Password Guessing Attacks Research Articles

Quantum-safe three-party lattice based authenticated key agreement protocol for mobile devices

Mobile-based web apps have gained popularity among phone devices because of the rapid advancement of mobile communication and equipment capabilities. Users may utilize their handsets to obtain different types of online services through the Internet at any time and from anywhere. The last three decades have seen widespread use of the three-party AKA protocol, built on asymmetric-key cryptography to produce a private communication channel via any cellular connection between two mobile users. The server can help two mobile users with the assistance of a three-party authentication protocol so that they may create a high-entropy shared private session key. According to several recent studies, all the conventional public-key cryptosystem-based three-party AKA schemes could not withstand attacks due to quantum computing. To get resistance to quantum attacks, Islam and Basu (2021) proposed a new password-based three-party authentication protocol for mobile users using ideal lattices. We improve the efficiency of lattice-based authenticated key exchange protocol and the security of this protocol by making it resistant to password-guessing attacks. A comparative study along with performance and security evaluation is also presented, which demonstrates the applicability of the proposed design.

PGTCN: A novel password-guessing model based on temporal convolution network

Text passwords are the primary method for identity authentication. However, easy-to-remember passwords are vulnerable to password-guessing attacks. The study of password-guessing not only enhances the understanding of password security, but also promotes the improvement of password library security. Nowadays, deep learning based models have demonstrated their promising ability for password-guessing, e.g., Recurrent Neural Network (RNN) and its variants. However, RNNs are failed to parallelize and lack long memory, resulting in unsatisfactory guessing efficiency and effectiveness. Aiming to generate a high-quality password dictionary for password checking, we propose a temporal convolutional network-based password-guessing model named PGTCN. Specifically, in PGTCN we improve the password-guessing efficiency by introducing the Improved Temporal Convolutional Network (ITCN) which adopts residual learning and feature fusion techniques. PGTCN can automatically study the structure and characteristics of passwords and generate new passwords based on the learned knowledge. To verify the performance of PGTCN, we compare it with state-of-the-art models on six public password datasets. Evaluation results show that the password dictionary generated by the proposed PGTCN achieves the structure coverage rate up to 84%, and boosts the matching rate up to 22%. We conclude that the PGTCN could be regarded as a robust and efficient model for password guessing.

An Effective Privacy-Preserving Blockchain-Assisted Security Protocol for Cloud-Based Digital Twin Environment

Recently, the Digital Twin (DT) technology has procured a lot of attention because of its applicability in the manufacturing and space industries. The DT environment involves the formation of a clone of the tangible object to perform simulations in the virtual space. The combination of conceptual development, predictive maintenance, real-time monitoring, and simulation characteristics of DT has increased the utilization of DT in different scenarios, such as medical environments, healthcare, manufacturing industries, aerospace, etc. However, these utilizations have also brought serious security pitfalls in DT deployment. Towards this, several authentication protocols with different security and privacy features for DT environments have been proposed. In this article, we first review a recently proposed two-factor authentication protocol for DT environments that utilizes the blockchain technology. However, the analyzed scheme is unable to offer the desirable security and cannot withstand various security attacks like offline password-guessing attack, smart card stolen attack, anonymity property, and known session-specific temporary information attack. We also demonstrate that an attacker can impersonate the analyzed protocol’s legal user, owner, and cloud server. To mitigate these security loopholes, we devise an effective three-factor privacy-preserving authentication scheme for DT environments. The proposed work is demonstrated to be secure by performing the informal security analysis, the formal security analysis using the widely recognized Burrows-Abadi-Needham (BAN) logic, and the Real-or-Random (ROR) model. A detailed comparative study with the existing competing schemes including the analyzed scheme demonstrates that the devised framework furnishes better security features while also having lower computation costs and comparable communication costs than the existing schemes.

An Enhanced User Authentication and Key Agreement Scheme for Wireless Sensor Networks Tailored for IoT.

