Secure Authentication Method Research Articles

Shortcomings of the Bharatiya Sakshya Adhiniyam, 2023: Challenges for Courts, Prisons, and Police

The Bharatiya Sakshya Adhiniyam, 2023 (BSA) replacing the Indian Evidence Act, 1872 (IEA) introduces several new provisions that create challenges for courts, prisons, and police, impacting their operational efficiency. The increased focus on electronic evidence in judicial proceedings raises worries about the authenticity of digital records and the dependability of electronic testimony, which can easily be subject to manipulation and tampering. Moreover, the law's unclear provisions regarding the admissibility of electronic evidence add to the complexity of its application. Courts, Prisons and Police Units need infrastructural enhancements to support remote monitoring, which necessitates substantial financial investments in video conferencing technology and cyber security measures. For law enforcement agencies, the BSA calls for improved digital forensics capabilities and stricter protocols for evidence gathering in course of investigation, leading to additional administrative and logistical burdens. These deficiencies highlight the urgent need for secure authentication methods, ongoing updates to the legal framework, and increased technological investment to safeguard the integrity of digital evidence. Failing to address these issues could compromise the effectiveness and credibility of the justice system.

Blockchain Based Decentralized Storage Drive

The "Decentralized Storage Drive" project introduces a secure, blockchain-based platform for decentralized data storage and sharing. By integrating the Interplanetary File System (IPFS) for decentralized storage, the platform ensures that data remains immutable and resistant to censorship. Solidity smart contracts deployed on the Ethereum blockchain provide robust mechanisms for access control, allowing users to manage data ownership and permissions without relying on centralized authorities. A React-based front- end interface simplifies user interaction, enabling seamless data upload and access management. This project addresses critical issues related to data privacy, security, and ownership, offering a user-friendly solution that empowers individuals with greater control over their digital assets. Throughout the development of this project, a focus on security, user control, and decentralization has been paramount. The rigorous testing of smart contracts and the integration of secure authentication methods ensure that the platform is both reliable and resilient to potential threats. The "Decentralized Storage Drive" represents a significant advancement in the field of decentralized applications, demonstrating the practical application of blockchain technology in everyday data management. Key Words: Decentralized Storage, Blockchain Technology, IPFS(InterPlanetary File System), Smart Contracts, Data Integrity, Access Control

Enhancing Data Warehouse Security: An Encrypted Cued-Click-Points Authentication Approach

Text passwords and other traditional security measures have been the mainstay of current data warehouse content security techniques. Due to the growing computational capability of information systems, security requirements, especially for the selection of secure text passwords, have changed throughout time. Because database administrators are either unaware of these changes or are overburdened by the magnitude of the adjustments necessary to remedy them, these vulnerabilities are typically invisible to them. As a result, research on usable authentication schemes have picked up steam, with the goal of developing a secure authentication method using cued click points and encryption techniques for accessing a hybrid data warehouse. This scheme aims to enhance the security of data access by combining the unique characteristics of cued click points with encryption to create a robust authentication system. The project will involve designing and implementing the authentication scheme, testing its effectiveness in a hybrid data warehouse environment, and evaluating its performance in terms of security and usability. Overall, the project aims to provide a secure and user-friendly authentication solution for accessing sensitive data in a hybrid data warehouse setting. This scheme utilizes a combination of encryption techniques and user-specific click points to verify user identity and access to the data warehouse. It also discusses the potential benefits of this authentication scheme in terms of data security and user experience.

