Password-based Authentication Research Articles

Enhancing cell phone security through finger vein biometric authentication systems

The growing demand for secure mobile devices has led to the widespread adoption of biometric technologies. While personal identification numbers (PINs), passwords, gridlock patterns to safeguard phones and facial recognition have become common, they have certain limitations in terms of security and user convenience. These conventional security measures are riddled with susceptibilities, such as password pilferage, memory lapses in authentication details, and user mistakes in grid pattern creation. Due to the rising occurrence of cell phone incursions and theft, there is an urgent requirement for a strong security system that not only defends data but also shields the device itself. This paper proposes a resilient finger vein biometric security system as a more effective substitute for knowledge-based and password-based authentication techniques. The implementation of finger vein biometrics as a novel approach to enhancing cell phone security. The method employs infrared (IR) light transmission to capture the vein patterns and shadows resulting from the different thicknesses of finger muscles, bones, and tissues. The unique vascular patterns in fingers are difficult to forge, offering a higher level of security compared to other biometric systems. The simulations we conducted indicate an identification accuracy rate of 93.82%, indicating that this technique provides a substantial enhancement in preventing unauthorized access and theft of cell phones. This study examines the technology behind finger vein biometrics, its integration into mobile devices, and the security advantages it offers.

New Test to Detect Clustered Graphical Passwords in Passpoints Based on the Perimeter of the Convex Hull

This research paper presents a new test based on a novel approach for identifying clustered graphical passwords within the Passpoints scenario. Clustered graphical passwords are considered a weakness of graphical authentication systems, introduced by users during the registration phase, and thus it is necessary to have methods for the detection and prevention of such weaknesses. Graphical authentication methods serve as a viable alternative to the conventional alphanumeric password-based authentication method, which is susceptible to known weaknesses arising from user-generated passwords of this nature. The test proposed in this study is based on estimating the distributions of the perimeter of the convex hull, based on the hypothesis that the perimeter of the convex hull of a set of five clustered points is smaller than the one formed by random points. This convex hull is computed based on the points that users select as passwords within an image measuring 1920 × 1080 pixels, using the built-in function convhull in Matlab R2018a relying on the Qhull algorithm. The test was formulated by choosing the optimal distribution that fits the data from a total of 54 distributions, evaluated using the Kolmogorov–Smirnov, Anderson–Darling, and Chi-squared tests, thus achieving the highest reliability. Evaluating the effectiveness of the proposed test involves estimating type I and II errors, for five levels of significance α∈{0.01,0.02,0.05,0.1,0.2}, by simulating datasets of random and clustered graphical passwords with different levels of clustering. In this study, we compare the effectiveness and efficiency of the proposed test with existing tests from the literature that can detect this type of pattern in Passpoints graphical passwords. Our findings indicate that the new test demonstrates a significant improvement in effectiveness compared to previously published tests. Furthermore, the joint application of the two tests also shows improvement. Depending on the significance level determined by the user or system, the enhancement results in a higher detection rate of clustered passwords, ranging from 0.1% to 8% compared to the most effective previous methods. This improvement leads to a decrease in the estimated probability of committing a type II error. In terms of efficiency, the proposed test outperforms several previous tests; however, it falls short of being the most efficient, using computation time measured in seconds as a metric. It can be concluded that the newly developed test demonstrates the highest effectiveness and the second-highest efficiency level compared to the other tests available in the existing literature for the same purpose. The test was designed to be implemented in graphical authentication systems to prevent users from selecting weak graphical passwords, enhance password strength, and improve system security.

A comprehensive evaluation on the benefits of context based password cracking for digital forensics

Password-based authentication systems have many weaknesses, yet they remain overwhelmingly used and their announced disappearance is still undated. The system admin overcomes the imperfection by skilfully enforcing a strong password policy and sane password management on the server side. But in the end, the user behind the password is still responsible for the password’s strength. A poor choice can have dramatic consequences for the user or even for the service behind, especially considering critical infrastructure. On the other hand, law enforcement can benefit from a suspect’s weak decisions to recover digital content stored in an encrypted format. Generic password cracking procedures can support law enforcement in this matter — however, these approaches quickly demonstrate their limitations. This article proves that more targeted approaches can be used in combination with traditional strategies to increase the likelihood of success when contextual information is available and can be exploited.

