Authentication Stage Research Articles

PSL-MAAKA: Provably Secure and Lightweight Mutual Authentication and Key Agreement Protocol for Fully Public Channels in Internet of Medical Things

Designing efficient and secure mutual authentication and key agreement (MAAKA) protocols for Internet of Medical Things (IoMT) has been shown to be challenging, mainly due to the different security and privacy requirements in complex settings. Existing schemes generally are subject to a number of limitations, ranging from performance to security issues. In this article, we introduce a provably secure and lightweight MAAKA (PSL-MAAKA) protocol for fully public channels in IoMT. First, the proposed scheme is lightweight since the major operations in the stage of authentication and key agreement are hash operation and XOR operation, respectively. Second, this article proves the security of the presented protocol taking the advantage of the random oracle model. Next, this article gives that security requirements in IoMT could be satisfied through our presented MAAKA protocol. Finally, we demonstrate that it enjoys optimal performance than other competing schemes, in terms of communication overhead, computation overhead, and storage overhead.

Stateless Re-Association in WPA3 Using Paired Token

In Wi-Fi Protected Access 3 (WPA3), a secure connection is established in two sequential stages. Firstly, in the authentication and association stage, a pairwise master key (PMK) is generated. Secondly, in the post-association stage, a pairwise transient key (PTK) is generated from PMK using the traditional 4-way handshake protocol. To reduce the heavy load of the first stage, PMK caching can be used. If the client and AP are previously authenticated and have a PMK cache, the first heavy stage can be skipped and the cached PMK can be used to directly execute the 4-way handshake. However, PMK caching is a very primitive technology to manage shared key between a client and AP and there are many limitations; AP has to manage a stateful cache for a large number of clients, cache lifetime is limited, etc. Paired token (PT)is a new secondary credential scheme that provides stateless pre-shared key (PSK) in a client-server environment. The server issues a paired token (public token and secret token) to an authenticated client where the public token has the role of signed identity and the secret token is a kind of shared secret. Once a client is equipped with PT, it can be used for many symmetric key-based cryptographic applications such as authentication, authorization, key establishment, etc. In this paper, we apply the PT approach to WPA3 and try to replace the PMK caching with the one-time authenticated key establishment using PT. At the end of a successful full handshake, AP securely issues PT to the client. Then, in subsequent re-association requests, the client and AP can compute the same one-time authenticated PMK using PT in a stateless way. Using this kind of stateless re-association technology, AP can provide a high performance Wi-Fi service to a larger number of clients.

An Efficient GCD-Based Cancelable Biometric Algorithm for Single and Multiple Biometrics

Cancelable biometrics are required in most remote access applications that need an authentication stage such as the cloud and Internet of Things (IoT) networks. The objective of using cancelable biometrics is to save the original ones from hacking attempts. A generalized algorithm to generate cancelable templates that is applicable on both single and multiple biometrics is proposed in this paper to be considered for cloud and IoT applications. The original biometric is blurred with two co-prime operators. Hence, it can be recovered as the Greatest Common Divisor (GCD) between its two blurred versions. Minimal changes if induced in the biometric image prior to processing with co-prime operators prevents the recovery of the original biometric image through a GCD operation. Hence, the ability to change cancelable templates is guaranteed, since the owner of the biometric can pre-determine and manage the minimal change induced in the biometric image. Furthermore, we test the utility of the proposed algorithm in the single- and multi-biometric scenarios. The multi-biometric scenario depends on compressing face, fingerprint, iris, and palm print images, simultaneously, to generate the cancelable templates. Evaluation metrics such as Equal Error Rate (EER) and Area and Receiver Operator Characteristic curve (AROC) are considered. Simulation results on single- and multi-biometric scenarios show high AROC values up to 99.59%, and low EER values down to 0.04%.

Multi-Stage Quantum Secure Direct Communication Using Secure Shared Authentication Key