Design of Robotics Implementation of A Fingerprint Biometric System

Biometrics, rooted in the Greek terms "bios" (life) and "metrikos" (measure), represents a modern approach to identifying individuals based on their unique physical characteristics, such as fingerprints, facial features, and iris patterns. In today's increasingly digital landscape, traditional security methods like passwords and keys have become inadequate in safeguarding sensitive information. The rise of sophisticated cyberattacks and unauthorized access has highlighted the need for more advanced and secure authentication methods. This project aims to design and implement a fingerprint biometric system using robotics and FPGA technology. The system is intended to provide a more reliable and secure method of verifying identities by capturing and processing fingerprint images. It will extract minutiae points, the unique features within a fingerprint, to create a robust authentication mechanism. This approach promises to enhance security by offering an alternative to conventional methods that are often vulnerable to breaches. In developing this biometric system, the focus will be on ensuring that it can be effectively integrated into various applications where secure access control is crucial. By leveraging the unique and immutable nature of fingerprints, the system will reduce the risks associated with password reuse, theft, and unauthorized sharing. The inclusion of continuous authentication techniques will further strengthen security, ensuring that the user’s identity is verified throughout a session, not just at the initial login. Additionally, the project will incorporate version control mechanisms to track the development and deployment of the system, ensuring that any changes or updates can be easily managed and reviewed. This will help maintain the system's reliability and effectiveness over time, allowing it to adapt to evolving security challenges. Through this work, we aim to contribute to the broader adoption of biometric technologies in securing digital and physical environments, paving the way for more secure and seamless user experiences.

Visions of the Future: What Could Happen to User Authentication?

The most prevalent information system security feature for the user is the authentication process. Passwords have been the primary authentication method for decades due to their simplicity for both the user and the system provider. However, over recent years, the digitalization of services has increased the number of credentials each user must manage, making traditional password authentication problematic for the user. Strong candidates for easier and more secure authentication methods are emerging (e.g., FIDO alliance, Single-sign-on, biometrics). Still, a single method has yet to dominate the market due to the rapid changes in technology, costs of implementation, trust in these methods, and the vast number of users and digital services. Due to the varied reasons that affect the adoption of these methods, it is unclear what kinds of authentication methods will be the forerunners in the future. This study aims to envision the future of user authentication and security features emerging from the interaction of different factors. We present a qualitative interview study, which examines six experts from the fields of authentication, cybersecurity, and emerging technologies. A hermeneutic mode of analysis is used to form scenarios of the future based on the observations of different experts. The results reflect an understanding of how users and their interactions with security features, such as authentication, may change over the following decade and beyond and how security professionals intend to incorporate this knowledge into future security systems. The results shed light on the influence of society, developing technology, and the need for user- and future-proof security in the coming years. This study will have several implications, as it will contribute to forming a coherent picture of the different elements that shape the future and give an idea of how to prepare for what is coming. Furthermore, it will provide an understanding of how choices with technology today lead to different futures.

Retraction Note: Efficient identity security authentication method based on improved R-LWE algorithm in IoT environment

This article has been retracted. Please see the Retraction Notice for more detail: https://doi.org/10.1186/s13635-024-00153-8.

Security Considerations in iOS App Development: Encryption, Authentication, and Secure Data Storage

Abstract: Security is a paramount concern in iOS app development, as sensitive user data must be protected from unauthorized access and breaches. This scholarly article explores essential security measures, focusing on encryption protocols, authentication mechanisms, and secure data storage techniques specific to iOS platforms. By examining industry-standard encryption algorithms, secure authentication methods, and best practices for data storage, this study aims to provide developers with the knowledge and tools necessary to build robust and resilient iOS applications. Real-world case studies and practical implementation guidelines are presented to illustrate the effective application of these security measures. The findings emphasize the importance of adopting a comprehensive security approach to foster user trust and confidence in mobile applications