Fast Identity Online 2 :Authentication Technique

Fast Identity Online 2 (FIDO2) emerges as a transformative solution to the vulnerabilities inherent in traditional password-based authentication methods. Leveraging public key cryptography and authenticators, it establishes a passwordless authentication paradigm, extending its relevance beyond web applications to diverse realms such as online payments and government services. This paper explores FIDO2's emphasis on a seamless user experience while bolstering security measures through innovative credential management techniques. The acceptance of FIDO2 on major browsers ensures its usability on mobile devices, with most modern devices equipped to support FIDO2 authentication, thus expanding its reach and applicability. Additionally, its adoption by major tech companies and standards bodies underscores its credibility and potential for widespread adoption. However, challenges remain, including overcoming legacy systems, addressing compatibility issues, and ensuring user education. Despite these challenges, FIDO2 represents a significant advancement in online authentication, offering strong security, usability, and privacy features, positioning it as a key enabler of the passwordless authentication paradigm. Keywords: Public key cryptosystem, challenge, relying party, web browser and web authentication.

A Recognition-Based Graphical Password System for Enhanced User Authentication

Abstract: Password-based authentication is a popular way for ensuring computer application security and privacy. Nonetheless, the "weakest link" in the authentication process is believed to be user-chosen weak passwords and hazardous input techniques. People generally utilize mnemonic or brief passphrases instead of random alphanumeric characters. Because internet and mobile applications are widely available, users can access them from any location, at any time, using any device. While this simplicity is generally appreciated, it also increases the likelihood that credentials will be compromised through Visual Hacking. The assault tactics can include employing external recording equipment or watching the victim personally in order to obtain their login information. In response to this issue, our team created a graphical password-based authentication mechanism to combat the threat of Visual Hacking. The system's security mechanism is three-tiered, featuring password verification as well as colour and pattern matching features. This means that even with numerous camera-based hacking attempts, potential attackers would have a tough time determining or limiting the password. In addition, we created and tested a system prototype to determine its usability. According to our trial results, our system can survive Visual Hacking better than previous authentication systems while maintaining a high level of security and usability.

Password authenticated key exchange-based on Kyber for mobile devices.

In this article, a password-authenticated key exchange (PAKE) version of the National Institute of Standards and Technology (NIST) post-quantum cryptography (PQC) public-key encryption and key-establishment standard is constructed. We mainly focused on how the PAKE version of PQC standard Kyber with mobile compatibility can be obtained by using simple structured password components. In the design process, the conventional password-based authenticated key exchange (PAK) approach is updated under the module learning with errors (MLWE) assumptions to add password-based authentication. Thanks to the following PAK model, the proposed Kyber.PAKE provides explicit authentication and perfect forward secrecy (PFS). The resistance analysis against the password dictionary attack of Kyber.PAKE is examined by using random oracle model (ROM) assumptions. In the security analysis, the cumulative distribution function (CDF) Zipf (CDF-Zipf) model is also followed to provide realistic security examinations. According to the implementation results, Kyber.PAKE presents better run-time than lattice-based PAKE schemes with similar features, even if it contains complex key encapsulation mechanism (KEM) components. The comparison results show that the proposed PAKE scheme will come to the fore for the future security of mobile environments and other areas.

Cryptanalysis of a privacy-preserving authentication scheme based on private set intersection

Abstract Continuous and context-aware authentication mechanisms have been proposed as complementary security mechanisms to password-based authentication for computer devices that are handled directly by humans, such as smart phones. Such authentication mechanisms incur some privacy issues as user-dependent features are revealed to the authentication server, which is assumed to be untrusted. Domingo-Ferrer et al. proposed a privacy-preserving protocol for context-aware user authentication on the basis of private set intersection and Paillier homomorphic encryption. This approach enables user authentication based on establishing the number of similarities between sampled user context data and reference context data, without revealing any plaintext data to either party. The authors claim that their scheme is secure against malicious adversaries. In this article, we show that Domingo-Ferrer et al.’s scheme is insecure by means of two undetectable attacks that reveal all user information despite the encryption. The Paillier encryption primitive has a homomorphic property that we observe not only lacks relevance but, indeed, incurs a vulnerability that is exploited in the proposed cryptanalysis. This means that special care needs to be taken considering homomorphic properties of cryptographic primitives used in cryptographic protocols. Our cryptanalysis may therefore have a general interest regarding the design of cryptographic protocols.

