Single-factor Authentication Research Articles

Suppressed K-Anonymity Multi-Factor Authentication Based Schmidt-Samoa Cryptography for privacy preserved data access in cloud computing

Security and privacy-preservation is a significant problem to be solved in the cloud when accessing data services. The existing authentication technique verifies the client identity using single authentication factor. But, the performance of conventional single factor authentication technique is not efficient since the client’s sensitive information is highly intrusive and exposed to third parties. In order to overcome these limitations, a novel multifactor authentication called Suppressed K-Anonymity Multi-Factor Authentication Based Schmidt-Samoa Cryptography (SKMA-SC) technique is proposed. The SKMA-SC technique comprises three key processes namely registration, authentication and data access. During the registration phase, the clients register their personal identification information’s and securely stores it in the cloud server (CS) with support of suppression method. This helps for SKMA-SC technique to preserve the client sensitive information’s from adversaries or third parties in a cloud environment. During the authentication phase, SKMA-SC technique validates the identity of clients by considering multifactor such as password, one-time token and conditional attributes. At last in the data access phase, SKMA-SC technique allows the clients to get requested data services when she or he is authorized by performing Schmidt-Samoa data encryption/decryption process . From that, SKMA-SC technique avoids illegal access from the unauthorized party over insecure communications in a cloud environment with a lower amount of time. Result analysis of SKMA-SC technique is carried out with the metrics authentication accuracy (AA), computational complexity (CC) and privacy-preserving rate (PPR) with different number of clients and cloud data. The experimental result proves that SKMA-SC technique enhances the PPR and lessens the CC of authentication as evaluated with state-of-the-art works.

Keystroke Dynamics Based User Authentication using Deep Multilayer Perceptron

User authentication is an essential factor to protect digital service and prevent malicious users from gaining access to the system. As Single Factor Authentication (SFA) is less secure, organizations started to utilize Multi-Factor Authentication (MFA) to provide reliable protection by using two or more identification measures. Keystroke dynamics is a behavioral biometric, which analyses users typing rhythm to identify the legitimacy of the subject accessing the system. Keystroke dynamics that have a low implementation cost and does not require additional hardware in the authentication process since the collection of typing data is relatively simple as it does not require extra effort from the user. This study aims to propose deep learning model using Multilayer Perceptron (MLP) in keystroke dynamics for user authentication on CMU benchmark dataset. The user typing rhythm from 51 subjects collected based on the static password (.tie5Roanl) typed 400 times over 8 sessions and 50 repetitions per session. The MLP achieved optimum EER of 4.45% compared to original benchmark classifiers such as 9.6% (scaled Manhattan), 9.96% (Mahalanobis Nearest Neighbor), 10.22% (Outlier Count), 10.25% and 16.14% (Neural Network Auto-Assoc). © 2020 by the authors.

A Longitudinal Study on Web-Sites Password Management (in)Security: Evidence and Remedies

Single-factor password-based authentication is generally the norm to access on-line Web-sites. While single-factor authentication is well known to be a weak form of authentication, a further concern arises when considering the possibility for an attacker to recover the user passwords by leveraging the loopholes in the password recovery mechanisms. Indeed, the adoption by a Web-site of a poor password management system makes useless even the most robust password chosen by the registered users. In this paper, building on the results of our previous work, we study the possible attacks to on-line password recovery systems analyzing the mechanisms implemented by some of the most popular Web-sites. In detail, we provide several contributions: (i) we revise and detail the attacker model; (ii) we provide an updated analysis with respect to a preliminary study we carried out in December 2017; (iii) we perform a brand new analysis of the current top 200 Alexa's Web-sites of five major EU countries; and, (iv) we propose Maildust, a working open-source module that could be adopted by any Web-site to provide registered users with a password recovery mechanism to prevent mail service provider-level attacks. Overall, it is striking to notice how the analyzed Web-sites have made little (if any) effort to become compliant with the GDPR regulation, showing that the objective to have basic user protection mechanisms in place-despite the fines threatened by the GDPR-is still far, mainly because of sub-standard security management practices. Finally, it is worth noting that while this study has been focused on EU registered Web-sites, the proposed solution has, instead, general applicability.