ABCD Analysis of Voice Biometric System in Banking

Purpose: This article aims to provide an overview of the voice biometric system in banking and its benefits using the ABCD analytical methodology. Voice biometric systems in banking are pivotal for improving customer experiences, effortlessly integrating into various service channels like call centers and mobile apps. This article provides advantages, benefits, constraints and disadvantages (ABCD) analysis of the voice biometric offerings for banking sector. Design/Methodology/Approach: The research examined published papers through the ABCD analysis framework, employing quantitative analysis within focus group interactions to uncover crucial attributes and variables that impact consumers' intentions to implement voice biometric system in banking system. This process yielded valuable insights. Findings/Result: The ABCD analytical approaches of voice biometric systems in banking indicates the enhanced customer satisfaction and streamline operations through their diverse functionalities. When integrated into the bank's multi-factor authentication framework, voice biometric systems serve as a non-intrusive yet highly secure authentication method. They offer a seamless customer experience by eliminating the need for traditional PINs or passwords, reducing the risk of unauthorized access, and bolstering overall system security. The implementation of voice biometric systems in the banking sector provides several key benefits. Originality/Value: Utilizing the ABCD analysis approach, this research examines the inclination of consumers to activate the voice biometric systems in banking. The investigation delves into consumer behavior and the elements that impact usage decisions, employing determinant issues, key attributes, factor analysis, and elementary analysis. Paper Type: Empirical Analysis

RETRACTED ARTICLE: Efficient identity security authentication method based on improved R-LWE algorithm in IoT environment

In recent years, various smart devices based on IoT technology, such as smart homes, healthcare, detection, and logistics systems, have emerged. However, as the number of IoT-connected devices increases, securing the IoT is becoming increasingly challenging. To tackle the increasing security challenges caused by the proliferation of IoT devices, this research proposes an innovative method for IoT identity authentication. The method is based on an improved ring-learning with errors (R-LWE) algorithm, which encrypts and decrypts communication between devices and servers effectively using polynomial modular multiplication and modular addition operations. The main innovation of this study is the improvement of the traditional R-LWE algorithm, enhancing its efficiency and security. Experimental results demonstrated that, when compared to number theory-based algorithms and elliptic curve cryptography algorithms at a 256-bit security level, the enhanced algorithm achieves significant advantages. The improved algorithm encrypted 20 data points with an average runtime of only 3.6 ms, compared to 7.3 ms and 7.7 ms for the other algorithms. Similarly, decrypting the same amount of data had an average runtime of 2.9 ms, as opposed to 7.3 ms and 8 ms for the other algorithms. Additionally, the improved R-LWE algorithm had significant advantages in terms of communication and storage costs. Compared to the number theory-based algorithm, the R-LWE algorithm reduced communication and storage costs by 3 °C each, and compared to elliptic curve cryptography, it reduced them by 4 °C each. This achievement not only enhances the efficiency of encryption and decryption but also lowers the overall operational costs of the algorithm. The research has made significant strides in improving the security and efficiency of IoT device identity authentication by enhancing the R-LWE algorithm. This study provides theoretical and practical foundations for the development and application of related technologies, as well as new solutions for IoT security.

Review Paper on Cloud-Based Emergency Response System

Abstract: In our rapidly advancing technological landscape, the Cloud-Based Emergency Response System with QR Code Integration emerges as a groundbreaking initiative at the inter- section of technology and emergency management. This project addresses the critical need for swift and efficient access to vital individual information during emergencies, especially in the context of road incidents. Traditional emergency response systems often encounter challenges in the rapid retrieval and dissemination of essential data, prompting the need for a trans- formative solution. At its essence, the project aims to redefine the paradigm of information accessibility during emergencies, offering a comprehensive platform that leverages cloud computing, secure authentication methods, and QR code technology. The primary goal is to enhance the efficiency of emergency response procedures by providing a seamless and secure mechanism for users to input and store their critical information. This, in turn, enables emergency responders and authorized individuals to access this information rapidly and effectively.

