A deployment-aware multi-node FIDO2/WebAuthn authentication architecture for maritime information systems

This study investigates the feasibility of FIDO2/WebAuthn-based passwordless authentication for maritime information systems operating under constrained communication conditions, including high latency, limited bandwidth, and intermittent connectivity. Under such conditions, conventional password-based authentication and password plus email-delivered one-time password (OTP) authentication may suffer from reduced reliability, delayed verification, and operational disruption. To address these challenges, this study proposes a deployment-aware multi-node FIDO2/WebAuthn authentication architecture consisting of primary onboard relying party (RP) nodes, backup onboard RP nodes, and a shore-side central management node. The proposed architecture supports distributed authentication workflows, including registration, login, cross-node verification, credential synchronization, and RP policy management, and is designed to support operational stability under constrained network conditions. The system is implemented using the WebAuthn API and device-bound cryptographic credentials. In the proposed design, private keys remain securely stored on the user device, and authentication is completed through a challenge–response mechanism to reduce the risks of credential leakage, replay attacks, and phishing attacks. To evaluate its practical feasibility, experiments are conducted under controlled experimental conditions with simulated maritime communication constraints, including network latency, packet loss, and node availability variations. Authentication latency, success rate, and process stability are used as the main evaluation metrics. The experimental results suggest that the proposed FIDO2/WebAuthn-based architecture can maintain acceptable user-facing latency and consistent authentication behavior under the tested simulated conditions. Compared with password plus email-delivered OTP authentication, the proposed approach shows lower latency variation and reduced dependence on email delivery, manual user input, and time-sensitive verification codes. However, this comparison should be interpreted specifically in relation to the email-delivered OTP workflow evaluated in this study, rather than as a general conclusion about all OTP mechanisms, such as app-based time-based one-time password (TOTP) mechanisms or hardware OTP tokens. Overall, the findings indicate that FIDO2/WebAuthn has practical potential for secure and reliable identity verification in maritime information systems, while further validation in real ship–shore communication environments is still required.