Authentication Module Research Articles

CASTRA: Seamless and Unobtrusive Authentication of Users to Diverse Mobile Services

This paper presents context-aware security technology for responsive and adaptive protection (CASTRA), an “always-on” context-aware authentication and access control framework that seamlessly and unobtrusively authenticate users to mobile applications of varying sensitivity levels. CASTRA uses a continuous and multifaceted behavioral biometrics authentication that passively authenticates the user in the background while the device is being in contact with the user, and a context-aware risk assessment and access control that provides access to applications based on the perceived threat level around the device. The behavioral authentication module is constructed by exploiting a combination of supervised and unsupervised learning techniques on raw sensor and GPS data passively gathered from the mobile device. Multiple inferences about the user (or user behavioral traits ) such as frequently visited locations, location transition patterns, physical proximity of user with the device (e.g., device in the pocket or placed on the table), and walking patterns are automatically inferred and extracted. Analytical studies were conducted to derive optimal thresholds to fuse these multiple traits and an adaptive trust score is generated every user-defined time period to determine the degree to which the user is trustworthy to access the applications. CASTRA is implemented in a client-server mode, utilizing the Android and the Amazon Cloud computing platform. The novelty of CASTRA stems from the design and fusion of multiple behavioral biometric-based authentication factors and the development and deployment of a practical end-to-end architecture that enables real-time data acquisition, automatic training and learning of user behavioral patterns, and context-aware risk assessment and access control. The performance of CASTRA was evaluated under natural settings, on 15 subjects, using different variants of the Samsung devices. Multiple realistic attack scenarios (e.g., stolen, lost, and shared devices) targeting mobile devices were designed to prove the security and user-friendliness of the proposed scheme. We also present techniques to reduce energy and bandwidth consumption and ways to unobtrusively acquire data for supervised learning algorithms without requiring explicit user annotation.

WLAN Mesh Security Access Method Based on Blockchain Technology

As a brand-new network structure, WLAN Mesh network is a distributed network with large capacity, fast speed and wide coverage. However, the security problems caused by the characteristics of wireless connection are not negligible. This paper proposes a new blockchain-based WLAN Mesh design method, including user encryption module, blockchain authentication module and kernel space module. Using the blockchain technology, each user's access authentication request is treated as a transaction, and all authentication records in the mesh network are treated as public ledgers. This method based on blockchain enables secure access to the network and prevents malicious attacks.

A private user data protection mechanism in trustzone architecture based on identity authentication

In TrustZone architecture, the Trusted Application (TA) in the secure world does not certify the identity of Client Applications (CA) in the normal world that request data access, which represents a user data leakage risk. This paper proposes a private user data protection mechanism in TrustZone to avoid such risks. We add corresponding modules to both the secure world and the normal world and authenticate the identity of CA to prevent illegal access to private user data. Then we analyze the system security, and perform validity and performance tests. The results show that this method can perform effective identity recognition and control of CA to protect the security of private user data. After adding authentication modules, the data operation time of system increases by about 0.16 s, an acceptable price to pay for the improved security.

INTEGRATION OF INFORMATION AND EDUCATIONAL SYSTEMS IN THE UNIVERSAL EDUCATION UNIVERSITY ELECTRONIC ENVIRONMENT

The article is devoted to the integration of educational resources and educational and informational systems in a single information and educational environment of the university. Access to the university's information and educational environment is carried out through the additional web-site of the official portal “Information and educational environment” for authorization, which uses technology of the single sign-on point, the main element of which is the creation of a user database. Taking into account the features of the analyzed directory services and the use of the domain structure of the network organization, we have selected to create the Lightweight Directory Access Protocol (LDAP) database using the OpenLDAP open protocol. Were described the implementation of the settings for a single sign-on page using the protocol for the web CAS (Central Authentication Service). To synchronize the University's corporate email and available Google services with the LDAP database, Google Apps developed a Google Apps Directory Sync application that synchronizes the structure and all users in Google Apps. In order to synchronize the e-learning system based on the LMS Moodle, an existing appropriate module was used to authenticate users through the LDAP database. Configuring the module, synchronizing users and groups is presented in the article. Also are listed the settings specified in the LocalSettings.php file that are related to LDAP authentication with the university's wiki portal via the installed and connected LDAP authentication module. Also we described an approach to synchronizing users with the systems of scientific conferences and seminars based on the open conference system engine, which includes a module for LDAP authentication. DOI: https://doi.org/10.28925/2414-0325.2017.3.6ez16

