A Two-Phase Authentication Protocol Using the Cell Phone as a Token

In a climate where personal information is ’freely available’, such as through the internet and via social networking sites, information based authentication systems have inherent weaknesses: Individuals are leaving a rich information footprint’ which is easily accessible to others, and so reducing the currency of private information for authentication purposes. Biometric approaches are expensive and lack user acceptance. Token based authentication offers practical alternatives to increase levels of security for remote access and online transactions. This paper extends an existing token mechanism for authentication using mobile/cell phones and presents a novel protocol to address some of the existing limitations and provide wider applicability. The paper hopes to contribute to theory by bringing an information richness perspective on authentication and, contribute to security practice by providing a route to increased security based on the ubiquitous mobile/cell phone and software tokens.