A security protocol for wireless transmission is essential to defend sensitive information from malicious enemies by providing a variety of facilities such as privacy of the user's information, secure session key, associated authentication, and user-repeal facility when a person's authorizations are suddenly disclosed. Singh et al. proposed an improved user authentication and key agreement system for wireless sensor networks (WSNs). Authors are sure that their protocol is secure from various attacks. Here, we find several security pitfalls in their scheme, such as an offline password-guessing attack, failure to protect the session key, and a man-in-the-middle attack. To remove the identified pitfalls found in Singh et al.'s scheme, we design an enhanced authentication scheme for WSNs tailored for IoT. We prove the reliability of our proposed protocol using the real or random (RoR) model. We also evaluate the proposed scheme with the associated schemes and show its superior efficacy as compared to its counterparts.

A Novel Verification Scheme to Resist Online Password Guessing Attacks

User name and password are the most commonly used user authentication scheme in information systems. Strong passwords are secure but difficult to remember, so many users prefer easy-to-remember passwords. These weak passwords are also easily guessed by attackers, leading to online password guessing attacks, posing a serious security threat to information systems. Providing a reliable user authentication scheme to allow legitimate users to login while preventing online password guessing attacks is a challenge. We define a formal statistical model for the behavior of users and attackers, and differentiate users and attackers according to this model. The proposed solution computes the entropy of the passwords entered by the user and considers the user legitimate only if the entropy does not exceed a threshold. We show that entropy is an effective feature to distinguish legitimate users from attackers. We also show that the proposed user authentication scheme is effective in identifying password guessing attacks, even if the user chooses a common password. The new scheme adds an extra layer of protection to passwords, which is especially important for weak passwords. The scheme is a slight modification of the existing scheme, so it can be easily integrated into existing systems.

A Survey on Hadoop Security and Comparative Analysis on Authentication Frameworks in Hadoop Clusters

This paper presents a survey on various security frameworks which aim to secure Hadoop clusters and the files stored there. Most of the Hadoop platforms rely on Kerberos Authentication Protocol for user authentication. It is known that Kerberos itself has some vulnerabilities like Password Guessing Attacks, Single Point of Failure, Insider Attacks, and Time Synchronization problems. A new authentication framework that can address most of the identified issues and is computationally feasible than other schemes is introduced in this paper. The proposed framework is based on Secure Remote Password Protocol (SRP), Threshold Cryptography, and Blockchain Technology. The system focus on eradicating Password Guessing Attacks and Single Point of Failure in Kerberos Enabled Hadoop Clusters. The analysis results strengthen the claim that the proposed scheme beats the others in terms of computational efficiency and feasibility while offering the same security features. The paper is concluded with directions for future work.

An efficient two-factor authentication scheme based on negative databases: Experiments and extensions

With the rapid development of network communication technology, identity authentication based on smart cards is one of the most common two-factor authentication schemes. In some real-world applications, timeliness is another challenge besides security and privacy because of the frequent logon and logoff or data updating. Presently, two-factor authentication schemes based on elliptic curve cryptography (ECC) are efficient. They are based on asymmetric encryption algorithms. But the time efficiency can be improved by hash-based methods, such as Negative databases (NDB) inspired by the artificial immune system. A one-time password authentication scheme based on NDBs is efficient, but it does not achieve the functions of mutual authentication and password changing, nor resists stolen-verifier attacks.In this paper, we propose an efficient two-factor authentication scheme based on NDBs. With this scheme, the password changing function is achieved, and the properties of uncertain form of negative databases can reduce the frequency of data updating. As the proposed scheme is a hash function based one, it has fewer calculation steps and higher time efficiency, compared with the authentication schemes based on asymmetric encryption algorithms such as ECC. This scheme also resists the majority of attacking behaviours, such as password-guessing attacks and man-in-the-middle attacks. Experimental results verify the time efficiency of this proposed scheme, and its security is analysed as well.