Score based Decision System for Imposter Identification using Non-Biometric Authentication Factors

Objectives: An imposter identification system allows authenticated user to request for regeneration of password while restricting users who possess imposter properties. Existing system in the literature either allows the users to request for regeneration of password or denies access to the users. So the imposter acceptance and genuine rejection percentage is high in the existing system. Methods: The proposed system improves the performance of imposter identification system by adding three levels of non biometric factors to it. Fuzzy score is calculated on each level and the scores are accumulated with its own weight at last level. Using weighted score the threshold is compared and evaluated to make further decisions. Based on the evaluations made with respect to the threshold, the user will be allowed or denied to regenerate the password. Neural Network is applied to find out the threshold value whereas initially the threshold value is randomly assigned. The neural system works on two modes; one is learning mode in which the developer has to validate the system using training and testing dataset. Findings: With the validation, the threshold value is set to the most accurate value. Secondly, the system works on production mode where the end user uses the system. The proposed system increases the performance of imposter identification algorithm by increasing the rate of genuine user acceptance and imposter rejection. Applications: For all, ID-Password based authentication applications which supports Forget password as a sub module for the authentication module.

A Strongly Trusted Integrity Preservance based Security Framework for Critical Information Storage over Cloud Platform

During last few years, the demand of cloud computing has immensely arisen among the Corporate/Business organizations. The cloud computing concept brings exclusive monetary benefits to the corporate houses through its pay-as per use facility. The incurred cost only lies in the consumption of hardware and software resources for any particular available business applications[1].For any particular project, all the web applications are deployed on available physical servers ,dispersed throughout the countries ,connected through cloud service providers. This mega scale growth in the adoption of cloud platform leads to extreme revenue benefits to the involved parties. But at the same time, information security also requires to be well enveloped in the cloud environment [2].In this research work, we have incorporated various cryptographic algorithms to improve the authentication module such as Challenge response Authentication protocol and file data storage using suitable and efficient Digital Signature Standard scheme along with effective encryption schemes such as AES as well. The proposed framework represents proper client –server authentication and secured & trusted architecture for stored information on cloud server. We have done research work to alleviate the security of stored information with in the cloud and also to protect it from any outside attack during information exchange between client and server. General Terms Information Security, Cloud Platform, File Integrity.

