Traditional Password Research Articles

SDD: A trusted display of FIDO2 transaction confirmation without trusted execution environment

The FIDO2 protocol allows users to perform online authentication by setting a public key and avoids the shortcomings of the traditional password authentication mechanism in terms of security. During transaction confirmation with the FIDO2 protocol, users must confirm the transaction message and then sign this message using a cryptographic signature scheme. However, it is a challenge to show that transaction messages are correct or trusted in practice. No available authenticator that supports the FIDO2 protocol uses trusted display hardware to guarantee the correctness of transaction messages. This paper proposes a trusted display of transaction messages by developing a lightweight and trusted base on hardware without a trusted execution environment (TEE). The proposed trusted display is easily applied in the FIDO2 protocol and resists four types of well-known attacks, such as malicious process tampering with display and occupying an authenticator. The experimental results indicate that the improved FIDO2 protocol slightly increases the processing overhead compared to the traditional protocol.

A Novel Session Password Security Technique using Textual Color and Images

Traditionally people will be using a weak password that has to be often changed can be influenced by a dictionary attack, shoulder surfing, and other methods of password cracking. After the past years, graphical passwords came into existence however; they are not as useful as the traditional password method, since they take more time to authenticate the passcode. As a result, this paper has taken a study of session password strategy in which the password is used only once for each session and, as that session ends, the password no longer provides access. The suggested session password scheme would us a “text” session password. Once upon a time, textual passwords were the most often used technique for authentication. Password are vulnerable to many scenarios, such as shoulder surfing, social engineering attacks, and lazy password selection. Graphical keys are introduced as a way to express very important passwords. Nearly all of the graphical schemes are vulnerable to shoulder pack design. To contend with the downside of being unable to remember passwords, pictures may be used to pair with session passwords for authentication. A session secret of a completely new password can only be used any time a new password is created. During this article, two approaches are expected to become a welcome cure for depression with an in-session approach that is unpredictable to shoulder ache and color. Strategies for Digital Assistants that is suitable for private uses. The proposed system measures the security and usability of the proposed system and displays the assistance of the proposed system to shoulder surfing assault.

Graphical password based mouse behavior technique

This paper proposes a new password generation technique on the basis of mouse motion and a special case location recognized by the number of clicks to protect sensitive data for different companies. Two, three special locations click points for the users has been proposed to increase password complexity. Unlike other currently available random password generators, the path and number of clicks will be added by admin, and authorized users have to be training on it.This method aims to increase combinations for the graphical password generation using mouse motion for a limited number of users. A mathematical model is developed to calculate the performance of the password. The proposed technique in this paper allows the user to keep the ease-of-use in the mouse motion, while minimizing the risk of password guessing. A comparative evaluation has been conducted against a traditional password. The results show that the proposed approach improves the complexity 200% for fix position technique and two variants technique but more than 200% for three variants technique.

A Camouflage Text-Based Password Approach for Mobile Devices against Shoulder-Surfing Attack

Authentication in mobile devices is inherently vulnerable to attacks and has the weakness of being susceptible to shoulder-surfing attack. Shoulder-surfing attack is a type of attack that uses direct observation techniques such as looking over someone’s shoulder to get information. This paper aims to introduce a novel way of concealing the password within a contingent of randomly selected entries. In particular, the traditional password concept where what you input is what you get is redefined by proposing the camouflage characters approach. Based on this approach, three defensive techniques are introduced for mobile devices. By using an Android platform, the introduced techniques are implemented. Experimental studies are conducted in order to evaluate both security and usability perspectives. The empirical results showed that the proposed approach is reasonably resistant against shoulder-surfing attacks and usable for participants. Moreover, it is possible to choose very short passwords, while insuring that the password remains hidden amongst a large number of key presses. Based on the achieved results, the proposed approach is recommended to be a new avenue in the field of security to produce very simple and yet very complicated passwords, to be observed by the attacker, at the same time.