Secure and Memorable Authentication Using Dynamic Combinations of 3D Objects in Virtual Reality

As Virtual Reality (VR) applications gain popularity, the need for a secure, usable, and memorable user authentication method becomes crucial. However, security and privacy in such VR applications are often ignored. Current methods are insufficient in preventing man-in-the-room (MITR) attacks, which allow attackers to observe user interactions in VR while remaining invisible, and inputted passwords can easily be stolen. In this study, we propose a dynamic combination of multi-attribute authentication methods for VR, where various 3D objects and their attributes can be created and displayed. Users must select combinations of 3D objects and their attributes provided by our designed principles for identity authentication. We explore the impact of method parameters on security and provide three specific parameter schemes to deploy the practical authentication system. We designed three user studies to evaluate the usability, security, and memorability of our authentication system. The results show that the proposed scheme can effectively resist both shoulder surfing and MITR attacks with unsuccessful attack rates of 100% and 95.83%, respectively. Furthermore, this research provides suggestions to secure VR applications while maintaining usability and enhancing the memorability of the authentication method.

Vulnerability Analysis and Security Assessment of Secure Keyboard Software to Prevent PS/2 Interface Keyboard Sniffing

Online security threats have arisen through Internet banking hacking cases, and highly sensitive user information such as the ID, password, account number, and account password that is used for online payments has become vulnerable. Many security companies have therefore researched protection methods regarding keyboard-entered data for the introduction of defense techniques. Recently, keyboard security issues have arisen due to the production of new malicious codes by attackers who have combined the existing attack techniques with new attack techniques; however, a keyboard security assessment is insufficient here. The research motivation is to serve more secure user authentication methods by evaluating the security of information input from the keyboard device for the user authentication, including Internet banking service. If the authentication information input from the keyboard device is exposed during user authentication, attackers can attempt to illegal login or, worst, steal the victim's money. Accordingly, in this paper, the existing and the new keyboard-attack techniques that are known are surveyed, and the results are used as the basis for the implementation of sample malicious codes to verify both a security analysis and an assessment of secure keyboard software. As a result of the experiment, if the resend command utilization attack technique is used, 7 out of 10 companies' products expose keyboard information, and only 1 company's products detect it. The fundamental reason for these vulnerabilities is that the hardware chip related to the PS/2 interface keyboard does not provide security facilities. Therefore, since keyboard data exposure does not be prevented only by software, it is required to develop a hardware chip that provides security facilities.

A Survey on Quantitative Risk Estimation Approaches for Secure and Usable User Authentication on Smartphones.

Mobile user authentication acts as the first line of defense, establishing confidence in the claimed identity of a mobile user, which it typically does as a precondition to allowing access to resources in a mobile device. NIST states that password schemes and/or biometrics comprise the most conventional user authentication mechanisms for mobile devices. Nevertheless, recent studies point out that nowadays password-based user authentication is imposing several limitations in terms of security and usability; thus, it is no longer considered secure and convenient for the mobile users. These limitations stress the need for the development and implementation of more secure and usable user authentication methods. Alternatively, biometric-based user authentication has gained attention as a promising solution for enhancing mobile security without sacrificing usability. This category encompasses methods that utilize human physical traits (physiological biometrics) or unconscious behaviors (behavioral biometrics). In particular, risk-based continuous user authentication, relying on behavioral biometrics, appears to have the potential to increase the reliability of authentication without sacrificing usability. In this context, we firstly present fundamentals on risk-based continuous user authentication, relying on behavioral biometrics on mobile devices. Additionally, we present an extensive overview of existing quantitative risk estimation approaches (QREA) found in the literature. We do so not only for risk-based user authentication on mobile devices, but also for other security applications such as user authentication in web/cloud services, intrusion detection systems, etc., that could be possibly adopted in risk-based continuous user authentication solutions for smartphones. The target of this study is to provide a foundation for organizing research efforts toward the design and development of proper quantitative risk estimation approaches for the development of risk-based continuous user authentication solutions for smartphones. The reviewed quantitative risk estimation approaches have been divided into the following five main categories: (i) probabilistic approaches, (ii) machine learning-based approaches, (iii) fuzzy logic models, (iv) non-graph-based models, and (v) Monte Carlo simulation models. Our main findings are summarized in the table in the end of the manuscript.