The security of Quantum Secure Direct Communication (QSDC) and its authentication procedure based on multiple stages is analyzed. The security analysis shows that the process of authentication is required to be done three times based on the usage of unitary transformation that is only known between Alice and Bob. In the proposed protocol, a secure quantum handshake is utilized to share the secret polarization angle and an authentication key at the initial stage of authentication over the quantum channel. The symmetry key is used in this work to protect user data communication within the QSDC protocol, where the same secret key is used to encrypt and decrypt the message. This work adopts the information travel time (ITT) by allowing the sender to detect any interference from third parties. In addition, the operation of the Pauli-X quantum gate increases Eve’s difficulty in stealing the information. The information transmitted is then continued by sending photons once in the quantum channel, which improves the efficiency without losing the message’s security. In addition, to securely transfer the stream of messages, the proposed protocol is operated in single-stage, and the authentication is applied bit-by-bit, thus reducing the transmission time. Security checks are carried out along the data transmission process. Compared to previous protocols, this new initial authentication protocol has remarkable advantages since it does not require public communication to pre-share the authentication key and secret angles before the onset of the transmission, therefore, reducing the communication cost. Moreover, the secret authentication key and polarization angles are updated after a number of bits are sent to increase the security level. The verification process is also conducted to ensure the symmetry of the sender and receiver. The analyses presented herein demonstrate that the proposed authentication protocol is simple and secure in order to ensure the legitimacy of the users.

An online/offline distributed attribute-based authentication scheme

Attribute-based authentication is an effective cryptography mechanism, which makes it possible for service providers to implement fine-grained access control on cloud resources. Although many attribute-based authentication schemes have been proposed, most of them only support single attribute authority and users have to perform a large amount of computation in the authentication phase. By extending the ciphertext policy attribute-based encryption scheme of Rouselakis et al, a distributed attribute-based authentication scheme was designed. The feature of the new scheme is to optimize the online computation efficiency of both service providers and users, i.e., by introducing the technique of online/offline attribute-based encryption, the online computational burden of semi trusted servers is greatly reduced. On the other hand, by introducing outsourcing decryption, users’ computation in the authentication stage is independent of the size of underlying access structures. Compared with previous schemes, the new scheme satisfies several ideal properties, that is, introducing distributed authorities, supporting outsourcing computation, satisfying anonymity and unlinkability, and so on.

An efficient attribute-based authentication scheme with multiple authorities in public cloud

Currently, attribute-based authentication provides a feasible solution for fine-grained access control in cloud environment. However, the existing schemes can not solve the following problems at the same time, that is, how to ensure that the computation cost of the client does not depend on the size of underlying access structure, and how to introduce distributed authorities to manage and maintain the attribute universe. To solve the above problems, an efficient multi-authority attribute-based authentication scheme is proposed. The new scheme uses the technique of distributed attribute-based encryption to realize the access control of anonymous users, and reduces users’ computation burden by optimizing the standard implementation zero-knowledge proof and outsourcing users’ computing tasks in the authentication stage. Under the new definition of security, it can be proved that the new scheme is secure and satisfies many attractive properties, such as introducing distributed authorities, supporting outsourcing computation, satisfying attribute anonymity.

A lightweight attribute-based authentication system with DAA

In cloud computing environment, while preventing users from illegally accessing resources, various cloud service systems must provide protection for authorized users of their personal sensitive information. Attribute-based authentication (ABA) makes it possible to solve the above problems. An efficient ABA system was put forward by extending the direct anonymous attestation (DAA) scheme of Brickell et al. During the construction of the new system, the technique of lightweight ciphertext policy attribute-based encryption was adopted, and the online computing task of users was optimized. Compared with other similar systems, the new system is characterized by the use of trusted computing technology to improve the level of privacy protection of users, and the computational complexity of users in the authentication stage is independent of the size of access policy.

An Effective Semi-fragile Watermarking Method for Image Authentication Based on Lifting Wavelet Transform and Feed-Forward Neural Network

Digital watermarking is a significant issue in the field of information security and avoiding the misuse of images in the world of Internet and communication. This paper proposes a novel watermarking method for tamper detection and recovery using semi-fragile data hiding, based on lifting wavelet transform (LWT) and feed-forward neural network (FNN). In this work, first, the host image is decomposed up to one level using LWT, and the discrete cosine transform (DCT) is applied to each 2×2 blocks of diagonal details. Next, a random binary sequence is embedded in each block as the watermark by correlating DC coefficients. In the authentication stage, first, the geometry is analyzed by using speeded up robust features (SURF) algorithm and extract watermark bits by using FNN. Afterward, logical exclusive or operation between original and extracted watermark is applied to detect tampered region. Eventually, in the recovery stage, tampered regions are recovered using the inverse halftoning technique. The performance and efficiency of the method and its robustness against various geometric, non-geometric, and hybrid attacks are reported. From the experimental results, it can be seen that the proposed method is superior in terms of robustness and quality of the watermarked and recovered images, respectively, compared to the state-of-the-art methods. Besides, imperceptibility has been improved by using different correlation steps as the gain factor for flat (smooth) and texture (rough) blocks. Based on the advantages exhibited, the proposed method outperforms the related works, in terms of superiority, efficiency, and effectiveness for tamper detection and recovery-based applications.

