Password Generation Research Articles

IJARCCE - Computer and Communication Engineering

Online and Enterprise resources typically required authentication before user allow to access the sensitive applications and information. Sensitive information generally contains user personal information, transactions, confidential data, etc. Traditional user authentication system used user identifier, Password, Personal Identification Number (PIN), Token code etc. These Systems can't fulfil the current requirement of the user authentication. So that most of the system used multilevel and multifactor authentication mechanism to allow authorized user to get access the sensitive application and information. Recently such multilevel and multifactor security is provided using Risk Based Authentication (RBA) mechanism. The RBA provides access based on Enforcement policy and access decision based on the risk score. Due to which RBA mechanism provides a more secure way to access the sensitive application and information by the user. In this paper, we will propose RBA mechanism based on User's machine specific authentication information and Dynamic Quick Response (QR) code based One Time Password generation for User step Up Authentication.

Extended results of Norwegian password security survey

Purpose – The purpose of this paper is to extend the results of a Norwegian password security survey. Research, especially in the early 21st century, has shown that education is needed to change people’s behaviour regarding password generation, management and storage. As our daily routines and duties have become more dependent on electronic services in the last decade, one could think that qualitative education is nowadays given to users. This survey is to verify that assumption. Methodology – A nation-wide demographic survey among employees in Norway with a sample of 1,003 respondents at the ages of 18-64 years was conducted in October 2012. Findings – The results show that the education or proper guidance seldom is given leading to the outdated users’ behaviour. Research limitations – The results of the study are limited to the employed only and they do not explain behaviour of students, teenagers or children. Social implications – During the current year, the results of the study have been discussed several times in national media and, hopefully, have an impact to employees’ behaviour. The results have also been used in the National Security Month campaign in October 2013. Originality/value – The questionnaire itself is not unique. However, the large amount of respondents gives higher value to the results.

Microcontrollers as (In)Security Devices for Pervasive Computing Applications

Often overlooked, microcontrollers are the central component in embedded systems which drive the evolution toward the Internet of Things (IoT). They are small, easy to handle, low cost, and with myriads of pervasive applications. An increasing number of microcontroller-equipped systems are security and safety critical. In this tutorial, we take a critical look at the security aspects of today's microcontrollers. We demonstrate why the implementation of sensitive applications on a standard microcontroller can lead to severe security problems. To this end, we summarize various threats to microcontroller-based systems, including side-channel analysis and different methods for extracting embedded code. In two case studies, we demonstrate the relevance of these techniques in real-world applications: Both analyzed systems, a widely used digital locking system and the YubiKey 2 onetime password generator, turned out to be susceptible to attacks against the actual implementations, allowing an adversary to extract the cryptographic keys which, in turn, leads to a total collapse of the system security.

A novel Approach to System Security using Derived Odor Keys with Weight Elimination Neural Algorithm (DOK-WENA)

A novel security technique for network and data communication applications that makes use of odors as password generators is developed and tested. The developed system employs odor keys derived from an original key together with the original key to allow access to systems and networks. The used key combinations are initially unknown to the user, and if detected while in the transmission process, there is no way of being able to be emulated.The uniqueness of the developed system is that it is not necessary for an odor key to be an exact replica of the original, but to be derived from the original. This is a chemical encryption and encoding as the right key will not be detected by anyone since it is a derived version and not a match. Genetic Algorithm is used to emulate the chemical derivation and to make up for any margin of odor detection error and sensors tolerances.

PUF를 이용한 OTP 기반 거래 검증 프로토콜

The One-Time Password(OTP) Generator is used as a multi-factor authentication method to ensure secure transaction during e-Financial transaction in the bank and securities company. The OTP based e-Financial Transaction Verification Protocol ensures secure e-financial transaction through confirming the user's identity using OTP authentication information and counters not only Man-in-the-Browser(MITB) attacks but also memory hacking attacks. However, it is possible to generate correct OTPs due to potential of stealing sensitive information of the OTP generator through intelligent phishing, pharming, social engineering attacks. Therefore, it needs another scheme to prevent from above threats, and this paper proposes advanced scheme using Physical Unclonable Functions(PUFs) to solve these problems. First, it is impossible to generate the same OTP values because of the hysically unclonable features of PUFs. In addition, it is impossible to clone OTP generator with hardware techniques. Consequently, the proposed protocol provides stronger and more robust authentication protocol than existing one by adding PUFs in the OTP generator.