모바일 결제의 신뢰성 향상 방안

핀테크의 활성화로 모바일 결제를 위한 다양한 기반 서비스들이 개발되고 있다. 각종 결제 방식이 개발되고, 결제의 신뢰성을 향상시키기 위한 인증 방식이 개발되고 있다. 그러나, 모바일 간편 결제 서비스 시, 전화번호에 의해 인증이 이루어지므로 누출 가능성이 있어 보안이 취약하다. 따라서, 본 논문에서는 전화번호 기반의 인증과정을 개선하기 위해 모바일 디바이스의 고유한 식별자인 디바이스 ID를 활용하여 인증 과정의 신뢰성을 높이기 위한 방안을 제안한다. 핵심 연구 내용은 모바일 디바이스 ID를 기반으로 모바일 결제 인증을 위한 아키텍쳐와 인증 프로세스이다. 모바일 결제 아키텍쳐는 모바일 디바이스, 인증 서비스, 그리고 모바일 결제 어플리케이션으로 구성된다. 모바일 디바이스는 모바일 디바이스 ID와 전화번호로 구성하며, 인증 서버는 인증 모듈과 암호화 모듈로 구성된다. 모바일 결제 서비스는 사전 인증 모듈과 복호화 모듈로 구성된다. 모바일 결제 서비스의 프로세스는 모바일 디바이스, 인증 서버, 그리고 모바일 결제 어플리케이션 간에 암호화된 인증 정보(디바이스 ID, 전화번호, 인증 번호)에 의해 처리된다. 모바일 디바이스는 전화번호와 디바이스 ID를 인증 서버로 전달하며, 인증 서버는 인증 과정과 암호화 과정을 통해 사용자를 인증한다. 모바일 결제 어플리케이션은 전달받은 인증 번호에 대해 복호화를 통해 사전 인증 과정을 수행한다. 본 논문의 인증 서버의 인증 과정과 모바일 결제 서비스의 사전 인증 과정을 통해 기존 결제 서비스의 인증 번호 누출에 의한 위험을 예방할 수 있는 차별성을 제공할 것이다. A variety of services for mobile payments by the activation of FinTech have been developed. Various payment methods were developed, and an authentication method was developed to improve the reliability of the payment. On the other hand, when mobile easy payment services are used, they have weak security because the authentication by phone number. Therefore, this paper proposes a technique for increasing the reliability of the authentication process using the unique device ID of the mobile device to improve the authentication process based on the telephone number. The core research contents are the architecture and process for the authentication of mobile payments based on the mobile device ID. The mobile payment architecture consists of a mobile device, authentication service, and mobile payment application. The mobile device consists of mobile device ID and phone number, and the authentication server consists of authentication module and encryption module. The mobile payment service consists of a pre-authentication module and decryption module. The process of mobile payment service is processed by the encrypted authentication information (device ID, phone number, and authentication number) among mobile devices, authentication server, and mobile payment application. The mobile device sends the telephone number and the device ID to the authentication server and the authentication server authenticates the user through an authentication process and encryption process. The mobile payment application performs the pre-authentication process by decrypting the received authentication number. This paper reports a difference that can prevent the risk of leakage of the authentication number in existing payment services through the authentication process of the authentication server and the pre-authentication process of the mobile payment service of this paper.

Secret Sharing Approach in Multi-database System

Secret sharing schemes are ideal for storing highly sensitive data. A secret is divided into many parts and every participant gets his unique part. If we combine all of these parts and try regenerating the secret then it might be impractical, and therefore the threshold scheme is used. Shamir’s secret sharing scheme supports the same. Here, some of the parts or all of them are required to reconstruct the secret. Any threshold number of parts are sufficient to reconstruct the original secret. The Admin has a set of files which are confidentiality and availability of data. Whenever a Client requests to access the files, the Admin performs authentication of the user through an encrypted and stored on multiple databases so as to achieve Authentication module, who makes use if Shamir's secret sharing concept. This is similar to the One Time Password (OTP) mechanism. If the Client is authentic, Admin grants him the decryption key and the Client can access the file. In this paper, we shall discuss all this in detail using which we can provide security, replication of data and authentication.Â

An improved security framework for Web service-based resources

Web service-based application has become one of the dominative ones of the Internet. This trend brings more and more security challenges in reliability, condentiality, and data nonrepudiation, especially in some systems that have massive diversied resources. An improved framework for secure accesses of Web resources is presented and implemented by extending and enhancing the Spring Security framework. It improves the security level of systems for identity authentication, authorized access, and secure transmission. The highly safe authentication is based on the integration of an improved authentication module of Spring Security with a U-key method and a RSA algorithm. For authorized access, the Spring Security's ACL (access control list) mechanism is improved by optimizing the domain object-level access control. For secure transmission, a compromising method is presented to take both the security level and the speed of data transmission into account by means of mixing the RSA and DES algorithms. In addition, the security interceptor of Spring Security is extended and a series of securitylters are added to keep Web attacks away. The above improved security framework has been applied to an online virtual experiment platform named VeePalms. The experimental results show that most security problems with high severity in the system have been solved and medium-low severe problems decreased dramatically. Moreover, VeePalms has been used in practice for about 2 years, which has proved the effectiveness of the security framework.

