One-time Password Research Articles

Canteenautomation System using Android Application

Nowadays technology has been used in almost every field in our present life, but still in the College canteen using traditional cash and card methods to take orders from the customer. When we are going to the college canteen for taking food, we have to wait in the queue for billing food and taking for token. But these days people do not have lots of time to spend in a queue for billing in the canteen. Many people are visiting the canteen during their break time, lunch break and leisure time So they have little time to eat and go back to particular places. Our project can provide the user with online registration on the android apps then read the food list from the e-menu card and select the item of food that the user wants to take and eat using android apps. Once the food has been selected from card E-menu then go to conformation food after that a one-time password generated on display or by a message on register mobile number.This one-time password use as a token for food. When the customer will take food from the food counter after verifying the one-time password by food supplier then the amount of food automatically debit from the customer wallet or account. By using it The cashier work will reduce through the android application and We can also say cashier's work is taking over. The main advantage of this application is if it's there a crowd in the canteen then there are opportunities the customer will be spending so much time in the queue for getting the token of the food and if cashier is not available then the user Could directly be booked and Order the meal items by using these android apps. So these android apps help them to save time to waiting in the queue and order food items whenever they want without visiting the cashier counter every now and then.

Shuffled Illusion PIN Framework to Prevent Shoulder – Surfing

Shoulder surfing is a kind of technique applied to sneak the personal data like passwords and some confidential data of the user. For this type of attacks there is no need of any kind of technical knowledge but just a keen observation towards the user performance is necessary. However, secret gadgets made these shoulder surfing easy for the attackers like cc cams. To overcome these attacks some authentication schemes are proposed- Illusion pin that works on digital display. It applies the method of hybrid pictures with 2 keypads blended one keypad with another, it is designed by using the human visibility and quotes the least distance at which an attacker is incapable to understand the buttons. We developed an innovative shuffling algorithm for shuffling the keys for every single pin entry. Using this Shuffling algorithm, we create a new pattern of the keypad for every exclusive entry of the pin. Through this technique the attacker is unable to track the pin even if he remembers the spatial arrangement of the digits in a keypad. To provide more security we are adding one-time password generating (OTP) technique.

Multi-Factor Authentication and Fingerprint-based Debit Card System

One thing can be said to be common to all forms of debit card fraud – authentication bypass. This implies that a secure debit card transaction system can only be guaranteed by a safe and reliable authentication system. Many approaches have been adopted to ensure a secure authentication system, but often, these approaches are either focused on the Automated Teller Machines (ATM)/Point of Sales (POS) terminals or Online/e-commerce transactions, thus not providing full security on both fronts. In this work, we address this problem by adopting a multi-factor debit card system that uses a combination of the traditional Personal Identification Number code (PIN) and the mobile-phone delivered One-Time Password (OTP) with a biometric authentication option (fingerprint). We demonstrate that this approach ensures the security of both online and terminal transactions. The fingerprint option makes it easy to use by people who find memorizing PINs difficult.

A Malicious Behavior Awareness and Defense Countermeasure Based on LoRaWAN Protocol.

Low power wide area network (LoRaWAN) protocol has been widely used in various fields. With its rapid development, security issues about the awareness and defense against malicious events in the Internet of Things must be taken seriously. Eavesdroppers can exploit the shortcomings of the specification and the limited consumption performance of devices to carry out security attacks such as replay attacks. In the process of the over-the-air-activation (OTAA) for LoRa nodes, attackers can modify the data because the data is transmitted in plain text. If the user’s root key is leaked, the wireless sensor network will not be able to prevent malicious nodes from joining the network. To solve this security flaw in LoRaWAN, we propose a countermeasure called Secure-Packet-Transmission scheme (SPT) which works based on the LoRaWAN standard v1.1 to prevent replay attacks when an attacker has obtained the root key. The proposed scheme redefines the format of join-request packet, add the new One Time Password (OTP) encrypted method and changes the transmission strategy in OTAA between LoRa nodes and network server. The security evaluation by using the Burrows-Abadi-Needham logic (BAN Logic) and the Scyther shows that the security goal can be achieved. This paper also conducts extensive experiments by simulations and a testbed to perform feasibility and performance analysis. All results demonstrate that SPT is lightweight, efficient and able to defend against malicious behavior.

