Strong Password Authentication Research Articles

Design a sturdy and secure authentication scheme capable of early detection of COVID-19 patients using WBANs

<p>COVID-19 was first reported in China Wuhan and rapidly grown up to more than 58 countries based on the World Health Organization (WHO). Well ahead of any health emergency, the health care server has the ability to access these data via authorization and then s/he performs necessary actions. In order to protect medical data from malicious activities, authentication is the starting point for this. Authentication systems represent a network support factor to reduce ineffective users and radically eliminate phishing because authentication determines the identity of the real user. Many schemes and technologies have been suggested for authentication in wireless body area networks (WBANs). In this paper, we suggest a strong dynamic password authentication system for WBANs. We adopt a (different/new) way to calculate a password and make it coherent and dynamic for each login session. Our work also provides additional security properties to get rid of hub node impersonation attacks and resolve key escrow issues. Our scheme resist fishing attach which keep patient from any illegal change of drugs. By comparison, the proposed scheme is considered active and has strong security based on formal security analysis tools such as AVISPA.</p>

Reverse Engineering IoT Devices: Effective Techniques and Methods

Recent Internet of Things (IoT) botnet attacks have called the attention to the fact that there are many vulnerable IoT devices connected to the Internet today. Some of these Web-connected devices lack even basic security practices such as strong password authentication. As a consequence, many IoT devices are already infected with malware and many more are vulnerable to exploitation. In this paper we analyze the security level of 16 popular IoT devices. We evaluate several low-cost black-box techniques for reverse engineering these devices, including software and fault injection-based techniques used to bypass password protection. We use these techniques to recover device firmware and passwords. We also discover several common design flaws which lead to previously unknown vulnerabilities. We demonstrate the effectiveness of our approach by modifying a laboratory version of the Mirai botnet to automatically add these devices to a botnet. We also discuss how to improve the security of IoT devices without significantly increasing their cost or affecting their usability.

A Comparative Study of Authentication Schemes with Security and Usability of IPAS

User authentication is one of the most important topics in information security. Conventional user strong-password authentication schemes have the common drawback that user has to memorize a hard-to-remember textual password, and therefore their applications are restricted. As an alternative, token and biometric-based authentication systems were introduced. However, they have not improved substantially to justify the investment. Thus, an image-based authentication scheme has been proposed as a possible alternative solution to text-based authentication, motivated particularly by the fact that humans can remember images better than text. Click based graphical passwords that use background images do not have a sufficiently large password space suited for most Internet applications. Also, it suffered due to shoulder-surfing and replay attacks. All graphical and image algorithms comprise two different aspects: security and usability. Unfortunately, none of the graphical algorithms are able to cover both aspects at the same time. In this paper, we evaluate the usability and security of different authentication schemes and compare them with our proposed scheme, which is the Implicit Password Authentication System (IPAS) by an experiment and a questionnaire survey.

MULTI-DIMENSIONAL PASSWORD GENERATION TECHNIQUE FOR ACCESSING CLOUD SERVICES

Cloud computing is drastically growing technology which provides an on-demand software, hardware, infrastructure and data storage as services. This technology is used worldwide to improve the business infrastructure and performance. However, to utilize these services by intended customer, it is necessary to have strong password authentication. At present, cloud password authentication can be done in several ways, such as, textual password, graphical and 3D password. In this paper, we are proposing the strong password generation technique by considering multiple input parameters of cloud paradigm referred as a multidimensional password. This paper presents the multidimensional password generation technique along with architecture, sequence diagrams, algorithms and typical user interfaces. At the end, we derive the probability of breaking our authentication system.

Multi-Dimensional Password Generation Technique for Accessing Cloud Services

Cloud computing is drastically growing technology which provides an on -demand software, hardware, infrastructure and data storage as services. This technology is used worldwide to improve the business infrastructure and performance. However, to utilize these services by intended customer, it is necessary to have strong password authentication. At present, cloud password authenti cation can be done in several ways, such as, textual password, graphical and 3D password. In this paper, we are proposing the strong password generation technique by considering multiple input parameters of cloud paradigm referred as a multidimensional password. This paper presents the multidimensional password generation technique along with architecture, sequence diagrams, algorithms and typical user interfaces. At the end, we derive the probability of breaking our authentication system.

Design and analysis of USB-Key based strong password authentication scheme

Concerning that the OSPA protocol is vulnerable to the replay attack and the denial-of-service attack,in this paper,a USB-Key based strong password authentication scheme was proposed,which used USB-Key to verify the user's password and store the security parameter.In this scheme,user's identity can be protected by using the temporary identity and the authentication parameters computation by Hash function.This scheme can achieve mutual authentication between user and server by transferring the authentication parameters.The security analysis of the scheme proves that the scheme is resistant to replay attack,impersonation attack and Denial of Service(DoS) attack,and it has high security,and it can be used by users with limited computation ability.