Password-Guessing Attack-Aware Authentication Scheme Based on Chinese Remainder Theorem for 5G-Enabled Vehicular Networks

The new fifth-generation (5G) cellular networks dramatically improve the speed of message transmissions. Most existing authentication schemes that secure 5G communication rely heavily on the vehicle’s tamper-proof device (TPD) and roadside units (RSUs) to store the system’s master key. However, it only takes a single compromised TPD to render the whole system insecure. We propose a password-guessing attack-aware authentication scheme based on the Chinese Remainder Theorem (CRT) to secure inter-vehicle communication on 5G-enabled vehicular networks to address this issue. The trusted authorities (TAs) in the proposed scheme generate and broadcast new group keys to the vehicles assisted by CRT. Moreover, since the system’s master key does not need to be preloaded, the proposed scheme only requires realistic TPDs. The proposed scheme overcomes password-guessing attacks and guarantees top-level security for entire 5G-enabled vehicular networks. The security analysis indicates that the proposed scheme is secure against adaptive chosen-message attacks under the random oracle model and meets the security requirements of a 5G-enabled vehicular network. Since cryptographic operations based on elliptic curve cryptography are employed, the performance evaluation shows that the proposed scheme outperforms the eight existing schemes in terms of computation and communication costs.

SMASG: Secure Mobile Authentication Scheme for Global Mobility Network

The rapid growth of the Internet of Things (IoT) has enabled prompt services over mobile devices. The Global Mobility Network (GLOMONET) is an important global network that allows mobile users to access the Internet anywhere. Although implementing a secure mechanism in GLOMONET is a difficult and complex task due to the computational and processing limitations of most mobile devices, an authentication system is vital for secure communications among such mobile devices. In 2021, Rahmani <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> proposed an authentication method, called the advanced mobile authentication protocol for GLOMONET (AMAPG). However, we found three serious vulnerabilities in AMAPG. First, AMAPG contains large amounts of information on the smart card of the mobile phone. Therefore, they are vulnerable to attacks that steal critical information. Second, it is susceptible to password-guessing attacks. Third, AMAPG cannot guarantee the security of future messages because attackers can steal the session key. In this study, we discuss the weaknesses of AMAPG and propose a new three-factor authentication scheme called the secure mobile authentication scheme for GLOMONET (SMASG). We performed informal and formal security analyses using ProVerif and BAN Logic on SMASG. In addition, we analyzed and compared its performance with that of the latest GLOMONET-based authentication schemes. SMASG saves an average of 93% time in user login and authentication phase.

The count-min sketch is vulnerable to offline password-guessing attacks

The count-min sketch is vulnerable to offline password-guessing attacks

The count-min sketch is vulnerable to offline password-guessing attacks

The count-min sketch is vulnerable to offline password-guessing attacks

ES-HAS: ECC-Based Secure Handover Authentication Scheme for Roaming Mobile User in Global Mobility Networks

The design and implementation of two-factor schemes designed for roaming mobile users for global mobility networks in smart cities requires attention to protect the scheme from various security attacks, such as the replay attack, impersonation attack, man-in-the-middle attack, password-guessing attack and stolen-smart-card attack. In addition to these attacks, the scheme should achieve user anonymity, unlinkability and perfect forward secrecy. In the roaming scenario, as mobile users are connected to the foreign network, mobile users must provide authentication details to the foreign network to which they are connected. The foreign network forwards the authentication messages received from the mobile users to their home network. The home network validates the authenticity of the mobile user. In the roaming scenario, all communication between the three entities is carried over an insecure channel. It is assumed that the adversary has the capabilities to intercept the messages transmitted over an insecure channel. Hence, the authentication scheme designed must be able to resist the above-mentioned security attacks and achieve the security goals. Our proposed scheme ES-HAS (elliptic curve-based secure handover authentication scheme) is a two-factor authentication scheme in which the mobile user possesses the password, and the smart card resists the above-mentioned security attacks. It also achieves the above-mentioned security goals. We also extended our two-factor authentication to a multi-factor authentication scheme using the fingerprint biometric technique. The formal security analysis using BAN logic and the formal security verification of the proposed scheme using the widely accepted AVISPA (automated validation of internet security protocols and applications) tool is presented in this article. In comparison with the related schemes, the proposed scheme is more efficient and robust. This makes the proposed scheme suitable for practical implementation.