A new one time password mechanism for client-server applications

OTP (One Time Passwords) are very important in today’s scenario in various applications like in financial transactions, e-commerce etc. They are used for enhancing the security of data communication. Many security applications are based on the strength of OTP. Any prediction in OTP generation can create serious threats to information security. Many new methods have been presented by researchers for OTP generation in the past decade. In this paper, we present a new authenticated OTP generation procedure between client and server. We also provide illustration with complete security analysis in order to prove its utility in various applications. Our procedure is implementable very easily and has embedded authentication and randomness.

A highly secure Multi- Factor authentication system using biometrics to enhance privacy in Internet of Things (IOT)

Authentication is becoming critical in the Internet of Things (IoT) environment because of its many applications and services have been emerging in the areas such as smart city, healthcare, industry etc. Security and privacy plays a vital role in IoT because their services can be accessed through smart device applications by the user from everywhere and at any time. Hence a multi-factor based authentication can provide high security in IOT environment. This security system incorporates most of the valuable methods such as cryptography, steganography and pattern recognition for authentication process. Among various biometric traits, palm vein is more efficient because it has essential sufficient features points for individual unique identification. The system employs registration phase and authentication phase. The registration phase enrolls person privacy data with their biometric and the obtained data’s are encrypted with the help of Elliptical Curve Cryptography (ECC) and this confidential information is embedded into person palm print image using bits substitution procedure. In authentication phase, recognition will be performed through three levels such as password, palm print and One Time Password (OTP). Using these three levels the matching can be done. The texture features can be obtained by using Multi Block Local Binary Pattern (MB-LBP) and Gabor filter. To afford high authentication, OTP method is also appended. This system provides better information security and texture analysis rather than previous approaches. Thus this multiple level approach ensures a fool proof and a reliable way for data access. Results are in terms of some validation parameters like false acceptance ratio, false rejection ratio and recognition rate. Observing from results, it is clear that the proposed approach outperform many existing methods. As a result, the proposed scheme has strong security, reliability and enhanced computational efficiency.

Selection of a rational authentication method for the remote systems of interaction with the vessels

Scientific and technical progress in the development and creation of software and hardware systems has a positive effect on improving the efficiency of water transport operation. The developed systems solve both general and particular tasks. Remote technical condition monitoring systems are used to solve particular problems, for example, to control fuel consumption. The vessels remote control systems are considered as larger ones. Obviously, only wireless means of communication between the remote user (operator) and the vessel are provided in them. The purpose of the paper is to determine a rational approach to ensure the information security for the remote systems of interaction with vessels. The main approaches to ensure the safe use of resources (Password authentication and authentication with one-time passwords, biometric authentication, authentication with a public key, authentication protocols and cryptographic methods) are considered and evaluated by the expert assessments method. Information security threats for the above-mentioned systems of remote interaction with the vessels are highlighted. It has been determined that for remote control systems it is highly expediently to use the cryptography methods with encryption, and for the remote technical condition monitoring such protection is not expedient, but the password authentication (including authentication with one-time password) is sufficient. Further directions of researches will be the elaboration of the specific solutions for selected means of security providing.