Implementation and Evaluation of a Secure and Efficient Web Authentication Scheme using Mozilla Firefox and WAMP

User authentication and session management are two of the most critical aspects of computer security and privacy on the web. However, despite their importance, in practice, authentication and session management are implemented through the use of vulnerable techniques. To solve this complex problem, we proposed new authentication architecture, called StrongAuth. Later, we presented an improved version of StrongAuth that includes a secure session management mechanism based on public key cryptography and other cryptographic primitives. In this paper, we present an experimental implementation and evaluation of the proposed scheme to demonstrate its feasibility in real-world scenarios. Specifically, we realize a prototype consisting of two modules: (1) a registration module that implements the registration, and (2) an authentication module integrating both the mutual authentication and the session management phases of the proposed scheme. The experimental results show that in comparison to traditional authentication and session management mechanisms, the proposed prototype presents the lowest total runtime.

스마트폰과 근거리 무선 통신을 이용한 성인 인증 시스템의 개발

본 논문에서는 스마트폰과 NFC 통신을 이용한 공인 인증서 기반의 성인 인증 시스템을 설계 및 개발하였다. 제안하는 성인 인증 시스템은 스마트폰과 NFC 통신을 기반으로 하여 쉽고 간편하고 빠르게 인증할 수 있으며, 공인인증서 기술을 기반으로 하여 보안성 및 신뢰성이 매우 높고, 가상 신원 확인 코드만 생성하고 전송하여 개인 정보유출의 위험이 매우 낮으며, 전자서명법에 기반하여 적절한 법적 근거를 가지고 있다. 제안하는 성인 인증 시스템은 성인 인증 모듈, NFC 제어 모듈, 정책 서버 모듈, DB 서버 모듈로 구성되며, 프로토타입을 설계하고 구현하여 정상적으로 동작하는 것을 확인하였다. In this paper, an adult authentication system based on authentication certificate was designed and implemented using smartphone and near-field communication. It has three advantages. First, it achieves easy, convenient, and fast authentication by using smartphone and near-field communication. Second, it achieves extremely high security and reliability by exploiting authentication certificate. Third, it achieves extremely low risk of personal information leakage by generating and sending only virtual identification code. Finally, it has a proper legal basis by Digital Signature Act. It consists of adult authentication module, near-field communication control module, policy server module, and database server module. A prototype of the proposed system was designed and implemented, and it was verified to have correct operation.

DCache, Sync-and-Share for Big Data

The availability of cheap, easy-to-use sync-and-share cloud services has split the scientific storage world into the traditional big data management systems and the very attractive sync-and-share services. With the former, the location of data is well understood while the latter is mostly operated in the Cloud, resulting in a rather complex legal situation.Beside legal issues, those two worlds have little overlap in user authentication and access protocols. While traditional storage technologies, popular in HEP, are based on X.509, cloud services and sync-and-share software technologies are generally based on username/password authentication or mechanisms like SAML or Open ID Connect. Similarly, data access models offered by both are somewhat different, with sync-and-share services often using proprietary protocols.As both approaches are very attractive, dCache.org developed a hybrid system, providing the best of both worlds. To avoid reinventing the wheel, dCache.org decided to embed another Open Source project: OwnCloud. This offers the required modern access capabilities but does not support the managed data functionality needed for large capacity data storage.With this hybrid system, scientists can share files and synchronize their data with laptops or mobile devices as easy as with any other cloud storage service. On top of this, the same data can be accessed via established mechanisms, like GridFTP to serve the Globus Transfer Service or the WLCG FTS3 tool, or the data can be made available to worker nodes or HPC applications via a mounted filesystem. As dCache provides a flexible authentication module, the same user can access its storage via different authentication mechanisms; e.g., X.509 and SAML. Additionally, users can specify the desired quality of service or trigger media transitions as necessary, thus tuning data access latency to the planned access profile. Such features are a natural consequence of using dCache.We will describe the design of the hybrid dCache/OwnCloud system, report on several months of operations experience running it at DESY, and elucidate the future road-map.