YOLO-face: a real-time face detector

Face detection is one of the important tasks of object detection. Typically detection is the first stage of pattern recognition and identity authentication. In recent years, deep learning-based algorithms in object detection have grown rapidly. These algorithms can be generally divided into two categories, i.e., two-stage detector like Faster R-CNN and one-stage detector like YOLO. Although YOLO and its varieties are not so good as two-stage detectors in terms of accuracy, they outperform the counterparts by a large margin in speed. YOLO performs well when facing normal size objects, but is incapable of detecting small objects. The accuracy decreases notably when dealing with objects that have large-scale changing like faces. Aimed to solve the detection problem of varying face scales, we propose a face detector named YOLO-face based on YOLOv3 to improve the performance for face detection. The present approach includes using anchor boxes more appropriate for face detection and a more precise regression loss function. The improved detector significantly increased accuracy while remaining fast detection speed. Experiments on the WIDER FACE and the FDDB datasets show that our improved algorithm outperforms YOLO and its varieties.

A Compressive Sensing Based Image Encryption and Compression Algorithm With Identity Authentication and Blind Signcryption

Recently, a robust and secure image sharing scheme with personal identity information embedded was proposed based on Compressive Sensing, Secret Image Sharing and Diffie-Hellman Agreement. However, there exists a security flaw in this scheme. It cannot resist the man-in-the-middle attack in the authentication stage. Anyone can disguise himself as a legal person and get the information when exchanging the secret keys, which provides the possibility for information leakage, tampering, and other attacks. In this paper, we propose an image encryption and compression algorithm with identity authentication and blind signcryption based on Parallel Compressive Sensing (PCS), Secret Sharing(SS) and Elliptic Curve Cryptography (ECC). Firstly, Logistic-Tent system and PCS are employed to complete compression and lightweight encryption in the compression stage. Secondly, random sequences are generated based on Chebyshev map to construct four encryption matrices to perform the encryption process. Meanwhile, the participants' identity authentication and blind signcryption can be achieved by using ECC. Finally, we prove the efficiency and security of the blind signcryption, which can authenticate the participants' identity before restoring the original image. Experiments and security analysis demonstrate that the proposed scheme not only reduce the storage space and computational complexity effectively, but also has resistance against the man-in-the-middle attack, forgery attack and chosen-text attack.

Security of user authentication in payment systems in the agricultural value chain

In the offered article, the threats of informational safety, arising in the modern world, directed on the bank and commercial payment systems using in all world and in Russia in particular are considered. The circuits of operation of the most popular Russian banking and commercial payment systems using electronic money (e–cash) and their possible vulnerability caused by increase of monetary calculations through the Internet are described. Not all bank devices support biometric scanning; therefore, there is question on how the huge amount of bank payment systems users can protect their personal data from not authorized operations (hackers breaking)? For support of payments safety, the paper offers using the additional complicated authentication – the application of simplified cryptography token which is looking like program application, and installed on USB – device. It will allow amplifying the safety at authentication stage as the program application generating of one – time keywords and checking (controlling) of user’s authenticity with the help of white list, is capable to eliminate all existing vulnerabilities and gaps in the informational protection of banking and commercial payment systems.

False-Accept/False-Reject Trade-Offs for Ensembles of Biometric Authentication Systems

Biometric authentication systems, based on secret key generation, work as follows. In the enrollment stage, an individual provides a biometric signal that is mapped into a secret key and a helper message, the former being prepared to become available to the system at a later time (for authentication), and the latter is stored in a public database. When an authorized user requests authentication, claiming his/her identity to be one of those of the subscribers, he/she has to provide a biometric signal again, and then the system, which retrieves also the helper message of the claimed subscriber, produces an estimate of the secret key that is finally compared to the secret key of the claimed user. In the case of a match, the authentication request is approved; otherwise, it is rejected. Evidently, there is an inherent tension between two desired, but conflicting, properties of the helper message encoder; on the one hand, the encoding should be informative enough concerning the identity of the real subscriber, in order to approve him/her in the authentication stage, but on the other hand, it should not be too informative, as otherwise, unauthorized imposters could easily fool the system and gain access. A good encoder should then trade off the two kinds of errors: the false reject (FR) error and the false accept (FA) error. In this paper, we investigate trade-offs between the random coding FR error exponent and the best achievable FA error exponent. We compare two types of ensembles of codes: fixed-rate codes and variable-rate codes, and we show that the latter class of codes offers considerable improvement compared to the former. In doing this, we characterize ensemble-optimal rate functions for both types of codes. We also examine the effect of privacy leakage constraints for both fixed-rate codes and variable-rate codes