Authentication Framework for Kerberos Enabled Hadoop Clusters

The corporate world is intensively thinking of how to process vast datasets efficiently and securely. Apache Hadoop, an open source framework serves this requirement. Most of the current Hadoop technologies use Kerberos Authentication to incorporate security aspect to Hadoop, which suffers from numerous security and performance issues. The reliance on authentication credentials, a single point of failure as well as a single point of vulnerability, the insider threat and time synchronization problem adds to the list. A comprehensive review of various authentication issues in Kerberos-enabled Hadoop Clusters is provided in this paper. This paper proposes an authentication framework for Hadoop that uses an enhanced One-time Password (OTP) that can solve all the identified problems. The simulation results in Riverbed Modeler proves that the proposed model performs as good as traditional Kerberos Authentication Mechanism. A comparative analysis with existing mechanisms is also presented to strengthen the claims of proposed method

Improvement of a Security Enhanced One-time Mutual Authentication and Key Agreement Scheme

So far, many one-time password based authentication schemes have been proposed; however, none is secure enough. In 2004, W.C.Ku proposed hash-based strong-password based authentication scheme without using smart card that is vulnerable to the password guessing attack, not achieving mutual authentication and key agreement. In this paper, we propose a new improved version of Ku’s scheme that is eliminated these weaknesses.

MudraChain: Blockchain-based framework for automated cheque clearance in financial institutions

Currently, the burden on the cheque clearing houses in financial institutions is increasing day-by-day, which necessitates the upgrading of the existing cheque truncation system (CTS). It is a manual process which uses Magnetic Ink Character Recognition (MICR), where cheques have been scanned and sent to the clearing house for further processing. The limitations of existing CTS are — illegal duplication of cheque images, invisible ink usage, visibility issues in beneficiary name, and amount on the cheque. To handle the aforementioned issues of the existing CTS, blockchain has emerged as a new technology which is a distributed ledger that is timestamped and immutable. Being immutable, forgeries related to images of cheques during clearance cycles are not allowed. This provides trust and consensus among all participating entities in the network. Motivated by the above discussion, in this paper, we propose a framework named MudraChain for automated cheque clearance, where clearance operations are handled by the blockchain network, instead of existing CTS. It includes: (i) A multi-level authentication scheme to make the blockchain-based framework secure and tamper-proof among participating financial stakeholders, (ii) A quick-response (QR) code generation algorithm which performs digital signing of a cheque, and (iii) A novel two-factor authentication protocol to generate a time based one-time password (TOTP) for secure funds transfer. The obtained results are examined against state-of-the-art approaches to indicate the supremacy of the proposed framework. Thus, MudraChain allows a seamless flow of clearance operation via blockchain for the payer and the payee without any intermediaries. Finally, it addresses the requirements of building a secure application for cheque clearance in view of decentralized blockchain 4.0 applications.

A Secured One Time Password Authentication Technique using (3, 3) Visual Cryptography Scheme

The world is vastly becoming a completely digital one with most transactions carried out over the internet. This has exposed the internet to increasing threats and attacks and has necessitated the need for an internet-based authentication and authorization services. One Time Passwords (OTP) have been introduced to overcome the limitations of static passwords. However, research has shown that OTP are not completely free from middle man attacks. This paper presents a (3, 3) Visual Cryptographic Scheme (VCS) technique for OTP security. The technique secures the generated OTP image by dividing it into three shares, of which one of the shares will be sent to the user while the remaining shares will be stored at different locations on the server. Before the original OTP image will be recovered, all the shares must the retrieved and stacked together. To avoid pixel expansion problem and loss of image quality that have characterized existing VCS technique, progressive visual cryptography was adopted to decrypt the retrieved OTP shares. A high quality OTP image was recovered as revealed by the peak signal to noise ratio values and there was no change in size of the OTP images.

Improving the Security of Wireless Communications on High-Speed Trains by Efficient Authentication in SCN-R

Recently, we have witnessed the remarkable development in high-speed railways around the world. To provide a robust and fast wireless network for the onboard passengers, we have earlier proposed smart collaborative networking for railways (SCN-R). In the realization of SCN-R, its security is challenged by potential exploitation of authentication vulnerabilities since traditional authentication mechanisms are unsuitable for scenarios with fast moving objects due to their complex and relatively timely operations. In this paper, we address this issue by proposing a new efficient authentication mechanism, which is based on a new design of chaotic random number generator (RNG). Comparing with the recent proposal relying on the precise boundaries of chaotic map state spaces, our RNG uses two logistic maps to avoid the time-consuming boundary location process. The proposed authentication mechanism uses the RNG to generate and validate the one-time password (OTP). To support different authentication applications, different lengths of OTPs can be used to differentiate and identify the applications. We have implemented our proposed authentication mechanism under real-world conditions, with results showing the feasibility and effectiveness of our authentication mechanism.