Handover authentication for mobile networks: security and efficiency aspects

A handover authentication module in mobile networks enables mobile nodes to securely and seamlessly roam over multiple access points. However, designing an appropriate handover authentication protocol is a difficult task because wireless networks are susceptible to attacks, and mobile nodes have limited power and processing capability. In this article, we identify the security and efficiency requirements of a good handover authentication protocol and analyze the existing related protocols, and show that many such protocols are either insecure or inefficient. Then we review a recently proposed protocol named PairHand, which has been shown to outperform all other protocols on security and efficiency. Furthermore, we propose a novel protocol named HashHand that not only inherits the merits of Pair- Hand and efficiently eliminates its security vulnerabilities, but also provides a session key update mechanism. Experiments using our implementation on resource-limited laptop PCs show that HashHand is feasible for practical mobile networks.

Experimentation Using Short-Term Spectral Features for Secure Mobile Internet Voting Authentication

We propose a secure mobile Internet voting architecture based on the Sensus reference architecture and report the experiments carried out using short-term spectral features for realizing the voice biometric based authentication module of the architecture being proposed. The short-term spectral features investigated are Mel-Frequency Cepstral Coefficients (MFCCs), Mel-Frequency Discrete Wavelet Coefficients (MFDWC), Linear Predictive Cepstral Coefficients (LPCC), and Spectral Histogram of Oriented Gradients (SHOGs). The MFCC, MFDWC, and LPCC usually have higher dimensions that oftentimes lead to high computational complexity of the pattern matching algorithms in automatic speaker recognition systems. In this study, higher dimensions of each of the short-term features were reduced to an 81-element feature vector per Speaker using Histogram of Oriented Gradients (HOG) algorithm while neural network ensemble was utilized as the pattern matching algorithm. Out of the four short-term spectral features investigated, the LPCC-HOG gave the best statistical results withRstatistic of 0.9127 and mean square error of 0.0407. These compact LPCC-HOG features are highly promising for implementing the authentication module of the secure mobile Internet voting architecture we are proposing in this paper.

Protection Method for Data Communication between ADS-B Sensor and Next-Generation Air Traffic Control Systems

Communications, Navigation, Surveillance/Air Traffic Management (CNS/ATM) systems utilize digital technologies, satellite systems, and various levels of automation to facilitate seamless global air traffic management. Automatic Dependent Surveillance-Broadcast (ADS-B), the core component of CNS/ATM, broadcasts important monitoring information, such as the location, altitude, and direction of aircraft, to the ground. However, ADS-B data are transmitted in an unencrypted (or unprotected) communication channel between ADS-B sensors and Air Traffic Control (ATC). Consequently, these data are vulnerable to security threats, such as spoofing, eavesdropping, and data modification. In this paper, we propose a method that protects the ADS-B data transmitted between ADS-B sensors and ATC using Simple Public Key Infrastructure (SPKI) certificates and symmetric cryptography. The SPKI certificates are used to grant transmission authorization to the ADS-B sensors, while symmetric cryptography is used to encrypt/decrypt the ADS-B data transmitted between the ADS-B sensors and ATC. The proposed security framework comprises an ADS-B sensor authentication module, an encrypted data processing module, and an ADS-B sensor information management module. We believe that application of the proposed security framework to CNS/ATM will enable it to effectively obviate security threats, such as ground station flood denial, ground station target ghost injection, and ADS-B data modification.