An Efficient ECC-Based Authentication Scheme against Clock Asynchronous for Spatial Information Network

With the rapid development of mobile communication technology, the spatial information networks (SIN) have been used for various space tasks’ coverage in commercial, meteorology, emergency, and military scenarios. In SIN, one basic issue is to achieve mutual authentication and secret communication among the participants. Although many researches have designed authentication schemes for SIN, they have not considered the situation where the clock is not synchronized as the broad coverage space in wireless environment. In this paper, we disclose several flaws of Altaf et al.’s scheme (2020), in which the main weakness is that a malicious user can easily obtain the master key of the network control center after launching the offline password-guessing attack. Then, we design an authentication scheme against clock asynchronous for SIN by utilizing elliptic curve cryptosystem (ECC) and identity-based cryptography (IBC). Based on a brief introduction to the main design ideas of our scheme, the security protocol analysis tools of Scyther and AVISPA are used to prove that the scheme can resist various existing active and passive attacks. We further discuss our scheme that provides five essential requirements of security properties to design a robust scheme for SIN and is superior in terms of resistance to security functionality and computational performance by comparison with two other representative schemes. As a result, our scheme will be workable and efficient security for mobile users in the actual environment.

Chebyshev Polynomial-Based Authentication Scheme in Multiserver Environment

Nowadays, communication technologies are more and more strongly advanced, such as 4G or 5G. There are many useful online applications, and one of them is the telecare medical information system (TMIS). If the TMIS is widely deployed, patients and doctors will have more frequently connection. Clearly, this enhances our quality of life. One of the most important modules securely constructing this convenient TMIS is the user-authentication scheme. We should prevent user identity and related information from the adversary’s eavesdropping. Therefore, the authentication scheme could provide user anonymity and concern some kinds of attacks, such as impersonation or password-guessing attacks. Common solutions are a combination of hash function and public-key cryptosystem (RSA or elliptic curve cryptosystem, ECC), but current schemes do not consider identity protection as one main task necessary for medical information environment. In this paper, our results consist of some important analyses of previous works and a multiserver user-authentication scheme suitable for TMIS using Chebyshev polynomial with two models: random oracle and BAN-logic.

StopGuessing: Using Guessed Passwords to Thwart Online Password Guessing

Practitioners who are seeking to defend against online password-guessing attacks usually find a shortage of techniques. We present an open source system to defend against password-guessing attacks using information ignored previously: the guessed passwords themselves. We examine passwords to detect and are more forgiving of login failures caused by users mistyping their passwords.

Analyzing the usage of character groups and keyboard patterns in password creation

PurposeUsing passwords to keep account and data safe is very common in modern computing. The purpose of this paper is to look into methods for cracking passwords as a means of increasing security, a practice commonly used in penetration testing. Further, in the discipline of digital forensics, password cracking is often an essential part of a computer examination as data has to be decrypted to be analyzed. This paper seeks to look into how users that actively encrypt data construct their passwords to benefit the forensics community.Design/methodology/approachThe study began with an automated analysis of over one billion passwords in 22 different password databases that leaked to the internet. The study validated the result with an experiment were passwords created on a local website was analyzed during account creation. Further a survey was used to gather data that was used to identify differences in password behavior between user that actively encrypt their data and other users.FindingsThe result of this study suggests that American lowercase letters and numbers are present in almost every password and that users seem to avoid using special characters if they can. Further, the study suggests that users that actively encrypt their data are more prone to use keyboard patterns as passwords than other users.Originality/valueThis paper contributes to the existing body of knowledge around password behavior and suggests that password-guessing attacks should focus on American letters and numbers. Further, the paper suggests that forensics experts should consider testing patterns-based passwords when performing password-guessing attacks against encrypted data.

Improved Chebyshev Polynomials-Based Authentication Scheme in Client-Server Environment

With nonstop development of communication technologies, all aspects of social life continuously change and so do network systems. When establishing connection is easy, the convenience of online-service receives many users’ attentions, for example, the patients directly access medical system to be advised by doctors at any time. Therefore, user authentication scheme is necessary when we want to provide privacy and security for working sessions. Storing a password list for verification is an old method and not secure. This list can be easily leaked, and adversary can launch an offline password-guessing attack. In addition, information exchanged between user and server needs being prevented from attacker’s decryption. It can be said that current authentication schemes are unsuitable for new security standard. We need a strong user authentication scheme using new approach to overcome existing limitations and guarantee time efficiency. In this paper, we make a design with Chebyshev polynomial to achieve our goals and resist some kinds of attacks.