A novel user’s authentication scheme for pervasive on-line media services

Due to the explosive growth of the Internet and the pervasion of multimedia, protection of intellectual property (IP) rights of digital content in transactions induces people's concerns. Current security requirements and copyright protection mechanisms especially need to work in real-time and on-line for communication and networking. For media service systems in the Internet, user's authentication is most essential in association with the access control of the media system. The authentication scheme is a trivial but crucial issue for maintaining user's information. Up to now, many one-time password-based authentication schemes have been proposed. However, none is secure enough. The purpose of a one-time password (OTP) is to make it more difficult to gain unauthorized access to restricted resources. Traditionally static passwords can more easily be obtained by an unauthorized intruder given enough attempts and time. By constantly altering the password, as is done with a one-time password, this risk can be greatly reduced. These schemes are specially fit for media services in the Internet since they will frustrate the attacker's attempt. Lin, Shen and Hwang proposed a strong-password authentication scheme in association with one-time password by using smart cards, and claimed their scheme can resist guess attack, replay attack, impersonation attack and stolen attack. Later, Ku, Tsai, and Chen showed that Lin-Shen-Hwang's scheme suffers from a replay attack and a denial-of-service attack. Furthermore, Ku proposed a hash-based strong-password authentication scheme to enhance the security. In this paper, we show the weaknesses and devise some attacks against Ku's scheme. Then, we revise Ku's scheme and propose a novel user's authentication scheme in pervasive on-line media services for current communication and networking.

Efficient and secure password authentication schemes for low-power devices

In 2003, Lin et al. proposed an improvement on the Optimal Strong-Password Authentication (OSPA) scheme to make the scheme withstand the stolen-verifier attack, using smart card. However, Ku et al. showed that Lin et al.'s scheme is vulnerable to the replay and the denial of service attack. In 2004, Chen et al. proposed a secure SAS-like password authentication schemes. Their schemes can protect a system against replay and denial-of-service attacks. In this paper, we propose two efficient and secure password authentication schemes which are able to withstand replay and denial-of-service attacks. The proposed schemes are more efficient than Chen et al.'s schemes in computation costs. Moreover, the proposed schemes can be implemented on most of target low-power devices such as smart cards and low-power Personal Digital Assistants in wireless networks.

A new strong-password authentication scheme using one-way hash functions

Recently, Sandirigama et al. have proposed an authentication scheme by the name of SAS and have claimed that it has the lowest storage, processing, and transmission overhead. In 2001, Lin et al. showed that the protocol is insecure and proposed an optimal strong-password authentication protocol called the OSPA protocol. However, Chen and Ku pointed out that both SAS and OSPA are vulnerable to stolen-verifier attack in 2002. Later, Lin, Shen, and Hwang proposed a modified OSPA protocol to repair the security law of OSPA protocol. In this paper, we propose a new strong-password authentication protocol that not only can withstand many possible attacks including a stolen-verifier attack, but that is also more efficient than the modified OSPA protocol.

A Hash-based Strong Password Authentication Protocol with User Anonymity

Password authentication protocols range from complex public-key cryptosystems to simple hash-based password authentication schemes. One common feature of these protocols is that the user’s identity is transmitted in plain during the authentication process, which allows an attacker to monitor the user’s activities. In many cases, the user’s anonymity is a desirable security feature. In this paper, we propose a hash-based Strong Password Authentication Protocol with user Anonymity (SPAPA). We also analyze the security of our proposed scheme against known attacks.

Stolen-Verifier 공격과 Impersonation 공격에 안전한 개선된 OSPA 프로토콜

인터넷에서의 사용자 인증은 안전한 통신을 위해 가장 중요한 서비스 중의 하나이다. 비록 패스워드 기반 메커니즘이 네트워크 상에서의 사용자 인증을 위해 가장 많이 쓰이는 방법이기는 하나, 사용자들이 기억하기 쉬운 패스워드(easy-to-remember)를 사용하므로, 사전공격(dictionary attack)에 취약한 것과 같은 근본적인 문제점들을 가지고 있다. 이러한 사전공격을 방지하기 위만 방법들의 경우에는 높은 계산량을 필요로 한다. 본 논문에서는 이러한 문제를 해결하기 위한 최근에 발표된 OSPA 프로토콜에 대하여 설명하고, OSPA 프로토콜이 stolen-verifier 공격과 impersonation 공격에 취약함을 보인다. 그리고 이러한 공격들에 안전한 개선된 OSPA 프로토콜을 제안한다. 제안하는 프로토콜은 스마트 카드에 탑재된 co-processor를 통해 암호학적 연산이 수행되므로 사용자에게 낮은 계산량을 제공한다. In the Internet, user authentication is the most important service in secure communications. Although password-based mechanism is the most widely used method of the user authentication in the network, people are used to choose easy-to-remember passwords, and thus suffers from some Innate weaknesses. Therefore, using a memorable password it vulnerable to the dictionary attacks. The techniques used to prevent dictionary attacks bring about a heavy computational workload. In this paper, we describe a recent solution, the Optimal Strong-Password Authentication (OSPA) protocol, and that it is vulnerable to the stolen-verifier attack and an impersonation attack. Then, we propose an Improved Optimal Strong-Password Authentication (I-OSPA) protocol, which is secure against stolen-verifier attack and impersonation attack. Also, since the cryptographic operations are computed by the processor in the smart card, the proposed I-OSPA needs relatively low computational workload and communicational workload for user.

