Identifica ISP: Mutual Authentication between Multiple Entities for Technical Support Services Provided by ISPs

• Vagner E. Quincozes UNIPAMPA http://orcid.org/0000-0002-6688-5572
• Silvio E. Quincozes UFF https://orcid.org/0000-0001-6793-4033
• Diego Kreutz UNIPAMPA https://orcid.org/0000-0003-0830-0238
• Rodrigo B. Mansilha UNIPAMPA https://orcid.org/0000-0002-2083-653X

DOI: https://doi.org/10.5753/sbseg_estendido.2021.17336

Abstract

Internet Service Providers (ISPs) use fragile mechanisms for authentication and identification between entities involved in specialized technical support (i.e., customers, technicians, and managers). These mechanisms generate insecurity for users, as they tend to adopt non-authenticatable static data (e.g., CPF on physical or virtual cards) that can be easily stolen, cloned, or reproduced. In this work, we propose a system for authentication and identification of ISP customers, technicians, and managers, consisting of (i) an application for mobile devices supported by a back-end system and (ii) the implementation of security protocols that offer identification and authentication services. A demonstration of the application illustrates how to use the system. A conceptual evaluation of the security services, supported by the analysis of the protocols through the Scyther tool, supports the security provided by the system.

Keywords: Mutual Authentication, Identification Protocol, Authentication protocol, Internet Service Provider (ISP), Mobile Application

References

Cremers, C. and Mauw, S. (2006). A Family of Multi-Party Authentication Protocols. In First Benelux Workshop on Information and System Security (WISSec).

Cremers, C. J. (2008). The Scyther Tool: Verication, Falsication, and Analysis of Security Protocols. In International conference on computer aided verication, pages 414–418. Springer.

Daemen, J. and Rijmen, V. (2002). The design of Rijndael, volume 2. Springer.

Kreutz, D., Fernandes, R., Paz, G., Jenuario, T., Mansilha, R., Immich, R., and Miers, C. C. (2020). Auth4App: Protocols for Identication and Authentication using Mobile In SBC 20th International Brazilian Symposium on Information and Applications. Computational Systems Security (SBSeg), pages 1–14. SBC.

Quincozes, V. E., Temp, D., Quincozes, S. E., Kreutz, D., and Mansilha, R. B. (2020). Sistema para Autenticação entre Clientes, Técnicos e ISPs. In 5o Workshop Regional de Segurança da Informação e de Sistemas Computacionais, Joinville-SC, Brasil.

Torres, R., Quincozes, V. E., Mansilha, R. B., and Kreutz, D. (2020). Gateway de Acesso Controlado-GAC. Anais do Salão Internacional de Ensino, Pesquisa e Extensão, 12(2).