SESAME: Smartphone enabled secure access to multiple entities

In this paper we present a smartphone based architecture to secure user access to web services which require password entry. Our architecture takes advantage of biometric sensors that are present in today´s smartphones when authenticating a smartphone user in order to ensure that her identity cannot be masqueraded by anyone else. The user can then access web services using a complex password stored in her smartphone but without having to manually enter the complex password. As a result, the architecture overcomes many security limitations of today´s password based authentication approaches, and in particular, resolves the current dilemma associated with the use of complex passwords. In addition, the proposed architecture not only works seamlessly with today´s web services since it requires no changes to the existing authentication mechanisms used by the servers, but also can be extended to directly use a person´s biometrics as credentials instead of passwords when accessing web services and cyber-physical devices in the future.