The many ways to hack 2FA

As the days of pervasive password authentication are starting to wane, administrators and end users are increasingly turning to stronger types of authentication such as two-factor authentication (2FA) and multi-factor authentication (MFA). All other considerations considered equal, MFA solutions (which include 2FA) are usually stronger than single-factor authentication (1FA) solutions such as the ubiquitous duo of username and password. This is generally agreed upon by all computer security professionals. People are increasingly turning to stronger types of authentication such as two-factor authentication (2FA) and multi-factor authentication (MFA). But somewhere along the way, many people have come to associate MFA solutions with being far less hackable or even unhackable. Nothing could be further from the truth. In fact, it's possible to use nothing more than a simple phishing email to easily bypass many beloved MFA solutions, says Roger Grimes of KnowBe4.

A Novel Multiserver Authentication Protocol with Multifactors for Cloud Service

Secure and efficient authentication protocols are necessary for cloud service. Multifactor authentication protocols taking advantage of smart card, user’s password, and biometric, are more secure than password-based single-factor authentication protocols which are widely used in practice. However, most of the multiserver authentication protocols may have weak points, such as smart card loss attack, man-in-the-middle attack, anonymity, and high computation cost of authentication center. In order to overcome the above weaknesses, we propose a novel multiserver multifactor authentication protocol based on the Kerberos protocol using the extended Chebyshev chaotic mapping as a cryptographic algorithm. The proposed protocol achieves anonymity without sharing secret keys in advance and needs the user to register with the authentication center only once. Finally, we prove the security of the new protocol with BAN logic and compare it with other multifactor authentication protocols for multiserver environment. The results show that our proposed protocol is more secure and efficient and better for practical application.

Multi-Factor Authentication: A Survey

Today, digitalization decisively penetrates all the sides of the modern society. One of the key enablers to maintain this process secure is authentication. It covers many different areas of a hyper-connected world, including online payments, communications, access right management, etc. This work sheds light on the evolution of authentication systems towards Multi-Factor Authentication (MFA) starting from Single-Factor Authentication (SFA) and through Two-Factor Authentication (2FA). Particularly, MFA is expected to be utilized for human-to-everything interactions by enabling fast, user-friendly, and reliable authentication when accessing a service. This paper surveys the already available and emerging sensors (factor providers) that allow for authenticating a user with the system directly or by involving the cloud. The corresponding challenges from the user as well as the service provider perspective are also reviewed. The MFA system based on reversed Lagrange polynomial within Shamir’s Secret Sharing (SSS) scheme is further proposed to enable more flexible authentication. This solution covers the cases of authenticating the user even if some of the factors are mismatched or absent. Our framework allows for qualifying the missing factors by authenticating the user without disclosing sensitive biometric data to the verification entity. Finally, a vision of the future trends in MFA is discussed.

T2FA: Transparent Two-Factor Authentication

Traditional username and password-based single-factor authentication is easy to deploy but vulnerable to dictionary attacks, snooping, and brute force attacks. Two-factor authentication (2FA) has been proposed to improve the security, where smart devices are used as the second authentication factor. However, the interaction between human and the smart device is required, which is inconvenient to users. In addition, an attacker is able to get the second authentication factor through fraud, thus invalidating current 2FA mechanisms. In order to solve these problems, we propose a transparent two-factor authentication (T2FA) based on physical unclonable function (PUF) and voiceprint. The second authentication authenticates the user's mobile phone through the PUF. The third one is to determine whether the login terminal and the user's mobile phone are in the same environment with the environment voiceprint. The second and third authentication in the second factor is completely transparent to users. Therefore, T2FA avoids the tedious interaction and provides the same high user experience satisfaction as the single-factor authentication and exhibits high security simultaneously. Moreover, the fraud is eliminated technically due to the transparency of the authentication.

Lightweight, ECC based RFID Authentication Scheme for WLAN

Wireless local area networks (WLANs), like IEEE 802.11, are right now very common in numerous outdoor or indoor environments for providing wireless communication among WiFi-enabled devices by accessing an Access Point (infrastructure mode) or through peer to peer connections (ad hoc mode). Authentication is one among the most primary research challenges for the realization of the envisioned mobile and wireless Internet. This is mainly due to the latency delay introduced during the authentication process, which are of major concern for real-time applications and media streaming application. In the same way, it is also crucial for WLANs to authenticate clients and build secure channels with them. In the historical researches, the traditional authentication mechanisms frequently adopted the names and passwords of clients as login authentication. However, these Single Factor Authentication mechanisms are proved to be defective. In virtue of enhancing security, recent researches on authentication are built on Two-Factor authentication schemes. In this paper, the authors proposed a two factor, lightweight RFID authentication scheme based on elliptic curve cryptography (ECC) for WLAN. The analytic comparison demonstrates the research not just reduces the expense of proposed authentication schemes, yet gives security similarly as smart card technology. In addition, the performance of the proposed authentication scheme will analyze in terms of computational cost, communications cost, and storage cost.