Robust and Reusable Fuzzy Extractors from Non-Uniform Learning with燛rrors Problem

A fuzzy extractor can extract an almost uniform random string from a noisy source with enough entropy such as biometric data. To reproduce an identical key from repeated readings of biometric data, the fuzzy extractor generates a helper data and a random string from biometric data and uses the helper data to reproduce the random string from the second reading. In 2013, Fuller et al. proposed a computational fuzzy extractor based on the learning with errors problem. Their construction, however, can tolerate a sub-linear fraction of errors and has an inefficient decoding algorithm, which causes the reproducing time to increase significantly. In 2016, Canetti et al. proposed a fuzzy extractor with inputs from low-entropy distributions based on a strong primitive, which is called digital locker. However, their construction necessitates an excessive amount of storage space for the helper data, which is stored in authentication server. Based on these observations, we propose a new efficient computational fuzzy extractor with small size of helper data. Our scheme supports reusability and robustness, which are security notions that must be satisfied in order to use a fuzzy extractor as a secure authentication method in real life. Also, it conceals no information about the biometric data and thanks to the new decoding algorithm can tolerate linear errors. Based on the non-uniform learning with errors problem, we present a formal security proof for the proposed fuzzy extractor. Furthermore, we analyze the performance of our fuzzy extractor scheme and provide parameter sets that meet the security requirements. As a result of our implementation and analysis, we show that our scheme outperforms previous fuzzy extractor schemes in terms of the efficiency of the generation and reproduction algorithms, as well as the size of helper data.

Industrial Internet Sensor Node Construction and System Construction Based on Blockchain Technology

The present industrial Internet platform (IIP) is subjected to numerous complex security issues, and thus technologies that focus on achieving data security of the IIP has become top priority. The data security crisis of IIP gets mainly reflected in the malicious deletion and theft of data, the random access of terminal devices, and the low security of traditional security authentication methods. Blockchain technology adopts distributed network architecture, wherein through asymmetric encryption mechanism, it helps to solve problems associated with single point of downtime and privacy data leakage of central management of industrial Internet. In addition, considering the accept of random access and deletion of industrial interconnection terminal equipment, this paper uses the role access control mechanism based on Hyperledger, thereby regulating user access according to the user’s role in the platform and management of terminal equipment through chain code. The paper includes the following contributions: (1) firstly, it expounds the research background and significance of the IIP and introduces the research status of the industrial Internet and blockchain at home and abroad. (2) Secondly, the IIP architecture is designed based on blockchain technology and implements a sensor node management and monitoring system. (3) Thirdly, the paper uses the gateway to preprocess the collected data, thereby reducing the data transmission delay and improving the real‐time and effectiveness of the data. The paper finally implements neural network to evaluate the construction quality of industrial Internet sensor nodes and obtains promising test results.

Retracted: Simulation of Dynamic User Network Connection Anti‐Interference and Security Authentication Method Based on Ubiquitous Internet of Things

Retracted: Simulation of Dynamic User Network Connection Anti‐Interference and Security Authentication Method Based on Ubiquitous Internet of Things

An Edge-Supported Blockchain-Based Secure Authentication Method and a Cryptocurrency-Based Billing System for P2P Charging of Electric Vehicles.

The popularity of electric vehicles (EVs) is constantly increasing, as they use relatively greener, sustainable energy. However, it is a fact that the charging stations for EVs are yet to meet the demand. It could be a great solution if a peer-to-peer (P2P) charging system could be initiated by anyone who wants to make their garage's charge points publicly available for commercial purposes, named a home charging station (HCS). In this work, our idea is to bring interested charging stations under a network of nodes and a blockchain-based management system, where the blockchain is responsible for ensuring the authenticity of both the charging stations and charge receiver. A cryptocurrency-based payment system has also been proposed to ensure transactions' security, integrity, transparency, and immutability. A reputation management system is applied to maintain the quality of service. Miners with high processing power are used to alleviate lagging during block creation, supported by edge servers. The proposed system has been implemented by using virtual machines. A theoretical analysis is presented to assess the compatibility and possible cost requirements to implement the system in a real-world scenario.

