标题： 通过移动设备上的确认进行用户到PC的身份验证：可用性和性能分析 显示英文标题

标题： User-to-PC Authentication Through Confirmation on Mobile Devices: On Usability and Performance

摘要： 保护个人计算机（PC）免受未经授权的访问通常依赖于密码认证，这已知会带来认知负担和弱凭证的问题。 由于许多用户现在在日常生活中随身携带具有高级安全功能的移动设备，因此有机会利用这些设备来改进对PC的认证。 在本文中，我们采用了一种基于令牌的无密码方法，用户通过在其智能手机或智能手表上确认认证请求来对他们的PC进行认证。 当请求登录到PC或评估权限时，PC会发出一个认证请求，用户会在其移动设备上收到该请求，用户可以确认或拒绝该请求。 我们评估了按钮点击和生物特征指纹验证作为确认方式，并在一项有30名参与者、总共1200次认证尝试的用户研究中，将它们的认证时间、成功率和易用性与传统的基于密码的认证进行了比较。 基于智能手表的认证在认证时间上优于基于密码的认证和基于智能手机的变体，同时显示出相当的成功率。 参与者在易用性方面对基于智能手表的认证评价最高，其次是基于密码的认证和基于智能手机的认证。 显示英文摘要

摘要： Protecting personal computers (PCs) from unauthorized access typically relies on password authentication, which is know to suffer from cognitive burden and weak credentials. As many users nowadays carry mobile devices with advanced security features throughout their day, there is an opportunity to leverage these devices to improve authentication to PCs. In this paper we utilize a token-based passwordless approach where users authenticate to their PC by confirming the authentication request on their smartphones or smartwatches. Upon a request to login to the PC, or to evaluate privileges, the PC issues an authentication request that users receive on their mobile devices, where users can confirm or deny the request. We evaluate button tap and biometric fingerprint verification as confirmation variants, and compare their authentication duration, success rate, and usability to traditional password-based authentication in a user study with 30 participants and a total of 1,200 authentication attempts. Smartwatch-based authentication outperformed password-based authentication and smartphone-based variants in authentication duration, while showing comparable success rates. Participants rated smartwatch-based authentication highest in usability, followed by password-based authentication and smartphone-based authentication.