Assessing Usable Security of Multifactor Authentication

An authentication mechanism is a security service that establishes the difference between authorised and unauthorised users. When used as part of certain website processes such as online banking, it provides users with greater safety and protection against service attacks and intruders. For an e-banking website to be considered effective, it should provide a usable and secure authentication mechanism. Despite existing research on usability and security domains, there is a lack of research on synthesising the contributions of usable security and evaluating multifactor authentication methods. Without understanding the usability and security of authentication mechanisms, the authenticating process is likely to become cumbersome and insecure. This negatively affects a goal of the authentication process, convenience for the user. This thesis sought to investigate the usability and security of multifactor authentication and filled an important gap in the development of authenticating processes. It concentrated on users’ perspectives, which are crucial for the deployment of an authenticating process. To achieve the thesis goal, a systematic series of three studies has been conducted. First, an exploratory study was used to investigate the current state of the art of using multifactor authentication and to evaluate the usability and security of these methods. The study involved a survey of 614 e-banking users, who were selected because they were likely long-term users of online banking and they had two different bank accounts, a Saudi account and a foreign account (most foreign accounts were British). The study indicated that multifactor authentication has been widely adopted in e-banking in Saudi Arabia and the United Kingdom, with high levels of security and trustworthiness as compared to single factor authentication. The second study was a descriptive study of the most common authentication methods. This study aimed to learn more about commonly used methods that were identified in the previous study and sought to propose an appropriate combination of authentication methods to be evaluated in the third study. The third study was an experimental study with 100 users to evaluate the usable security of three different multifactor authentication methods: finger print, secure device and card reader. A web based system was designed specifically for this study to simulate an original UK e-banking website. One of the main contribution of this study was that the system allowed users to choose their preferred authentication method. Moreover, the study contributed to the field of usable security by proposing security evaluation criteria based on users’ awareness of security warnings. The key result obtained indicated that fingerprinting was the most usable and secure method. Additionally, the users’ level of understanding security warnings was very low, as shown by their reaction to the security indicators presented during the experiment.

Analysis of QKD multifactor authentication in online banking systems

Abstract In the present scenario internet usage and the online banking sectors are experiencing spectacular growth. The Internet is the fastest growing banking channel today, both in the fields of corporate and retail banking. Banks prefer their customers to use the online banking facility as it reduces their cost, primarily through labour costs. The online banking system addresses several emerging trends: customers’ demand for anytime, anywhere service, product time-to-market imperatives and increasingly complex back-office integration challenges. Online fraud has become major source of revenue for criminals all over the globe. The challenges that oppose online banking are the concerns of security and privacy of information. This has made detecting and preventing these activities a top priority for every major bank. The use of single-factor authentication, such as a user name and the password, has been inadequate for guarding against account fraud and identity theft, in sensitive online banking systems. In this paper we are going to analyze the QKD multifactor authentication in online banking systems

Secure biometric template generation for multi-factor authentication

In the light of recent security incidents, leading to compromise of services using single factor authentication mechanisms, industry and academia researchers are actively investigating novel multi-factor authentication schemes. Moreover, exposure of unprotected authentication data is a high risk threat for organizations with online presence. The challenge is how to ensure security of multi-factor authentication data without deteriorating the performance of an identity verification system? To solve this problem, we present a novel framework that applies random projections to biometric data (inherence factor), using secure keys derived from passwords (knowledge factor), to generate inherently secure, efficient and revocable/renewable biometric templates for users׳ verification. We evaluate the security strength of the framework against possible attacks by adversaries. We also undertake a case study of deploying the proposed framework in a two-factor authentication setup that uses users׳ passwords and dynamic handwritten signatures. Our system preserves the important biometric information even when the user specific password is compromised – a highly desirable feature but not existent in the state-of-the-art transformation techniques. We have evaluated the performance of the framework on three publicly available signature datasets. The results prove that the proposed framework does not undermine the discriminating features of genuine and forged signatures and the verification performance is comparable to that of the state-of-the-art benchmark results.