A Stable and Secure One-Time-Password Generation Mechanism using Fingerprint Features

The growth of online application used for financial transactions and transferring personal information is increasingly common on internet and in mobile communication. These applications require authenticating legitimate users by assigning digital identities. Static passwords are perhaps most common type of credentials used today to authenticate the users. To avoid tedious task of remembering passwords, users often behave less securely by using low entropy and weak passwords, thus presenting security threats to online services. Various solutions have been provided to eliminate the need of users to create and manage passwords’ typical solution is based on generating one time password (OTP) for a single session or transaction. Unfortunately in most of the general mechanisms used for generating one time password (OTP) randomness of OTP system breaks after certain period of time and hence passwords become predictable. To solve this problem, in this paper a novel OTP generation method has been proposed, which generates OTP from fingerprint features of the user. The OTP produced from the system is secure as it uses fingerprint features in the seed and RIPEMD160 hash function in OTP generation procedure.

Implementation of an Additional Factor for Secure Authentication in Online Transactions

ABSTRACTTo eradicate financial fraud, governments encourage the digitization of financial transactions, which is also reinforced by the digital economy paradigm. Recently, there has been an exponential increase in the number of e-transactions, and the incidence of cyber crimes related to online transaction fraud has also been increasing. To prevent online transaction fraud, the stakeholders of financial-transaction-related companies have implemented various secured authentication and authorization practices at all levels. In this paper, an additional factor for secure authentication for online transactions has been proposed. A third authentication factor, in addition to Personal Identification Number (PIN) and one time password (OTP), has been proposed, which is based on the global positioning system (GPS) location of the user who initiates the transaction. The strategy is to approve / decline the transaction based on a specified distance constraint between the transaction device and the user’s mobile device; this distance is used as an additional authentication factor (third factor) to verify the online transaction. The main objective of this study is to prevent fraudsters from performing online transactions from devices that do not belong to the user and are not currently in the possession of the user. The simulation results show that a high detection rate, i.e., 98.55%, is obtained using the proposed method.

A Framework of Optical Sensing and Actuation With Secure-Access Card Using Spatial-Geometry Codes

Information security deals with provisioning of secrecy to data, often based on digital techniques such as encryption and data hiding. There has been significant growth in applications of smart sensors for high speed secure access and automation of indoor electro-mechanical systems. This paper develops a preliminary study of secure sensing using optical key or card that is illuminated by panel of IR LED with some location distribution. The card provides secure access by random combinations of geometrical features mapped using binary codes in the X-Y finite field. The physical features represent various levels of secure code and are not easily detectible between a back-to-back case or seal. The card acts like a physical encryption channel that transforms optical data from IR source for performing various predefined actions. A one-time password feature communicated to user's mobile phone notifies of possible breach if spoofed card is used or if breaking in using the card. The analytic framework is given by architecture comprising of: 1) optical section: encryption of optical signals by card representing Generator matrix of X-Y product code and 2) electronics section: sensing voltage levels and processing of the data for control and actuation. This paper also introduces capabilities of the sensing architecture against some error patterns and likely attacks.

GENERATORS OF ONE-TIME TWO-FACTOR AUTHENTICATION PASSWORDS

The paper presents algorithms for generating a one-time two-factor authentication passwords where application of trigonometric functions have been considered. To protect the opening of a one-time password, a secret string is read that consists of a sequence of randomly generated characters. The second factor is due to the fact that that the code has a certain validity period. The presented password generators allow the formation of secret words and trigonometric functions that the proposed two-factor authentication method consists of. The algorithm presented was implemented in Java Script. The algorithm includes blocks for checking randomly generated words and functions.