Deep learning based biometric authentication using electrocardiogram and iris

Authentication systems play an important role in wide range of applications. The traditional token certificate and password-based authentication systems are now replaced by biometric authentication systems. Generally, these authentication systems are based on the data obtained from face, iris, electrocardiogram (ECG), fingerprint and palm print. But these types of models are unimodal authentication, which suffer from accuracy and reliability issues. In this regard, multimodal biometric authentication systems have gained huge attention to develop the robust authentication systems. Moreover, the current development in deep learning schemes have proliferated to develop more robust architecture to overcome the issues of tradition machine learning based authentication systems. In this work, we have adopted ECG and iris data and trained the obtained features with the help of hybrid convolutional neural network- long short-term memory (CNN-LSTM) model. In ECG, R peak detection is considered as an important aspect for feature extraction and morphological features are extracted. Similarly, gabor-wavelet, gray level co-occurrence matrix (GLCM), gray level difference matrix (GLDM) and principal component analysis (PCA) based feature extraction methods are applied on iris data. The final feature vector is obtained from MIT-BIH and IIT Delhi Iris dataset which is trained and tested by using CNN-LSTM. The experimental analysis shows that the proposed approach achieves average accuracy, precision, and F1-core as 0.985, 0.962 and 0.975, respectively.

Passwordless Authentication Using FIDO Server

The emphasis of the discussion will be on a passwordless login approach using the FIDO protocol and Ping Federate standard to resolve the security consequences linked to the password-based authentication.

A Building Model for Enhancing Information Systems Security

Today, electronic systems and information have become no less important than food and water for human life. No one can deny this fact. Electronic information systems contribute to the development of life in many areas. But some electronic information systems should not be available for anyone to use, such as reading, operating, modifying or destroying without permission. This type of electronic information systems must be protected in some way based on the related situation. . Password-based authentication is the first defense for most information systems. Password security enhances the security of the entire information system. Therefore, password protection models become very important in such cases to help users improve authentication security. Researchers published various methods based on salting, hashing, symmetric encryption, and key splitting methods. The paper conducted by Saleh Al-Asali describes a method for generating a suitable secret key that is easy to memorize and remember, as he succeeded in generating a password that is strong and easy to remember. This paper improves the previous method by adding some improvements mentioned in the section described in the suggested method.

Keyboard Data Protection Technique Using GAN in Password-Based User Authentication: Based on C/D Bit Vulnerability.

In computer systems, user authentication technology is required to identify users who use computers. In modern times, various user authentication technologies, including strong security features based on ownership, such as certificates and security cards, have been introduced. Nevertheless, password-based authentication technology is currently mainly used due to its convenience of use and ease of implementation. However, according to Verizon's "2022 Data Breach Investigations Report", among all security incidents, security incidents caused by password exposures accounted for 82%. Hence, the security of password authentication technology is important. Consequently, this article analyzes prior research on keyboard data attacks and defense techniques to draw the fundamental reasons for keyboard data attacks and derive countermeasures. The first prior research is about stealing keyboard data, an attack that uses machine learning to steal keyboard data to overcome the limitations of a C/D bit attack. The second prior research is an attack technique that steals keyboard data more efficiently by expanding the features of machine learning used in the first prior research. In this article, based on previous research findings, we proposed a keyboard data protection technique using GAN, a Generative Adversarial Network, and verified its feasibility. To summarize the results of performance evaluation with previous research, the machine learning-based keyboard data attack based on the prior research exhibited a 96.7% attack success rate, while the study's proposed method significantly decreased the attack success rate by approximately 13%. Notably, in all experiments, the average decrease in the keyboard data classification performance ranged from a minimum of -29% to a maximum of 52%. When evaluating performance based on maximum performance, all performance indicators were found to decrease by more than 50%.