A secure and efficient strong-password authentication protocol

Password authentication protocols are divided into two types. One employs the easy-to-remember password while the other requires the strong password. In 2001, Lin et al. proposed an optimal strong-password authentication protocol (OSPA) to resist the replay attack and the denial-of-service attack. However, Chen and Ku pointed out that the OSPA protocol is vulnerable to the stolen-verifier attack. Hence, Lin et al. presented an enhancement in 2003. Nevertheless, mutual authentication is not ensured in Lin et al.'s protocol such that it suffers from the server spoofing attack. Moreover, Lin et al.'s protocol is also vulnerable to the denial-of-service attack. As a result, we present a secure strong-password authentication protocol in this paper to overcome their disadvantages.

A hash-based strong-password authentication scheme without using smart cards

So far, many strong-password authentication schemes have been proposed, however, none is secure enough. In 2003, Lin, Shen, and Hwang proposed a strong-password authentication scheme using smart cards, and claimed that their scheme can resist the guessing attack, the replay attack, the impersonation attack, and the stolen-verifier attack. Later, Ku, Tsai, and Chen showed that Lin-Shen-Hwang's scheme suffers from a replay attack and a denial-of-service attack. Herein, we propose a more secure hash-based strong-password authentication scheme without using smart cards.

Two simple attacks on Lin-Shen-Hwang's strong-password authentication protocol

In 2001, Lin, Sun, and Hwang proposed a strong-password authentication protocol, OSPA, which was later found to be vulnerable to a stolen-verifier attack and a man-in-the-middle attack. Recently, Lin, Shen, and Hwang [10] proposed an improved protocol of OSPA and showed that the improved protocol can resist the guessing attack, the replay attack, the impersonation attack, and the stolen-verifier attack. Herein, we show that their protocol is still vulnerable to a replay attack and a denial-of-service attack.

Security enhancement for optimal strong-password authentication protocol

In 2001, Lin et al. proposed an optimal strong-password authentication protocol called the OSAP protocol. However, Chen and Ku pointed out that it is vulnerable to the stolen-verifier attack. In this paper, we shall propose an improved version of the OSAP protocol to enhance the security.

Security enhancement for Optimal Strong-Password Authentication protocol

In 2001, Lin et al. proposed an optimal strong-password authentication protocol called the OSAP protocol. However, Chen and Ku pointed out that it is vulnerable to the stolen-verifier attack. In this paper, we shall propose an improved version of the OSAP protocol to enhance the security.

Robust and Simple Authentication Protocol

Password-based authentication protocols are currently the conventional authentication protocols in many distributed systems. However, the security of these protocols is falling behind the times because more and more attacks can now break them. The security weaknesses of the Simple And Secure (SAS) protocol, the Optimal Strong-Password Authentication (OSPA) protocol, and the revised SAS protocols are examined in this paper. We then propose our RObust and SImple (ROSI) protocol to help raise security levels. The ROSI protocol can be easily implemented and has lower communication costs than most other protocols.

Directed One-Time Password Authentication Scheme Based upon Discrete Logarithm

A new kind of one-time password authentication scheme, directed one-time password authentication scheme, is presented in this paper. The distinguished feature of the directed authentication scheme is that only the specified verifier can validate the verifiee's genuine identity, without the help of this specified verifier, anyone else cannot verify it. One strong directed one-time password authentication scheme based on discrete logarithm is proposed in this paper and the security and performance of which are also analyzed.

DIRECTED ONE-TIME PASSWORD AUTHENTICATION SCHEME BASED UPON DISCRETE LOGARITHM

A new kind of one-time password authentication scheme, directed one-time password authentication scheme, is presented in this paper. The distinguished feature of the directed authentication scheme is that only the specified verifier can validate the verifiee's genuine identity, without the help of this specified verifier, anyone else cannot verify it. One strong directed one-time password authentication scheme based on discrete logarithm is proposed in this paper and the security and performance of which are also analyzed.