Combined Web/mobile authentication for secure Web access control

Previous Web access authentication systems have used either the Web or the mobile channel individually to confirm the claimed identity of the remote user. Both approaches proved to be insecure when used in isolation. An investigation is presented into the enhanced security of a new combined Web/mobile authentication system. The hybrid system enables a strong authentication by augmenting the traditional Web-based username/password approach with a mobile-based challenge/response authentication. Experiments show that the combined system is relatively immune to eavesdropping attacks and provides a trade-off between security and usability of the remote authentication system. The system is promising for current as well as for future 3G mobile and pervasive computing environments [A. Al-Qayedi et al., 2003].