On one-time cookies protocol based on one-time password

Cookies are used for tracking user sessions in Web servers. Though, the security vulnerability of cookies may cause session being hijacked. To resist attacks, Dacosta et al. proposed one-time cookies (OTC) protocol. Unfortunately, one primary weakness is its availability relying on time synchronization between two machines, while the other is using a fixed session key to generate OTC during session period, turning possible adversaries to crack the key. Motivated by these shortcomings, a novel OTC protocol based on a one-time password (OTP) is proposed in the paper. The protocol adopts the OTP algorithm based on a hash chain to avoid time synchronization problems and generate a dynamic key for improving the security of OTC. For efficiency, we also enhanced the OTP algorithm. Security analysis and experimental results show that the proposed OTC protocol is promising to deliver high security and minimal burden on performance.

Study of Out-Of-Hospital Access to HIS System: A Security Perspective.

In light of the need for Extramural Hospital Information System (HIS) access through mobile devices outside the hospital, this research analyzes situational information security threats, including the circumstances in which a mobile device may get lost and personal data may be stolen. Moreover, the system needs to be implemented in accordance with the regulations. Based on the security threat analysis, it is proposed to use a security control module to provide a security-enabled HIS proxy module, two-way authentication module, and One-Time Password (OTP). The sending module and cryptographic technology computing module with Micro SD encryption card form a set of HIS extension system, which includes the SMS OTP method to simultaneously verify the two-way authentication mechanism of a user and the device that the user owns.

A practical challenge-response authentication mechanism for a Programmable Logic Controller control system with one-time password in nuclear power plants

Abstract Instrumentation and Control (I&C) systems of nuclear power plants (NPPs) have been continuously digitalized. These systems have a critical role in the operation of nuclear facilities by functioning as the brain of NPPs. In recent years, as cyber security threats to NPP systems have increased, regulatory and policy-related organizations around the world, including the International Atomic Energy Agency (IAEA), Nuclear Regulatory Commission (NRC) and Korea Institute of Nuclear Nonproliferation and Control (KINAC), have emphasized the importance of nuclear cyber security by publishing cyber security guidelines and recommending cyber security requirements for NPP facilities. As described in NRC Regulatory Guide (Reg) 5.71 and KINAC RS015, challenge response authentication should be applied to the critical digital I&C system of NPPs to satisfy the cyber security requirements. There have been no cases in which the most robust response authentication technology like challenge response has been developed and applied to nuclear I&C systems. This paper presents a challenge response authentication mechanism for a Programmable Logic Controller (PLC) system used as a control system in the safety system of the Advanced Power Reactor (APR) 1400 NPP.

Securing one-time password generation using elliptic-curve cryptography with self-portrait photograph for mobile commerce application

Over the decades, the security in mobile commerce application via One Time Password (OTP) plays a vital role. With new developments in mobile wallets, the volume of transactions increase globally and the need for securing transactions is still a challenging aspect. A strong user authentication mechanism is required since many of the attacks take minimum effort to break the security. User Authentication is a critical requirement since many of the attacks take minimum effort to break the security. Hence a novel cryptographic scheme is proposed to bridge the gap between security and authentication mechanisms. Initially, the scheme captures the user image to analyze the face for its structure, texture and feature identification. Once the image components are matched from the available template database user authentication is successful. To avoid conflict during template matching the face components are further subjected to segment location, radius and center of eyeballs at subpixellic accuracy. Iris matching is done via spatial histogram. If the iris information is similar, the Transaction Server (TS) generates OTP and sends it to the user mobile in order to complete the transaction. The proposed model is proven to be highly efficient against False Acceptance Rate (FAR) and False Rejection Rate (FRR) measures and is validated over Q- Fire dataset.