Current Authentication Systems Research Articles

A robust brain pattern for brain-based authentication methods using deep breath

Security authentication involves the process of verifying a person's identity. Authentication technology has played a crucial role in data security for many years. However, existing typical biometric authentication technologies exhibit limitations related to usability, time efficiency, and notably, the long-term viability of the method. Recent technological advancements have led to the development of specific devices capable of reproducing human biometrics due to their visibility and tactile nature. Consequently, there is a demand for a new biometric method to address the limitations of current authentication systems. Human brain signals have been utilized in various Brain-Computer Interface (BCI) applications. Nevertheless, this approach also faces challenges related to usability, time efficiency, and most importantly, the stability of the method over time. Studies reveal that the stability of brain patterns poses a significant challenge in EEG-based authentication techniques. Stability refers to the capacity to withstand changes or disruptions, while permanency implies a lasting and unchanging state. Notably, stability can be temporary and subject to fluctuations, whereas permanency suggests a more enduring condition. Research demonstrates that utilizing alpha brainwaves is a superior option for authentication compared to other brainwave types. Many brain states lack stability in different situations. Interestingly, deep breathing can enhance alpha waves irrespective of the brain's current state. To explore the potential of utilizing deep breathing as a security pattern for authentication purposes, an experiment was conducted to investigate its effects on brain activity and its role in enhancing alpha brainwaves. By focusing on bolstering the permanency of brain patterns, our aim is to address the challenges associated with stability in EEG-based authentication techniques. The experimental results exhibited a high success rate of 91 % and 90 % for Support Vector Machine and Neural Network classifiers, respectively. These results suggest that deep breathing not only enhances permanency but could also serve as a suitable option for a brainwave-based authentication method.

Secure healthcare system with insurance processing using blockchain

Electronic health records provide details about the patient's medications and medical history records. Health information draws attackers' attention since it holds important records. The delivery of the wrong medication or operation is the outcome of the loss of electronic health records. Less security measures are provided by healthcare systems for patient safety information. With the support of particular hospitals, traditional digital health records (EHRs) manage medical information one patient record at a time, which leads to the uncomfortable exchange of records. Cloud-based EHRs are able to share information more easily than traditional EHRs. For cloud-based EHRs, however, a cloud service centre and key generation centre present a specific problem. The proposed effort focuses on developing a new EHR paradigm that can address the centralized issue with cloud-based EHRs. Applying emerging block chain technologies to EHRs is the solution (denoted as block chain-based EHRs for convenience). First, in a block chain scenario, specify the system paradigm of block chain-based EHRs. Additionally, the authentication problem can be crucial for EHRs. On the other hand, the present authentication procedures for block chain-based EHRs have security issues of their own. Additionally, a suggestion for a block chain-based EHR authentication technique is presented here. Our remedy is a collusion-resistant role-based signature system with many signatories that can fend off an attack. Additionally, the suggested method is presumably secure and offers more effective signature and verification processes than current authentication systems in the paradigm of random oracles. The recommended study also focuses on how patients file insurance claims. It helps people get insurance from the authorized insurance sector.

Draw-a-Deep Pattern: Drawing Pattern-Based Smartphone User Authentication Based on Temporal Convolutional Neural Network

Present-day smartphones provide various conveniences, owing to high-end hardware specifications and advanced network technology. Consequently, people rely heavily on smartphones for a myriad of daily-life tasks, such as work scheduling, financial transactions, and social networking, which require a strong and robust user authentication mechanism to protect personal data and privacy. In this study, we propose draw-a-deep-pattern (DDP)—a deep learning-based end-to-end smartphone user authentication method using sequential data obtained from drawing a character or freestyle pattern on the smartphone touchscreen. In our model, a recurrent neural network (RNN) and a temporal convolution neural network (TCN), both of which are specialized in sequential data processing, are employed. The main advantages of the proposed DDP are (1) it is robust to the threats to which current authentication systems are vulnerable, e.g., shoulder surfing attack and smudge attack, and (2) it requires few parameters for training; therefore, the model can be consistently updated in real-time, whenever new training data are available. To verify the performance of the DDP model, we collected data from 40 participants in one of the most unfavorable environments possible, wherein all potential intruders know how the authorized users draw the characters or symbols (shape, direction, stroke, etc.) of the drawing pattern used for authentication. Of the two proposed DDP models, the TCN-based model yielded excellent authentication performance with average values of 0.99%, 1.41%, and 1.23% in terms of AUROC, FAR, and FRR, respectively. Furthermore, this model exhibited improved authentication performance and higher computational efficiency than the RNN-based model in most cases. To contribute to the research/industrial communities, we made our dataset publicly available, thereby allowing anyone studying or developing a behavioral biometric-based user authentication system to use our data without any restrictions.