변동형 비밀번호 생성방법 및 이를 이용한 인터넷 인증 시스템에 관한 연구

인터넷 통신의 발전과 함께 다양한 온라인 서비스의 이용이 크게 확대되었고, 이에 따라 사용자를 확인하기 위한 인증 기술의 중요성이 증가되고 있다. 사용자 인증기술로 가장 일반적으로 사용되고 있는 방식은 사전에 약속된 비밀번호를 활용하는 기법이다. 그러나 기존의 비밀번호 인증 방식은 인증 마다 매번 동일한 비밀번호가 사용되기 때문에 공격자에 의하여 비밀번호가 노출되면 악의적으로 이용될 수 있다. 본 논문에서는 사용자가 접속한 날짜, 시간 및 IP 주소와 같은 정보를 이용하여 접속 시 마다 새로운 비밀번호를 생성하는 변동형 비밀번호 생성 방법 및 이를 이용한 인터넷 인증 시스템을 제안하였다. 본 논문에서 제안된 방식은 비밀번호 노출에 따른 개인정보의 유출을 미연에 방지하여 인터넷 인증분야 및 보안시스템 분야에서 신뢰성 및 경쟁력을 향상시킬 수 있고, 전자문서의 확인이나 다양한 분야의 보안 시스템에도 적용할 수 있어, 사용상의 범용성을 향상 시킬 수 있다. With the development of Internet communication and the use of a variety of online services has been greatly expanded. Therefore, the importance of authentication techniques for users of online services has increased. The most commonly used methods for user authentication is a technique that utilizes a prearranged password. However, the existing password scheme for authentication must use the same password every time. Therefore, the password being leaked by attackers, it can be used maliciously. In this paper, we proposed the Variable Password Generation Method in Internet Authentication System that generates a new password using information such as the access date, time, and IP address when user logs in. The method proposed in this paper prevents disclosure of personal information due to password exposure and improves the reliability and competitiveness in the field of security systems.

A SECURE COMMUNICATION IN SMART PHONES USING TWO FACTOR AUTHENTICATION

Most secure systems face security attacks mainly at the client side. Two Factor Authentication (TFA) provides improved protection to the system at the client side by prompting to provide something they know and something they have. This system uses a one time password(OTP) generation method which doesn’t require client-server communication, which frees the system from cost of sending a dynamic password each time the client wants to login. The OTP generation uses the factors that are unique to the user and is installed on a smart phone in Android platform owned by the user. An OTP is valid for a minutes time, after which, is useless. The system thus provides better client level security – a simple low cost method which protects system from hacking techniques like key logging, phishing, shoulder surfing, etc.

MULTI-DIMENSIONAL PASSWORD GENERATION TECHNIQUE FOR ACCESSING CLOUD SERVICES

Cloud computing is drastically growing technology which provides an on-demand software, hardware, infrastructure and data storage as services. This technology is used worldwide to improve the business infrastructure and performance. However, to utilize these services by intended customer, it is necessary to have strong password authentication. At present, cloud password authentication can be done in several ways, such as, textual password, graphical and 3D password. In this paper, we are proposing the strong password generation technique by considering multiple input parameters of cloud paradigm referred as a multidimensional password. This paper presents the multidimensional password generation technique along with architecture, sequence diagrams, algorithms and typical user interfaces. At the end, we derive the probability of breaking our authentication system.

Multi-Dimensional Password Generation Technique for Accessing Cloud Services

Cloud computing is drastically growing technology which provides an on -demand software, hardware, infrastructure and data storage as services. This technology is used worldwide to improve the business infrastructure and performance. However, to utilize these services by intended customer, it is necessary to have strong password authentication. At present, cloud password authenti cation can be done in several ways, such as, textual password, graphical and 3D password. In this paper, we are proposing the strong password generation technique by considering multiple input parameters of cloud paradigm referred as a multidimensional password. This paper presents the multidimensional password generation technique along with architecture, sequence diagrams, algorithms and typical user interfaces. At the end, we derive the probability of breaking our authentication system.

ProActive Approach for Generating Random Passwords for Information Protection

Text based passwords are the most widely used authentication mechanism in multiuser environment. Creating strong password is often a difficult task for users. Multiuser environments employ some password composition policy for users, which require a password containing alphabets (both lowercase and uppercase), numerical digits and special symbols. These policies become obstacle for users in creating good password that satisfies the specific policy. Users favor memorability factor without considering its security against an attacker. Memorability is important because if a user forgets password then usability of the system decreases. This paper presents a ProActive random password generation technique. A random password is generated by inserting random digits and special symbols in a randomly chosen word. Generated password is checked against certain attacker approaches through ProActive analysis. If ProActive analysis results positive then password is discarded and process starts all over again. To help users in memorizing password, both how the password is generated and word used to generate the password is sent.

