduces a new kind of observational attack,
since adversaries know the format of the password and they can see the set of
pictures.
Accordingly, to add an additional layer of security to the proposed approach,
we use a second factor for authentication through push
notifications before allowing access to the system.
In particular, users will be required to approve a push notification
that will be realized as an SMS notification
including a one-time passcode and as a mobile application notification.
With regards to the architectural design of the user authentication component,
the application programming interface is implemented as a Django application
in Python 3, using the Django REST framework
which is an open source library
intended for building web APIs.
Furthermore, to support fast request- response cycles
and deal with time-consuming tasks, we use
Celery, which is an asynchronous task queue
based on distributed message passing.
We also use RabbitMQ as the external message broker solution required by Celery.
To store users' data, we use PostgreSQL, which is an open source Relational
Database Management System, commonly used within Django applications.
Moreover, we use credential hardening to prevent offline attacks
through the use of hash-based message authentication codes,
which employ the Transport Layer Security private key of the Web server.
For the deployment of the Django application, we use the Apache HTTP server.
And finally, the integrated user
authentication component is built and deployed using Docker.
With regards to the design and development of the user authentication
system, we follow a User-Centered design
methodology, aiming to assure that the solution meets
the users' needs and expectations in terms of security and usability.
So far, we have designed and developed the first proof-of-concept user
authentication system, aiming to get feedback about patients'
preference and opinions regarding the suggested user authentication flexible
paradigm.
To do so, we conducted two controlled lab studies with
healthcare organizations in which we invited individuals to interact with the
user authentication component we implemented.
We recruited 55 participants from two large-scale healthcare organizations
and the study involved the following steps.
First, participants were briefed about the idea of FlexPass.
Then, they interacted with all the components of
the FlexPass proof-of-concept, such as password creation, login,
push notification and reset password process.
Finally, participants responded to a questionnaire.
The questionnaire was designed to elicit users' preferences,
their opinion about the proof-of-concept, as well as included questions about
perceived usability, memorability, security and trust.
Preliminary findings with regards to the proof-of-concept
are encouraging for further investigating the suggested flexible
and personalized user authentication approach.
In particular, we found that 42 out of 55 users perceived the FlexPass system
as secure, 35 out of 55 users perceived the FlexPass system as
easy to use, and 14 out of 55 as moderate to use.
Regarding memorability, 44 out of 55 users responded that they could
effectively recall the password they created in the
FlexPass system. Also, 20 out of 31 users
trust the technology and its ability to keep their data private
and secure. Finally, 25 out of 31 users would be willing to
adopt FlexPass as an alternative user authentication system.
That's pretty much it. Thank you for your attention.