A Survey of Biometric Authentication Technologies Towards Secure And Robust Systems: A Case Study of Mount Kenya University

In response to the increased demand for more effective authentication methods, the usage of biometric authentication to secure systems against unwanted access has grown. Because of the recent COVID-19 pandemic outbreak, any direct physical contact with the system should be avoided. Furthermore, current authentication systems lack the necessary security features, making them vulnerable to cyber risks such as forgery by unethical employees and unauthorized users. The goal of this paper is to investigate the existing biometric authentication systems and propose the best security models to overcome the weaknesses of existing technologies. The study employed mixed methodology, which was qualitative and quantitative in nature and relied on primary and secondary sources of data. The researcher collected the data from a population of 300 staff of Mount Kenya University with a sample size of 169 respondents. The R2 value on the relationship between the studied dependent and independent variables was R2 = 0.792 showing a good fit of the model since is greater than 50% of the test item used in the case study. Therefore the study recommends that institutions to implement a contactless biometric system to eliminate physical contact and use multimodal system that will help overcome the existing challenges associated with unimodal systems. There are still gaps for future researchers where they need to focus on the various decision algorithms that are best efficient in verifying users before they are authenticated in the system.

Design of a secure and privacy preserving authentication protocol for telecare medical information systems

AbstractWith the advancement of communication technology, Telecare Medicine Information Systems (TMIS) provides convenient healthcare services for patients, doctors, and health organizations over the insecure Internet. As a result, when accessing sensitive medical data over an insecure connection, user privacy, data security, and user authentication is very crucial. A secure authentication protocol plays a crucial role in securing communications over TMIS, these environments are very vulnerable to numerous attacks due to resource constraints and the nature of the communication medium. Recently, an efficient authentication framework has been introduced for TMIS to address various security issues. However, the existing mutual authentication and key agreement protocols are vulnerable to replay attacks, insider attacks, impersonation attacks, and password guessing attacks. Furthermore, the current authentication systems do not guarantee user privacy and the fair key agreement between the patient and the medical server. We propose a more robust authentication approach for healthcare information systems to address these security issues. To assess the authentication protocol's security strength, we employ formal verification tools like Automated Validation of Internet Security Protocols and Applications (AVISPA). Finally, a thorough performance analysis demonstrates that the proposed mutual authentication framework not only ensures privacy but also maintains a low computing overhead. As a result, when compared to other related systems, the proposed authentication protocol is both secure and computationally efficient.

Authentication and password storing improvement using SXR algorithm with a hash function

Secure password storing is essential in systems working based on password authentication. In this paper, SXR algorithm (Split, Exclusive OR, and Replace) was proposed to improve secure password storing and could also be applied to current authentication systems. SXR algorithm consisted of four steps. First, the received password from users was hashed through a general hash function. Second, the ratio and the number of iterations from the secret key (username and password) were calculated. Third, the hashed password and ratio were computed, and the hashed password was divided based on the ratio (Split) into two values. Both the values were applied to XOR equation according to the number of iterations, resulting in two new values. Last, the obtained values were concatenated and stored in the database (Replace). On evaluating, complexity analyses and comparisons has shown that SXR algorithm could provide attack resistance with a stronger hashed password against the aforementioned attacks. Consequently, even if the hackers hacked the hashed password, it would be challenging and would consume more time to decrypt the actual one, because the pattern of the stored password is the same as the one that has been hashed through the general hash function.

A Continuous User Authentication System Based on Galvanic Coupling Communication for s-Health

Smart health (s-health) is a vital topic and an essential research field today, supporting the real-time monitoring of user’s data by using sensors, either in direct or indirect contact with the human body. Real-time monitoring promotes changes in healthcare from a reactive to a proactive paradigm, contributing to early detection, prevention, and long-term management of health conditions. Under these new conditions, continuous user authentication plays a key role in protecting data and access control, once it focuses on keeping track of a user’s identity throughout the system operation. Traditional user authentication systems cannot fulfill the security requirements of s-health, because they are limited, prone to security breaches, and require the user to frequently authenticate by, e.g., a password or fingerprint. This interrupts the normal use of the system, being highly inconvenient and not user friendly. Also, data transmission in current authentication systems relies on wireless technologies, which are susceptible to eavesdropping during the pairing stage. Biological signals, e.g., electrocardiogram (ECG) and electroencephalogram (EEG), can offer continuous and seamless authentication bolstered by exclusive characteristics from each individual. However, it is necessary to redesign current authentication systems to encompass biometric traits and new communication technologies that can jointly protect data and provide continuous authentication. Hence, this article presents a novel biosignal authentication system, in which the photoplethysmogram (PPG) biosignal and a galvanic coupling (GC) channel lead to continuous, seamless, and secure user authentication. Furthermore, this article contributes to a clear organization of the state of the art on biosignal-based continuous user authentication systems, assisting research studies in this field. The evaluation of the system feasibility presents accuracy in keeping data integrity and up to 98.66% accuracy in the authentication process.