THREE LEVEL SECURITY AUTHENTICATION IN ONLINE BANKING

Authentication, security, and confidentiality are some of the most important topics of cyber security. There have been many solutions presented to users for strengthening the security of login password-based authentication methods. Primarily this has been through the use of two-factor authentication methods. Two-factor authentication is the combination of single factor authentication mechanisms. The growing popularity and acceptance of two-factor methods are driven by the increasing need for privacy and security in this technological age. The success and popularity of adapted security measures are largely dependent on their ease of implementation and convenience to the user. The focus of this research is to address and analyze the implications of using a three-factor authentication model for added security in websites and mobile apps. This paper will present an app we created which could provide a potential method for three-factor authentication that could potentially ensure added authentication assurances without loss of convenience.

A statistical Markov-based password strength meter

Although multi-factor authentication is gaining popularity, password-based authentication remains the most commonly employed method for both online login and data encryption. To help users choose secure passwords, password strength meters (PSMs) are a well-known and important tool. However, many PSMs still use simple rule sets or rely on heuristic results. With the continuous development of password-cracking methods, it is difficult for such PSMs to provide accurate assessment results. In this paper, we present a new PSM based on statistical results from a huge number of leaked passwords. The proposed method has a very simple structure, requires only a small amount of storage space, and succeeds in providing reliable feedback in real time. We also confirm the influence of linguistic features on user-created passwords and, therefore, recommend evaluating passwords based on the users’ language.

Implementacija dvofaktorske autentifikacije u računarskim sistemima

Introduction/purpose: The paper explores the implementation of two-factor authentication (2FA) in computer systems, addressing the increasing need for enhanced security. It highlights the vulnerabilities of password-based authentication and emphasizes the advantages of 2FA in mitigating digital threats. The development of the VoiceAuth application, integrating 2FA through a combination of password and voice authentication, serves as a practical illustration. Methods: The research adopts a three-tier architecture for the VoiceAuth application, encompassing a database, server-side REST API, and client-side single-page application. Speaker verification is employed for voice authentication, analyzing elements like pitch, rhythm, and vocal tract shapes. The paper also discusses possibilities for future upgrades, suggesting enhancements such as real-time voice verification and additional 2FA methods. Results: The application's implementation involves a detailed breakdown of the REST API architecture, Single Page Applications (SPAs), and the Speaker Verification service. Conclusion: The research underscores the crucial role of two-factor authentication (2FA) in bolstering the security of computer systems. The VoiceAuth application serves as a practical demonstration, showcasing the successful integration of 2FA through a combination of password and voice authentication. The modular architecture of the application allows for potential upgrades.

Evolution and State of the Art in Password Storage

Passwords have historically been pivotal for access control and authentication, yet their security remains a recurring concern in today’s digital world. As evidenced by high-profile data breaches, secure password storage has always been paramount, but often not achieved. While users grapple with the creation of strong, memorable passwords, the burden also falls on service providers to store these passwords securely. Even though alternative authentication mechanisms have emerged, password-based authentication remains pervasive. Surprisingly, studies highlight that developers frequently exhibit misconceptions or negligence towards password storage security. This paper traces the progression of password storage methods by explaining four password hashing methods. By informing of four modern password storage systems, this work seeks to bridge the knowledge gap, advocating for better practices and illuminating the significance of prioritizing security alongside functionality.

THE LANDSCAPE OF AUTHENTICATION SYSTEMS: A COMPREHENSIVE SURVEY

Nowadays, authentication systems are extremely important in many aspects of digital life. They help to protect personal and confidential data from unauthorized access. authentication systems are effective ways to prevent hacking and fraud attacks. Also, They are crucial in ensuring digital security and protecting sensitive data in our connected world. The authentication can be done in multiple ways, one of which is using a password, such system is called a password-based authentication system. Password is the basic and most common method of authentication. This paper overviews the authentication systems, types, and objectives and mentions each type's disadvantages, advantages, and problems. The paper then highlights the text password authentication system, its weak points, and attacks they are exposed to, in addition to developing means and methods to increase the strength of passwords so that they can overcome the attacks they face. The paper provides a good background for anyone who wants to start in this field, as it gives a detailed idea of the systems used, making it easier for the reader to choose the authentication system to desire