Low-Power Design of Hardware One-Time Password Generators for Card-Type OTPs

Since card-type one-time password (OTP) generators became available, power and area consumption has been one of the main issues of hardware OTPs. Because relatively smaller batteries and smaller chip areas are available for this type of OTP compared to existing token-type OTPs, it is necessary to implement power-efficient and compact dedicated OTP hardware modules. In this paper, we design and implement a low-power small-area hardware OTP generator based on the Advanced Encryption Standard (AES). First, we implement a prototype AES hardware module using a 350 nm process to verify the effectiveness of our optimization techniques for the SubBytes transform and data storage. Next, we apply the optimized AES to a real-world OTP hardware module which is implemented using a 180 nm process. Our experimental results show the power consumption of our OTP module using the new AES implementation is only 49.4% and 15.0% of those of an HOTP and software-based OTP, respectively.

얼굴 정보 기반 일회용 패스워드 생성 메커니즘을 이용한 사용자 인증 시스템 설계 및 구현

최근 스마트폰을 이용한 인터넷뱅킹, 전자금융 서비스 및 인터넷전화 서비스 등을 이용할 수 있다. 스마트폰을 이용할 경우 보다 강화된 사용자 인증 기능이 제공되어야 한다. 본 연구에서는 스마트폰을 이용하여 각 사용자 얼굴 정보와 같은 바이오메트릭 ID 정보를 이용하여 일회용 패스워드를 생성하는 메커니즘을 구현하였다. 스마트폰내 카메라 모듈을 이용하여 얼굴 이미지를 캡춰하여 서버로 전송하면 서버에서는 일회용 바이오메트릭 ID를 생성하도록 하였다. 그리고 이를 기반으로 클라이언트에서 일회용 패스워드를 생성하는 시스템을 개발하였다. 본 연구에서 제시한 기법을 이용할 경우 스마트폰 기반 SIP 서비스에서의 사용자 인증을 보다 강화할 수 있다. Internet banking, electronic financial services and internet telephony service can be available on smart phone recently. In this case, more robust authentication mechanisms should be provided for enhancing security on it. In this study, a facial biometric ID based one-time password generation mechanism is designed and implemented for enhancing user authentication on smart phone. After capturing a facial biometric data using camera module on smart phone, it is sent to server to generate one-time biometric ID. Finally one-time password will be generated by client module after receiving the one time biometric ID based challenge token from the server. Using proposed biometric ID based one-time password mechanism, it is possible for us to provide more secure user authentication service on smart phone for SIP protocol.

스마트폰에서 음성 정보를 이용한 일회용 패스워드(V-OTP) 기반 사용자 인증 메커니즘 설계 및 구현

음성 정보를 이용한 인증과정을 통해 스마트폰 서비스에서의 보안성을 향상시킬 필요가 있다. 본 연구에서는 스마트폰 사용자의 음성 정보를 이용하여 일회용 패스워드를 생성하는 메커니즘을 설계 및 구현하였다. 서버에서 전송된 PIN 값에 대해 스마트폰내 마이크 장치를 이용하여 음성 데이터를 캡춰하여 서버로 전송하면 서버에서는 검증 과정을 수행하고 일회용 토큰을 생성하도록 하였다. 그리고 클라이언트-서버간 상호 인증 과정 수행 후에 최종적으로 스마트폰 환경에서 음성 정보를 이용하여 일회용 패스워드(V-OTP)를 생성하는 메커니즘을 개발하였다. 본 연구에서 제시한 기법을 이용할 경우 스마트폰 기반 서비스에서의 사용자 인증을 보다 강화할 수 있다. It is necessary for us to enhance the security service on smart phone by using voice data on authentication procedure. In this study, a voice data based one-time password generation mechanism is designed and implemented for enhancing user authentication on smart phone. After receiving a PIN value from the server, a user inputs his/her own voice biometric data using mike device on smart phone. And then this captured a voice biometric data will be used to generate one-time token on server side after verification procedures. Based on those mutual authentication steps, a voice data based one-time password(V-OTP) will be generated by client module after receiving the one-time token from the server finally. Using proposed voice one-time password mechanism, it is possible for us to provide more secure user authentication service on smart phone.

Password Education Based on Guidelines Tailored to Different Password Categories

General password policies do not guarantee that passwords fulfilling the requirement are good enough. The policies have a tendency to be too broad to be useful for all users. Different users have different designing processes based on what kind of passwords they most easily remember. Users are also often left to generate passwords on their own without any training. In our study we used new password creation guidelines when teaching students password secu- rity. We divided passwords into three password categories: Word password, Mixture password and Non-word password. For each category different password generation guidelines were taught to students. Students had access to the password quality measurement tool, which not only measured the strength of the password but also guided students in the generation process. Our goal is to measure the effect of education on the strength of a password and analyze recall rates of the passwords created by the new guidelines. It is shown that education had a positive effect and that pass- words became stronger right after the education. The most important result is that a password structure got changed as the variation of structures increased and different structure types were more evenly distributed. However, after half a year without reminders or education repetition, most of the positive effect was lost. While password structures still differed, they had become less complex as participants had given up using special characters. Recall rates of the passwords generated with new guidelines are good.