Fingereye: improvising security and optimizing ATM transaction time based on iris-scan authentication

The tumultuous increase in ATM attacks using eavesdropping, shoulder-surfing, has risen great concerns. Attackers often target the authentication stage where a customer may be entering his login information on the ATM and thus use direct observation techniques by looking over the customer's shoulder to steal his passwords. Existing authentication mechanism employs the traditional password-based authentication system which fails to curb these attacks. This paper addresses this problem using the FingerEye. The FingerEye is a robust system integrated with iris-scan authentication. A customer’s profile is created at registration where the pattern in his iris is analyzed and converted into binary codes. The binary codes are then stored in the bank database and are required for verification prior to any transaction. We leverage on the iris because every user has unique eyes which do not change until death and even a blind person with iris can be authenticated too. We implemented and tested the proposed system using CIMB bank, Malaysia as case study. The FingerEye is integrated with the current infrastructure employed by the bank and as such, no extra cost was incurred. Our result demonstrates that ATM attacks become impractical. Moreover, transactions were executed faster from 6.5 seconds to 1.4 seconds.

Multimodal Biometric Authentication Systems Using Convolution Neural Network Based on Different Level Fusion of ECG and Fingerprint

A multimodal biometric system integrates information from more than one biometric modality to improve the performance of each individual biometric system and make the system robust to spoof attacks. In this paper, we propose a secure multimodal biometric system that uses convolution neural network (CNN) and Q-Gaussian multi support vector machine (QG-MSVM) based on a different level fusion. We developed two authentication systems with two different level fusion algorithms: a feature level fusion and a decision level fusion. The feature extraction for individual modalities is performed using CNN. In this step, we selected two layers from CNN that achieved the highest accuracy, in which each layer is regarded as separated feature descriptors. After that, we combined them using the proposed internal fusion to generate the biometric templates. In the next step, we applied one of the cancelable biometric techniques to protect these templates and increase the security of the proposed system. In the authentication stage, we applied QG-MSVM as a classifier for authentication to improve the performance. Our systems were tested on several publicly available databases for ECG and fingerprint. The experimental results show that the proposed multimodal systems are efficient, robust, and reliable than existing multimodal authentication systems.

Versatile Authentication Using an Identifier Based On Optical Variable Nanostructures

Counterfeit electronic devices are increasingly recognized as severe threats for the security of cyber-physical systems. To authenticate and verify original devices and manufacturers, an optical authentication identifier based on a pixelated nano-substrate and a versatile intensity control layer is introduced in this article. The pixelated nano-substrate is comprised of color pixels based on optical variable nanostructures whereas the intensity control layer is designed to activate or deactivate specific color pixels. A response image acquisition device based on angle-dependent optical diffraction is constructed to register the authentic identifiers and to detect fake identifiers. In the registration stage, the extracted data (color information) of the authentic identifier is stored as a reference on a secured server. In the authentication stage, the data are obtained from a detected identifier and compared to the reference using block-by-block calculations of inter-distances and intra-distances. Experimental results and analysis show that the proposed scheme can accomplish the authentication of the optical identifier with high reliability and robustness.

Parallel score fusion of ECG and fingerprint for human authentication based on convolution neural network

Biometrics have been extensively used in the past decades in various security systems and have been deployed around the world. However, all unimodal biometrics have their own limitations and disadvantages (e.g., fingerprint suffers from spoof attacks). Most of these limitations can be addressed by designing a multimodal biometric system, which deploys over one biometric modality to improve the performance and make the system robust to spoof attacks. In this paper, we proposed a secure multimodal biometric system by fusing electrocardiogram (ECG) and fingerprint based on convolution neural network (CNN). To the best of our knowledge, this is the first study to fuse ECG and fingerprint using CNN for human authentication. The feature extraction for individual modalities are performed using CNN and then biometric templates are generated from these features. After that, we have applied one of the cancelable biometric techniques to protect these templates. In the authentication stage, we proposed a Q-Gaussian multi support vector machine (QG-MSVM) as a classifier to improve the authentication performance. Dataset augmentation is successfully used to increase the authentication performance of the proposed system. Our system is tested on two databases, the PTB database from PhysioNet bank for ECG and LivDet2015 database for the fingerprint. Experimental results show that the proposed multimodal system is efficient, robust and reliable than existing multimodal authentication algorithms. According to the advantages of the proposed system, it can be deployed in real applications.