A portable blind cloud storage scheme against compromised servers

Applications (Apps) generate large amounts of data on users’ storage-limited local devices. To alleviate the burden of local storage, users can outsource their App-generated data to a remote cloud server. Secure data outsourcing needs data portability and blindness. The former enables users to access data from multiple devices using a single password, and the latter ensures data privacy against unauthorized individuals. Portable blind cloud storage (PBCS) can satisfy both requirements. However, existing PBCS schemes are vulnerable to offline password guessing attacks (OPGA) if both the App server and the cloud server are compromised: an adversary can learn users’ passwords from compromised registered information of users. In this paper, we propose a PBCS scheme called IPBCS that is secure against OPGA. In IPBCS, a user hardens her/his password with a secret key, which is stored in trusted execution environments (TEE). With the hardened password and a user-specific randomness, a token can be derived for user authentication. By adopting TEE to protect secret keys, IPBCS guarantees security against OPGA even if both servers are compromised. Moreover, IPBCS adopts a password-based authentication mechanism to support authentication over public channels. Security analysis and performance evaluation demonstrate that IPBCS is secure and efficient.

Efficient and anonymous password-hardened encryption services

Password-based authentication and encryption schemes are commonly employed to ensure data privacy. Nevertheless, these schemes are vulnerable to brute-force attacks, as user passwords have low-entropy. Password-hardened encryption (PHE) was proposed to combat brute-force attacks by introducing an external crypto service to enforce rate limiting for user requests. However, existing PHE schemes fail to provide user anonymity and need to rely on computationally expensive cryptographic primitives (e.g. zero-knowledge proofs and exponentiations). In this paper, we introduce cross-epoch anonymity in PHE to trade off rate limiting and per-user anonymity. The user requests within the same epoch can be linked by the external crypto service to enforce rate limiting and defend against brute-force attacks, while the requests from different epochs cannot be linked to specific users, ensuring per-user anonymity. Subsequently, we propose an anonymous PHE (APHE) scheme that leverages the trusted execution environment provided by Intel SGX to achieve cross-epoch anonymity. Our scheme achieves both soundness and strong soundness without using zero-knowledge proofs and exponentiations. Sensitive operations are executed within the trusted execution environment, leading to significant performance improvements. The evaluation results demonstrate that our scheme outperforms the state-of-the-art PHE scheme with more than 12/9 times lower latencies for encryption/decryption.

Using language-specific input methods and pronunciation rules to improve the guesses of passwords

Password-based authentication has the advantage of easy implementation and no requirement for additional hardware; therefore, it will remain one of the primary identification methods in the near future. However, users tend to choose passwords that are easy to remember, so these passwords may be vulnerable to guessing attacks. Based on the idea that some users are influenced by their native language when choosing passwords, we propose an improved password-guessing method that adds grammars regarding Asian-language input procedures and pronunciation rules to the most updated Probabilistic Context-Free Grammar (PCFG) v4.1. The experimental results show that the improved PCFG v4.1 can increase the success rate of password cracking compared to PCFG v4.1. The improvements range from 2% to 14% for different password datasets. Additionally, we compare the proposed method to many other guessing methods; ours can achieve an excellent performance. Moreover, the characteristics of passwords that are not cracked are analyzed, and we suggest some criteria for more robust passwords.

An Advanced Knowledge Based Graphical Authentication Framework with Guaranteed Confidentiality and Integrity

The information and security systems largely rely on passwords,which remain the fundamental part of any authentication process. The conventional authentication method based on alphanumerical username and password suffer from significant disadvantages. The graphical password-based authentication system has recently been introduced as an effective alternative. Although the graphical schemes effectively generate the passwords with better flexibility and enhanced security, the most common problem with this is the shoulder surfing attack. This paper proposes an effective 3D graphical password authentication system to overcome such drawbacks. The system is based on the selection of click points for generating passwords. The proposed work involved a training phase for evaluating the model in terms of the success rate. The overall evaluations of the model in terms of password entropy, password space, login success rates, and prediction probability in the shoulder surfing and guessing attacks proved that the model is more confidential and maintains a higher range of integrity than the other existing models.