Password-based Approaches Research Articles

HEAP: An Efficient and Fault-Tolerant Authentication and Key Exchange Protocol for Hadoop-Assisted Big Data Platform

Hadoop framework has been evolved to manage big data in cloud. Hadoop distributed file system and MapReduce, the vital components of this framework, provide scalable and fault-tolerant big data storage and processing services at a lower cost. However, Hadoop does not provide any robust authentication mechanism for principals’ authentication. In fact, the existing state-of-the-art authentication protocols are vulnerable to various security threats, such as man-in-the-middle, replay, password guessing, stolen-verifier, privileged-insider, identity compromization, impersonation, denial-of-service, online/off-line dictionary, chosen plaintext, workstation compromization, and server-side compromisation attacks. Beside these threats, the state-of-the-art mechanisms lack to address the server-side data integrity and confidentiality issues. In addition to this, most of the existing authentication protocols follow a single-server-based user authentication strategy, which, in fact, originates single point of failure and single point of vulnerability issues. To address these limitations, in this paper, we propose a fault-tolerant authentication protocol suitable for the Hadoop framework, which is called the efficient authentication protocol for Hadoop (HEAP). HEAP alleviates the major issues of the existing state-of-the-art authentication mechanisms, namely operating-system-based authentication, password-based approach, and delegated token-based schemes, respectively, which are presently deployed in Hadoop. HEAP follows two-server-based authentication mechanism. HEAP authenticates the principal based on digital signature generation and verification strategy utilizing both advanced encryption standard and elliptic curve cryptography. The security analysis using both the formal security using the broadly accepted real-or-random (ROR) model and the informal (non-mathematical) security shows that HEAP protects several well-known attacks. In addition, the formal security verification using the widely used automated validation of Internet security protocols and applications ensures that HEAP is resilient against replay and man-in-the-middle attacks. Finally, the performance study contemplates that the overheads incurred in HEAP is reasonable and is also comparable to that of other existing state-of-the-art authentication protocols. High security along with comparable overheads makes HEAP to be robust and practical for a secure access to the big data storage and processing services.

Keystroke dynamics in the pre-touchscreen era

Biometric authentication seeks to measure an individual’s unique physiological attributes for the purpose of identity verification. Conventionally, this task has been realized via analyses of fingerprints or signature iris patterns. However, whilst such methods effectively offer a superior security protocol compared with password-based approaches for example, their substantial infrastructure costs, and intrusive nature, make them undesirable and indeed impractical for many scenarios. An alternative approach seeks to develop similarly robust screening protocols through analysis of typing patterns, formally known as keystroke dynamics. Here, keystroke analysis methodologies can utilize multiple variables, and a range of mathematical techniques, in order to extract individuals’ typing signatures. Such variables may include measurement of the period between key presses, and/or releases, or even key-strike pressures. Statistical methods, neural networks, and fuzzy logic have often formed the basis for quantitative analysis on the data gathered, typically from conventional computer keyboards. Extension to more recent technologies such as numerical keypads and touch-screen devices is in its infancy, but obviously important as such devices grow in popularity. Here, we review the state of knowledge pertaining to authentication via conventional keyboards with a view toward indicating how this platform of knowledge can be exploited and extended into the newly emergent type-based technological contexts.

A dynamic password-based user authentication scheme for hierarchical wireless sensor networks

Most queries in wireless sensor network (WSN) applications are issued at the point of the base station or gateway node of the network. However, for critical applications of WSNs there is a great need to access the real-time data inside the WSN from the nodes, because the real-time data may no longer be accessed through the base station only. So, the real-time data can be given access directly to the external users (parties) those who are authorized to access data as and when they demand. The user authentication plays a vital role for this purpose. In this paper, we propose a new password-based user authentication scheme in hierarchical wireless sensor networks. Our proposed scheme achieves better security and efficiency as compared to those for other existing password-based approaches. In addition, our scheme has merit to change dynamically the user's password locally without the help of the base station or gateway node. Furthermore, our scheme supports dynamic nodes addition after the initial deployment of nodes in the existing sensor network.

Secure speech biometric templates for user authentication

The security of biometrics against attacks is a serious concern in biometric personal authentication systems. In particular, the security of biometric templates is a topic of rapidly growing importance in the area of user authentication. The authors first demonstrate the security of a protected speech biometric template and devised an algorithm to attack a speech biometric user authentication system where templates are protected by a cryptographic framework. The experimental result showed an improvement for attackers in gaining access to the system. Then, a way to combine a password with a speech biometric cryptosystem is proposed. The authors present two schemes to enhance verification performance in a biometric cryptosystem using a password. Both can resist a password brute-force search if the biometrics are not compromised. Even if the biometrics are compromised, the attackers have to make many more attempts in searching for cryptographic keys in the system described in this study, compared to a traditional password-based approach. Finally, it is shown that the error rate of the proposed scheme is the same as in a traditional password-based approach even when genuine biometrics or templates are compromised.

Beyond the PIN: Enhancing user authentication for mobile devices

There is now an increasing need for an enhanced level of user authentication on mobile devices. In this article, Steven Furnell, Nathan Clarke and Sevasti Karazouni begin by examining the existing provision, which is dominated by PIN and password-based approaches. They established that these may be both inconvenient and inadequate for securing modern devices and services. Mobile devices have changed significantly over the last decade, in terms of both their form factor and underlying capabilities. The introduction of third generation (3G) technologies has provided the underlying mechanism for a wide variety of innovative data-orientated services, with approximately one million users every day adopting these new features. 1

Authentication and Billing Protocols for the Integration of WLAN and 3G Networks

Wireless communications have developed rapidly and have been applied for many services. Cellular (the third-generation) mobile networks and wireless local area network (WLAN) are two important technologies for providing wireless communications. The third-generation (3G) networks provide wider service areas, and “always-o” and ubiquitous connectivity with low-speed data rate. WLAN networks offer higher data rate and the easy compatibility of wired Internet, but cover smaller areas. In fact, 3G and WLAN possess complementary properties. Integrating 3G and WLAN networks may offer subscribers high-speed wireless data services and ubiquitous connectivity. For integrating two heterogeneous networks, several issues should be involved, authentication, billing, quality of service, and seamless roaming between 3G and WLAN networks. In this paper, we address the authentication and billing problems and propose two protocols that provide both authentication and billing services. One protocol utilizes a one-time password approach to authenticate subscribers. This protocol is efficient in both computation time and authentication procedures. Because of the restrictions of the password-based approach, this protocol could not offer the non-repudiation property for the billing problem. Another protocol is constructed on a public-key-based system (i.e., certificates). Although it requires more computation time than the password-based approach, non-repudiation is guaranteed. Performance analysis simulation results are given to validate our two protocols.