Multi-Factor Identity Authenticated Key Agreement Protocol

This paper proposes scheme can achieve mutual authentication and session key agreement based on multi-factor. It improves the scheme proposed by Chuang et al on protecting from the stolen smart card attack, impersonation attack, server spoofing attack and man-in-the-middle attack, and guaranteeing on the forward security. It solves the problem of weak resistance to attacks in single-factor authentication approaches, by combining the smart card with biometrics and password. It also guarantees the security of mutual identity authentication between users and servers and that of session keys. It consumes more computing resources that the Chuang’s scheme, but it can resist to several known attacks efficiently.

Assessing Network Services and Security in Nigeria Universities

The paper investigated sources of threats and vulnerabilities to Nigerian university computer networks and assessed the adequacy of security controls in place to mitigate the occurrence of successful intrusion. This was with a view to enhancing the integrity of data transactions on the Universities' computer networks. Data for the study were sourced from 18 purposively selected universities in Southwestern Nigeria. Three universities, each representing federal, state and private were selected from each of the six states in the zone. Primary data were obtained through the use of validated questionnaire. The result revealed that 81.3% of the universities had internet presence. The Universities' Organisation Information Criticality Matrix (OICM) showed the bursary unit with highest weighted average. The result further showed that web services posed the greatest source of threat and vulnerability to the university networks. Indeed, 72% of the universities ran e-portal services that incorporated electronic payment but none of the universities was digitally signed with Certificate Authority (CA). The result also showed that single factor authentication using usernames and passwords were the only network access identifier employed by all the universities. The study noted that the security controls to safe guard the integrity and non-repudiation of networktransactions in the universities were weak and high potential existed for possible compromise of the network system. The study therefore concluded by proposing a layered approach to managing security on the university network.

User perceptions of security and usability of single-factor and two-factor authentication in automated telephone banking

This paper describes an experiment to investigate user perceptions of the usability and security of single-factor and two-factor authentication methods in automated telephone banking. In a controlled experiment with 62 banking customers a knowledge-based, single-factor authentication procedure, based on those commonly used in the financial services industry, was compared with a two-factor approach where in addition to the knowledge-based step, a one-time passcode was generated using a hardware security token. Results were gathered on the usability and perceived security of the two methods described, together with call completion rates and call durations for the two methods. Significant differences were found between the two methods, with the two-factor version being perceived as offering higher levels of security than the single-factor authentication version; however, this gain was offset by significantly lower perceptions of usability, and lower ratings for convenience and ease of use for the two-factor version. In addition, the two-factor authentication version took longer for participants to complete. This research provides valuable empirical evidence of the trade-off between security and usability in automated systems.

An RFID secure authentication mechanism in WLAN

With the thriving evolution of information technology, network technology attains to maturity and Wireless Local Area Network (WLAN) becomes universal as well. To discipline the right of network usage, network system identifies users before providing network services or resources. In the historical researches, the conventional authentication mechanisms frequently adopted the names and passwords of users as login authentication. However, these Single Factor Authentication mechanisms are proved to be defective. In virtue of enhancing security, recent researches on authentication are built on Two-Factor Authentication schemes. Nevertheless, the expensive cost of building Two-Factor Authentication approaches has affected the will of users. For the purpose of lifting the rate of usage, in this paper, we apply low-cost passive Radio Frequency Identification (RFID) tag along with the names and passwords of users as login authentication. The analytic comparison indicates the research not only reduces the cost of Two-Factor Authentication schemes, but provides security in the same way as smart cards technology.

KERBEROS SECURITY EVALUATION

Authentication of a person is an important task in many areas of day-to-day life including electronic commerce, system security and access control. We present Kerberos a client\server authentication protocol which can perform a secure communication over unsecured environments (internet). For example an e-bank application the client can log on in domain environment using password (single factor authentication) or a smart card running java card application in combine with PIN and the server is the banking hosted system at the bank. Smart card can enhance the security by storing the cryptographic key to perform dual factor authentication, it also can manage the encryption and decryption of the Kerberos keys on it rather then on the client workstation memory. A common methodology depends on the national standardizations is used to evaluate security of that authentication scenarios of Kerberos protocol.