A case for open, viable print accounting

Purpose – This paper aims to describe the design and business characteristics of the system pertaining to efficient and viable public services, the technical perspective and also usage results from the productive prototype. When the academic library of our institution turned to consider cost-effective solutions that would combine management and accounting for both printing and photocopying, it was realized that there are no open-source or enterprise platforms that can support such characteristics. Instead of relying on commercial solutions, the construction of a service was planned by means of integrating community-based projects and developing any missing components. Design/methodology/approach – The implementation of the system was based on the identification of appropriate open-source modules and on the development of ones that do not exist but are necessary to realize business procedures for credit reception, control and billing. Thus, the system integrates software for the management of printers and print tasks, for accounting for printing tasks, for user catalogues, for authentication modules and for the control of low level I/O operations. The aforementioned systems were integrated along with the following new modules that were developed to create a complete service. Findings – Our prototype has been operating at our University since May 2011. The system was installed at four sites in reading rooms of the library. Three of them are located in different departments within the University campus, while the fourth is located in the last reading room that has not yet moved within the campus. In two years, more than 28,000 pages were printed and charged. The steady rise in the number of served requests leads us to the conclusion that the system can cope with the heavy use of photocopying machines. Originality/value – The prototype described in this paper is a complete productive platform that is capable to accept money or credit over the counter or by using money receivers and provide billing and management for printing and photocopying. The system does not depend on any vendor technology, offers control, monitoring, receipts and reports and because it relies on open source can minimize the total costs of ownership. Scrutiny of the bibliography and market did not find any systems that could meet the aforementioned characteristics.

User Authentication in LabVIEW Platform

The increase in the information access terminals along with the growing use of information sensitive applications such as e-commerce, e-learning, e-banking, and e-healthcare and many more web applications have generated a real requirement of reliable, easy to use, and generally acceptable control methods for confidential and vital information. The person authentication is one of the most critical issues in contemporary societies. Accurate automatic personal identification is crucial to a wide range of application domains. It ensures that a system's resources are not obtained fraudulently by illegal users. So in any application the first stage is user authentication. King Khalid University (KKU) is a public university located at Abha in Asir region of Saudi Arabia. In this paper, we take a case study of KKU Department Administration system, a database application build in LabVIEW platform using database connectivity toolkit for authentication. The user supplies user name and password for authentication. If the user is a valid user then user is allowed further into the system otherwise not. The user authentication module is the backbone of any web based application. Keywords: Authentication, LabVIEW, VI, Block diagram, Front panel, Database connectivity toolkit

Closed-set Speaker Identification in Speech Gateways

It has been observed an ever increasing need to access information whenever and wherever you want, regardless the means by which it is achieved. A speech gateway proves to be an important tool to reduce the gap between information source and the individual. However, current implementations lack authentication modules for verifying the identity of system's users, which is an enjoyable feature for a sort of applications. This paper presents the construction of a speaker identification module and its integration to VoiceXML-enabled speech gateways. Feature extraction has been made with Cepstrum and Vector Quantization has been used to perform properly recognition. Experiments have shown an accuracy rate of 87% in the identification of the speaker.

Design and Implementation of a Portable Name Card Typesetting System

The goal of this study is to develop a real-time personalized digital name card typesetting system with seamless operability across various platforms. The system includes an authentication module, a template selection module, a text typesetting and merger module, a frame selection and merger module, and a QR code generator and merger module. The system authentication module proposes a potential authentication mechanism between server and client. The template selection module entails making a choice of template from the system-integrated gallery. The text typesetting and merger module proposes the methodology of automatic typesetting that is under fixed font and size restrictions. After it is merged with the last picture, the frame selection and merger module combines one of the pictures from the frame gallery. The QR code generator and merger module is essentially a flowchart of how the QR code is generated. A personalized name card is the end product of these modules. The prototype generation shows that the system works well as a name card typesetting system. Finally, the system shows promising potential for applications to the emerging and proliferating market of smart phones.

Design of SSL VPN System Based on RBAC Access

Abstract: in order to solve the access control system loopholes, can appear the problem of chaotic management, security failure and conflict of competence, this paper studies the access control model, on the basis of the design of a SSL VPN oriented access control system, the authentication module, access control module, role access module and security detection module design. The realization technology of system user identity. This has practical reference significance to the personnel security technology research network.