Research on Digital Encryption Security Information System Based on Identity Authentication

In order to solve the problems in the current authentication system, a new authentication system scheme is proposed. The user identity is used as a key production factor by using the CPK (Combined Public Key) combination public key system. From the perspective of security design, and combining the theory of CPK combined public key system, the overall design framework of CPK key management system is proposed. According to the functional requirements of the system, the main modules of the system are divided, and its main functions are stipulated. The system uses a secure authentication card as the only identity of the user. The authentication card has a certain computing power and safe storage space. It realizes the secure storage of the user’s key. Finally, from the actual application scenario, the data flow of the user in the process of registration and use in the system is given. The main modules of the system are tested successfully through the security authentication card.

Integrating Visual Mnemonics and Input Feedback With Passphrases to Improve the Usability and Security of Digital Authentication.

We developed a new authentication system based on passphrases instead of passwords. Our new system incorporates a user-generated mnemonic picture displayed during login, definition tooltips, error correction to reduce typographical errors, a decoy-based input masking technique, and random passphrase generation using either a specialized wordlist or a sentence template. Passphrases exhibit a greater level of security than traditional passwords, but their wider adoption has been hindered by human factors issues. Our assertion is that the added features of our system work particularly well with passphrases and help address these shortcomings. We conducted a study to evaluate our new system with a customized 1,450-word list and our new system with a 6-word sentence structure against the control conditions of a user-created passphrase of at least 24 characters and a system-generated passphrase using a 10,326-word list. Fifty participants completed two sessions so that we could measure the usability and security of the authentication schemes. With the new system conditions, memorability was improved, and security was equivalent to or better than the control conditions. Usability and overall ratings also favored the new system conditions over the control conditions. Our research presents a new authentication system using innovative techniques that improve on the usability and security of existing password and passphrase authentication systems. In computer security, drastic changes should never happen overnight, but we recommend that our contributions be incorporated into current authentication systems to help facilitate a transition from passwords to usable passphrases.

Design and implementation of Negative Authentication System

Modern society is mostly dependent on online activities like official or social communications, fund transfers and so on. Unauthorized system access is one of the utmost concerns than ever before in cyber systems. For any cyber system, robust authentication is an absolute necessity for ensuring security and reliable access to all type of transactions. However, more than 80% of the current authentication systems are password based, and surprisingly, they are prone to direct and indirect cracking via guessing or side channel attacks. The inspiration of Negative Authentication System (NAS) is based on the negative selection algorithm. In NAS, the password-based authentication data for valid users are termed as password profile or self-region (positive profile); any element other than the self-region is defined as non-self-region in the same representative space. The anti-password detectors are generated which covers most of the non-self-region. There are also some uncovered regions left in the non-self-region for inducing uncertainty to the attackers. In this work, we describe the design and implementation of three approaches of NAS and its efficacy over the other authentication methods. These three approaches represent three different ways to achieve obfuscation of password points with non-password space. The experiments are conducted with both real and simulated password profiles to justify the efficiency of different implementations of NAS.

Typing Biometric Keypads

Pervasive online applications are changing the way people perform routine activities. But while providing convenience to individuals and organizations, these applications can pose a significant remote user authentication challenge. Current authentication systems can be strengthened by adding an additional biometric layer to an existing authentication process. This paper addresses implementing such a solution by 1) presenting a novel biometric method that uses key-press pressure and timing patterns from a typed password to determine whether the person typing it is its true owner (even with a compromised PIN); and 2) investigating differences in perceptions of biometric keypads between two user groups, nursing and computing majors. Results reveal that combining pressure and timing patterns leads to better authentication compared with timing patterns alone. Furthermore, nursing majors are more cautious in accepting biometric keypad technology than computing majors, suggesting that care must be taken when introducing such technologies to different groups of people.