Cancelable biometric authentication system based on ECG

Biometrics are widely deployed in various security systems; however, they have drawbacks in the form of leakage or stealing, therefore numerous solutions have been proposed to secure biometric template such as cancelable biometric, which is one of the possible solutions for canceling and securing biometric template. However, this problem is still open and to the best of our knowledge, few previous studies have proposed a complete authentic system using the cancelable biometric techniques based on electrocardiogram (ECG). In this paper, we have applied two cancelable biometric techniques for developing a human authentication system based on ECG signals. The first one is an improved Bio-Hashing and the second one is matrix operation technique. The improved Bio-Hash technique solves the problem of accuracy loss, which is the main drawback of basic Bio-Hash technique. The protected feature vector (Bio-Hashed code) is generated from the inner product between the ECG features matrix and tokenize number matrix. While the matrix operation technique is applied on the ECG feature matrix to produce a transformed template which is irreversible to the original features of the ECG. In the authentication stage, Feed-Forward Neural Network (FFNN) is used to verify individuals. After applying the two cancelable techniques on three public available ECG databases, experimental results show that the proposed system performs better regarding authentication and outperforms state-of-the-art techniques considered.

Study on a Biometric Authentication Model based on ECG using a Fuzzy Neural Network

Traditional authentication methods use numbers or graphic passwords and thus involve the risk of loss or theft. Various studies are underway regarding biometric authentication because it uses the unique biometric data of a human being. Biometric authentication technology using ECG from biometric data involves signals that record electrical stimuli from the heart. It is difficult to manipulate and is advantageous in that it enables unrestrained measurements from sensors that are attached to the skin. This study is on biometric authentication methods using the neural network with weighted fuzzy membership functions (NEWFM). In the biometric authentication process, normalization and the ensemble average is applied during preprocessing, characteristics are extracted using Haar-wavelets, and a registration process called “training” is performed in the fuzzy neural network. In the experiment, biometric authentication was performed on 73 subjects in the Physionet Database. 10-40 ECG waveforms were tested for use in the registration process, and 15 ECG waveforms were deemed the appropriate number for registering ECG waveforms. 1 ECG waveforms were used during the authentication stage to conduct the biometric authentication test. Upon testing the proposed biometric authentication method based on 73 subjects from the Physionet Database, the TAR was 98.32% and FAR was 5.84%.

Multilevel Authentication System for Stemming Crime in Online Banking

Aim/Purpose: The wide use of online banking and technological advancement has attracted the interest of malicious and criminal users with a more sophisticated form of attacks. Background: Therefore, banks need to adapt their security systems to effectively stem threats posed by imposters and hackers and to also provide higher security standards that assure customers of a secured environment to perform their financial transactions. Methodology : The use of authentication techniques that include the mutual secure socket layer authentication embedded with some specific features. Contribution: An approach was made through this paper towards providing a more reliable and complete solution for implementing multi-level user authentication in a banking environment. Findings: The use of soft token as the final stage of authentication provides ease of management with no additional hardware requirement. Recommendations for Practitioners : This work is an approach made towards providing a more reliable and complete solution for implementing multi-level user authentication in a banking environment to stem cybercrime. Recommendation for Researchers: With this approach, a reliable system of authentication is being suggested to stem the growing rate of hacking activities in the information technology sector. Impact on Society :This work if adopted will give the entire populace confidence in carrying out online banking without fear of any compromise. Future Research: This work can be adopted to model a real-life scenario.

An efficient and secured approach for sequential and transparent identity validation of user in internet services

These days, it ends up noticeably genuine worry to give greater security to web administrations. Along these lines, secure client verification is the central assignment in security frameworks. Generally, a large portion of the frameworks depend on sets of username and secret key which checks the personality of client just at authentication stage. Once the client accesses with username and secret key, no checks are performed and encourages amid working sessions. Be that as it may, rising biometric arrangements gives the username and secret key using biometric information of client. In such approach, single shot check is less proficient in light of the fact that personality of client is perpetually amid entire session. Consequently, an important arrangement is to utilize brief time of timeouts for every session and occasionally ask the client to enter his or her qualifications again and again. In any case, this isn't a legitimate arrangement since it vigorously influences the administration convenience and eventually the fulfilment of clients. This paper investigates the framework for nonstop verification of client utilizing his accreditations, for example, biometric qualities. The utilization of consistent biometric verification framework procures certifications without expressly telling the client or requiring client communication that is, straightforwardly which is essential to ensure for better execution and administration ease of use.