Technology Corner: Brute Force Password Generation -- Basic Iterative and Recursive Algorithms

Most information systems are secured at minimum by some form of password protection. For various reasons a password may be unavailable, requiring some form of password recovery procedure. One such procedure is software-based automated password recovery, where a program attempts to log into a system by repeatedly trying different password combinations. At the core of such software is a password generator. This article describes the basic iterative and recursive algorithms for generating all possible passwords of a given length, which is commonly referred to as brute-force password generation. The paper ends with a discussion of alternative password recovery procedures one should attempt before brute-force password recovery.

A Novel Odor Key Technique for Security Applications Using Electronic Nose System

Problem statement: A novel approach to security applications that makes use of odors as password generators is developed and tested. The developed system detects and converts odor signals that are randomly selected to binary signals and then intelligently compares them with previously stored values. Approach: The interface device in question then either opens its interface if comparison is successful or applies security measures to extra protect resources from intrusion. The used odor keys are initially unknown to the user as it is randomly selected from a box containing many types, adding extra security to the system. This approach eliminated any possibility of hacking into the system and provides passwords which were truly secured. Results: Normal interfacing methods and algorithms were subject to hacking and infiltration. Random odor combinational keys are a novel, well secured biometric interfacing means to a wide range of systems. Design and testing of a practical electronic nose that can be used as a security interface in a wide variety of applications with a combinational odor key algorithm that ensures a hacking free environment. Conclusion/Recommendations: Successful implementation of human-machine interface through a highly secured electronic nose with very encouraging results in terms of possible odor combinations and multi-dimensional password generation.

Effectiveness of image-based mnemonic techniques for enhancing the memorability and security of user-generated passwords

Complex passwords are hard to remember, so people often pick simple passwords, write complex ones down, and reuse the same password across multiple accounts. Proactive password checking (PPC) restrictions and mnemonic techniques can enhance password security and memorability. Participants in this study were assigned to one of three password generation groups: PPC restrictions alone, image-based mnemonic, or text-based mnemonic. They were asked to generate and later recall passwords for five separate fictitious online accounts. The use of mnemonic techniques resulted in the generation of longer and more complex passwords. Furthermore, passwords were more accurately recalled when they were generated using the image-based mnemonic technique or PPC restrictions alone, as opposed to the text-based mnemonic technique. However, passwords generated using PPC restrictions alone were more easily forgotten and susceptible to being cracked. Thus, the image-based mnemonic technique was shown to be the most effective method for generating secure and memorable passwords.

Use of Image-based Mnemonic Techniques to Enhance the Memorability of User-generated Passwords

Participants in this study were assigned to one of three different password generation groups: image-based mnemonic, text-based mnemonic, or proactive password checking restrictions alone; and asked to generate and later recall passwords for five separate fictitious online accounts. Password accuracy and recall time were measured following both a short-term (10-minute) and long-term (1-week) delay. Results indicated that passwords were more quickly generated and accurately recalled when they were generated using the image-based mnemonic technique or proactive password restrictions alone, as opposed to the text-based mnemonic technique. Furthermore, use of the image-based mnemonic technique resulted in the generation of passwords that were more resistant to forgetting. Implications and future research considerations are discussed.

Password Generation and Search Space Reduction

It is easy for humans to design passwords that are easily remembered. However, such passwords may have a predictable structure, making exhaustive search feasible. We have divided human-generated passwords into three categories: Non-word passwords, Mixture passwords, and Word passwords; depending on their overall structure. Within these categories, we have analyzed the search-space reduction of several common password sub-structures. From this analysis, we have derived guidelines that yield strong passwords within in each password category. Our results contribute towards the goal of achieving both strong and memorable passwords.

지문 특징의 준동형 그래프를 이용한 일회용 암호키 생성기법 및 시뮬레이션

본 논문에서는 지문의 특징을 이용한 OTP의 일회용 암호 키를 생성하는 방법을 제안한다. 본 연구는 잘 알려진 강력한 개인 인증요소인 지문 정보를 이용하여 가변적이고 안전한 일회용 암호 키를 생성하였으며, 또한 제안 기법에 대한 dendrogram을 이용한 지문 특징점의 준동형 그래프간의 가변성 그리고 지문 특징점의 분포를 시뮬레이션을 통해 성능을 분석하였다. In this paper, we propose new technique which uses the fingerprint features in order to generate one time passwords(OTPs). Fingerprint is considered to be one of the powerful personal authentication factors and it can be used for generating variable passwords for one time use. Also we performed a simulation of homomorphic graph variable of fingerprint feature point using dendrogram and distribution of fingerprint feature points for proposed password generation method.