An improved authentication protocol–based dynamic identity for multi-server environments

The age of Internet of things gives rise to more challenges to various secure demands when designing the protocols, such as object identification and tracking, and privacy control. In many of the current protocols, a malicious server may cheat users as if it was a legal server, making it vital to verify the legality of both users and servers with the help of a trusted third-party, such as a registration center. Li et al. proposed an authentication protocol based on dynamic identity for multi-server environment, which is still susceptible to password-guessing attack, eavesdropping attack, masquerade attack, and insider attack etc. Besides, their protocol does not provide the anonymity of users, which is an essential request to protect users’ privacy. In this article, we present an improved authentication protocol, depending on the registration center in multi-server environments to remedy these security flaws. Different from the previous protocols, registration center in our proposed protocol is one of parties in authentication phase to verify the legality of the users and the servers, thus can effectively avoid the server spoofing attack. Our protocol only uses nonce, exclusive-OR operation, and one-way hash function in its implementation. Formal analysis has been performed using the Burrows–Abadi–Needham logic to show its security.

A study on user authentication and key agreement protocol in wireless sensor network

Background/Objectives: The user authentication and key agreement protocol proposed by Jung et al., which is suitable for a wireless sensor network environment is vulnerable to an attack in which a user who is issued a smart card from the gateway, completing the registration step disguises as a random user.Methods/Statistical analysis: This study proposed a method of improving the problem of the security technique proposed by Jung et al., which is vulnerable to a user impersonation attack. This method uses the variable that recorded the times of a user’s request for registration to the gateway in the registration step in which the user is registered to the gateway and a smart card is issued and the login step in which the user issued the smart card is authenticated as a legitimate user.Findings: The security technique proposed in this study consists of four steps, same as the security technique of user authentication and key agreement proposed by Jung et al. In the first step, the registration step, if a user requests for registration to the gateway, the variables that recorded the times of the user’s request for registration (User: Un and Gateway: Gn) are renewed and stored respectively by the user and the gateway. Once the registration step is completed, the user who got a smart card issued from the gateway is authenticated as a legitimate user in the login step, using the issued smart card, ID, password and Un. When the login step is completed, in the third step, the authentication step, the authentication procedures are carried out for the gateway and the sensor node.An attacker obtains a user’s information through various attacks, such as smart-card loss attack, ID-guessing attack or password-guessing attack and attempts the login step, using the obtained information. However, the technique proposed in this study needs the variable that recorded the times of the user’s request for registration to the gateway in addition to a smart card, ID and password to proceed with user authentication in the login step. This variable is a value that only the user and the gateway know, not transmitted in any steps. The attacker who does not know the times of requests for registration cannot proceed with the login step, and the attacker cannot be authenticated as a legitimate user without proceeding to the login step. Thus, the user authentication and key agreement protocol proposed in this study is safe from an attacker’s attack of impersonation as a user.Improvements/Applications: This study proposed a technique of using the variable that recorded the times of the user’s request for registration to the gateway, managed and stored only by the user and the gateway, not transmitted in any steps in user authentication. The proposed technique is safe from an attacker’s attack of impersonation as a user.

Advanced formal authentication protocol using smart cards for network applicants

The rapid growth of internet technologies has provided various functions that allow easy remote user or customer access to its many systems. However, the responsibility of the system does not end after providing access to such remote users. The framework must consummate a precise level of security, because otherwise, an adversary may be able to disrupt the system or use its resources without authorization. This affects the system and its clients directly or obliquely, and to restrict access, an authentication scheme must be implemented. Recently, Nikooghadam et al. proposed an authentication and key agreement protocol and illustrated how it would be secure against various types of security attacks. In this study, we show that their proposed system is susceptible to insider, replay, and password-guessing attacks. We propose a more secure authentication system that can withstand discrete attacks, and measure the total execution time to determine what realistic implementation is needed to carry out an entire scheme.