English

The paper aims to improve the security of the credit card online purchasing with taking into account the time and cost issues. Since the current online purchasing system using credit card has security drawbacks, a security improvement is suggested in this work by implementing a model which integrates the current authentication system of credit card with the fingerprint authentication. Moreover, it complements with a technique for validating and transmitting the fingerprint features. The customer submits his or her credit card information through the internet together with a file containing the fingerprint features and a validation code. This technique makes the customer feels more secure, at the same time it makes credit card fraud more difficult. Credit card information, fingerprint transaction authorization code and fingerprint features were the main components of the model. The authorization code is able to handle the usage of the scanned fingerprint features for one time only and preventing the submission of old and expired features. In addition, a ‘biometric and authorization code’ file is presented in this work to increase the fingerprint features security. It has its own structure in terms of storing the authorization code and fingerprint features which is unknown for the attacker and known only for the matching program. The average processing time consumed by the model to match all the data is 2.47 s while the overall accuracy rate was 99.48% with 0.52% error rate.   Key words: Credit card, authentication, fingerprint and biometrics.

Typing Biometrics

The use of stolen personal-identifying information, like Social Security numbers, to commit identity fraud continues to be a major problem. The fact that an impostor can pass as the genuine user by possession of stolen identification information is a weakness in current authentication systems. Adding a biometric layer to the traditional knowledge and token-based authentication systems is one way to counter this problem. Physical biometrics, such as fingerprint systems, are highly accurate; hence, they would be the first choice for such applications but are often inappropriate. Behavioral biometrics, like biometric typing patterns, have the potential to fill this gap as another level of security but this research identified some deficiencies in performance quality. Two research streams for improvements have emerged. The first approach attempts to improve performance by building better classifiers, while the second attempts to attain the same goal by using richer identifying inputs. Both streams assume that the typing biometric patterns are stable over time. This study investigates the validity of this assumption by analyzing how students’ typing patterns behave over time. The results demonstrate that typing patterns change over time due to learning resulting in several performance quality challenges. First, the changing patterns lead to deteriorating authentication accuracy. Second, the relevancy of the reference biometric template created during training becomes questionable. Third, the deterioration in accuracy compromises the security of the whole system and fourth, the net effect brings to question whether the biometric keypad is no longer “fit for use” as an authentication system. These are critical data quality issues that need to be addressed if behavioral biometrics are to play a significant role in minimizing authentication fraud. Possible solutions to the problem, including biometric template updating and choice of uncorrelated PIN combinations, are suggested as potential topics for future research.

Three-Dimensional Password for More Secure Authentication

Current authentication systems suffer from many weaknesses. Textual passwords are commonly used; however, users do not follow their requirements. Users tend to choose meaningful words from dictionaries, which make textual passwords easy to break and vulnerable to dictionary or brute force attacks. Many available graphical passwords have a password space that is less than or equal to the textual password space. Smart cards or tokens can be stolen. Many biometric authentications have been proposed; however, users tend to resist using biometrics because of their intrusiveness and the effect on their privacy. Moreover, biometrics cannot be revoked. In this paper, we present and evaluate our contribution, i.e., the 3-D password. The 3-D password is a multifactor authentication scheme. To be authenticated, we present a 3-D virtual environment where the user navigates and interacts with various objects. The sequence of actions and interactions toward the objects inside the 3-D environment constructs the user's 3-D password. The 3-D password can combine most existing authentication schemes such as textual passwords, graphical passwords, and various types of biometrics into a 3-D virtual environment. The design of the 3-D virtual environment and the type of objects selected determine the 3-D password key space.

Biometric cryptosystems: issues and challenges

In traditional cryptosystems, user authentication is based on possession of secret keys; the method falls apart if the keys are not kept secret (i.e., shared with non-legitimate users). Further, keys can be forgotten, lost, or stolen and, thus, cannot provide non-repudiation. Current authentication systems based on physiological and behavioral characteristics of persons (known as biometrics), such as fingerprints, inherently provide solutions to many of these problems and may replace the authentication component of traditional cryptosystems. We present various methods that monolithically bind a cryptographic key with the biometric template of a user stored in the database in such a way that the key cannot be revealed without a successful biometric authentication. We assess the performance of one of these biometric key binding/generation algorithms using the fingerprint biometric. We illustrate the challenges involved in biometric key generation primarily due to drastic acquisition variations in the representation of a biometric identifier and the imperfect nature of biometric feature extraction and matching algorithms. We elaborate on the suitability of these algorithms for digital rights management systems.