Development of Password-less authentication on the OpenID Connect Protocol

Abstract

Due to the increasing number of applications being developed simultaneously or by multiple service providers, users are required to remember digital IDs for each web application, resulting in the problem of forgetting usernames or passwords. Although the Single Sign-On protocol, such as OpenID Connect, allows users to access multiple applications with a single ID, users still need to remember passwords. Therefore, this research aims to design and develop an authentication system without using passwords on the OpenID Connect protocol to enhance security and convenience in accessing information systems. Additionally, the study aims to evaluate the system's usability, effectiveness, and its impact on accessing information systems. This research proposes a solution to the problem of password forgetfulness and enhances security in identity verification by using private keys and QR code-based data signing through a mobile application. The research achieves an AAL level 3 in enhancing the credibility of identity verification and improves convenience for users. Furthermore, this work extends the capabilities of the OpenID Connect protocol, which is a standard for accessing information systems.