Risk – Based Authentication Enhancement of University Digital Portal Security

Abstract

With the rapid advancement of digital systems, academic institutions increasingly utilized centralized digital platforms to support academic services and communication. The University of Eastern Pangasinan currently utilizes a digital portal that has a traditional password-based authentication system, which depends on username and password. This study analyzed user perceptions to the existing authentication method of the digital portal, focusing on three key indicators: (1) accessibility, (2) usability, and (3) security effectiveness. Using a descriptive - developmental research design, data were collected through online surveys and focus group discussion with the administrative staff and students. The findings revealed that while the portal performs well in accessibility and usability, its security effectiveness scored lower, indicating limited user confidence in password – based authentication. Based on data gathered, a prototype for risk – based authentication system was developed. This adaptive system evaluates risk through factors such as device and location trust, IP reputation, login patterns, failed attempts, user behavior, and adjusts verification requirements accordingly. Low risk access uses a single – factor authentication, medium risk triggers one – time code verification via email, and high risk requires one – time pin (OTP) verification and hardware token. By conducting a post – test with the developed prototype, a side-by-side comparison of the weighted means between the existing password - base and the developed risk-based authentication system, the developed system indicates a higher level of satisfaction in terms of accessibility, usability, and security features. The study concludes that the developed prototype for risk – based authentication system significantly shows the security effectiveness of the system without compromising user experience, offering a practical solution for academic institutions.