BLS-identification: A device fingerprint classification mechanism based on broad learning for Internet of Things

The popularity of the Internet of Things (IoT) has enabled a large number of vulnerable devices to connect to the Internet, bringing huge security risks. As a network-level security authentication method, device fingerprint based on machine learning has attracted considerable attention because it can detect vulnerable devices in complex and heterogeneous access phases. However, flexible and diversified IoT devices with limited resources increase difficulty of the device fingerprint authentication method executed in IoT, because it needs to retrain the model network to deal with incremental features or types. To address this problem, a device fingerprinting mechanism based on a Broad Learning System (BLS) is proposed in this paper. The mechanism firstly characterizes IoT devices by traffic analysis based on the identifiable differences of the traffic data of IoT devices, and extracts feature parameters of the traffic packets. A hierarchical hybrid sampling method is designed at the preprocessing phase to improve the imbalanced data distribution and reconstruct the fingerprint dataset. The complexity of the dataset is reduced using Principal Component Analysis (PCA) and the device type is identified by training weights using BLS. The experimental results show that the proposed method can achieve state-of-the-art accuracy and spend less training time than other existing methods.

ECQV-Based Lightweight Revocable Authentication Protocol for Electric Vehicle Charging

In the near future, using electric vehicles will almost certainly be required for the sustainability of nature and our planet. The most significant challenge that users are concerned about is the availability of electric vehicle charging stations. Therefore, to maximize the availability of electric vehicle charging stations, we suggest taking benefit from individual sellers who produce renewable energy from their homes or electric vehicle owners who have charging piles installed in their homes. However, energy services that are rapidly being offered by these businesses do not have a trust connection developed with the consumers and stakeholders in these new systems. Exchange of data related to electric vehicles and energy aggregators can be used to identify users’ behavior and compromise their privacy. Consequently, it is necessary to set up a charging system that will guarantee privacy and security. Several electric vehicle charging systems have been proposed to provide security and privacy preservation. However, ensuring anonymity alone is not enough to guarantee protection from reconstructing the victim vehicle’s route by the tracking adversary, even if the exchanged messages are completely anonymous. Furthermore, anonymity should not be absolute in order to protect the system and function as necessary by all entities. In this research, we propose an effective, secure, and privacy-preserving authentication method based on the Elliptic Curve Qu–Vanstone for an electric vehicle charging system. The proposed scheme provides all the necessary requirements and a reauthentication protocol to minimize the overhead of subsequent authentication processes. To create credentials and validate electric vehicles and energy aggregators, the scheme makes use of the Elliptic Curve Qu–Vanstone implicit certificate mechanism. The new protocols give EVs security and privacy while cutting computational time by 95% thanks to reauthentication, as demonstrated by the performance comparison with earlier works.

Lightweight Two-Factor-Based User Authentication Protocol for IoT-Enabled Healthcare Ecosystem in Quantum Computing.

The healthcare ecosystem is migrating from legacy systems to the Internet of Things (IoT), resulting in a digital environment. This transformation has increased importance on demanding both secure and usable user authentication methods. Recently, a post-quantum fuzzy commitment scheme (PQFC) has been constructed as a reliable and efficient method of biometric template protection. This paper presents a new two-factor-based user authentication protocol for the IoT-enabled healthcare ecosystem in post-quantum computing environments using the PQFC scheme. The proposed protocol is proved to be secure using random oracle model. Furthermore, the functionality and security of the proposed protocol are analyzed, showing that memoryless-effortless, user anonymity, mutual authentication, and resistance to biometric templates tampering and stolen attacks, stolen smart card attack, privileged interior attack are fulfilled. The costs of storage requirement, computation, communication and storage are estimated. The results demonstrate that the proposed protocol is more efficient than Mukherjee et al., Chaudhary et al., and Gupta et al. protocols.