Authenticating Users on Handheld Devices

Adequate user authentication is a persistent problem, particularly with handheld devices, which tend to be highly personal and at the fringes of an organization’s influence. Yet, these devices are being used increasingly in corporate settings where they pose a security risk, not only by the sensitive information they may contain, but also the means to access such information they may provide. User authentication is the first line of defense against unauthorized access to the contents of a lost or stolen device. Motivating users to employ common password mechanisms and periodically change their authentication information to meet corporate policy is always a challenge, and particularly so for handheld devices. This paper reviews mechanisms, which are compatible with the capabilities of handheld devices and designed to facilitate user authentication, as alternatives to using passwords.