Authentication Database Leakage Detection

Authentication is the first step for any important applications. Password verification is widely employed in the Internet. Some advanced mechanisms including bio features, such as fingerprints or retina. However, digital password authentication credential is commonly used in the public. In other words, traditional password verification is still an important authentication credential mechanism for today's online services. Password database may be compromised. Once if the database is stolen, it is dangerous and critical for any services. Consequently, password database leakage becomes an important issue. Detection and countermeasure are essential for such a disaster. Our research proposing a scheme based on a authentication database storage mapping method to detect possible leakage of authentication database. By multiple mapping mechanism, if the authentication database is stolen, an attacker could not know any user's correct password. This method can reduce additional space of storing passwords with ability to detect security event for stolen authentication databases. Keywords:Application Security; System Security; Leakage Detection; Authentication database, Password DOI: 10.7176/NCS/12-01 Publication date: January 31 st 2021

Reconfigurable and High-Efficiency Password Recovery Algorithms Based on HRCA

Cryptographic algorithms are widely used in information security fields such as network protocol authentication and commercial encryption software. Password recovery based on the hash algorithm is an important means of electronic forensics, encrypted information restoration, illegal information filtering, and network security maintenance. The traditional password recovery system is based mainly on the CPU and GPU and has a low energy efficiency ratio and cracking efficiency and cannot meet high-performance computing requirements. To further improve the computational efficiency and application flexibility of password recovery algorithms, this paper proposes a reconfigurable computing kernel design method based on a hybrid reconfigurable computing array (HRCA). Through in-depth analysis of the hash algorithm, the basic computing kernel set is extracted, and the combination design is carried out from the unit kernel, interconnection and storage structure to reconstruct the hash algorithm to match the application with the appropriate structure. Second, combined with the pipeline technology, the full pipeline hash and high-speed password attack algorithms are optimized and implemented to meet the needs of high-performance computing. Finally, an advanced computing kernel library is established, and the combination of a computing kernel map from the control and communication levels to achieve multidimensional reconfigurable computing and an overall placement strategy is used to make full use of the chip resources to improve computational efficiency. The experimental results and analysis show that compared with traditional CPU and GPU methods, the password recovery algorithm designed in this paper has the highest cracking speeds at 78.22 times and 2.65 times that of the CPU and GPU, respectively, and the highest energy efficiency ratio is 25.88 times and 3.16 times that of the CPU and GPU, respectively. Furthermore, the recovery efficiency has been significantly improved and meets the requirements of high-performance password recovery computing.

A Survey on Heart Biometrics

In recent years, biometrics (e.g., fingerprint or face recognition) has replaced traditional passwords and PINs as a widely used method for user authentication, particularly in personal or mobile devices. Differing from state-of-the-art biometrics, heart biometrics offer the advantages of liveness detection, which provides strong tolerance to spoofing attacks. To date, several authentication methods primarily focusing on electrocardiogram (ECG) have demonstrated remarkable success; however, the degree of exploration with other cardiac signals is still limited. To this end, we discuss the challenges in various cardiac domains and propose future prospectives for developing effective heart biometrics systems in real-world applications.

An Efficient Security Model for Password Generation and Time Complexity Analysis for Cracking the Password

Passwords tend to be one of the most popular approaches to protect operating systems and user’s data also. Most businesses rely on password protection schemes, and secure passwords are incredibly necessary to them. The proposed model typically aims to impose protection by forcing users to obey protocols to build passwords. For user protection, password has become a prevailing method in terms of exposure to scarce tools. The main problem with password is its consistency or power, i.e. how simple (or how difficult) a third person can be "assumed" to enter the tool that you use while claiming to be you. In operating systems, text-based passwords remain the primary form of authentication, following major improvements in attackers' skills in breaking passwords. The proposed Random Character Utilization with Hashing (RCUH) is used for generation of new passwords by considering user parameters. The proposed model introduces a new framework to design a password by considering nearly 10 parameters from the user and also analyze the time for cracking the generated password to provide the system strength. The proposed model aims to generate an efficient security model for password generation by considering several secret parameters from the user. To break a set of consistency passwords, analysis is also performed on time for password cracking. The tests show a close positive correlation between guessing complexity and password consistency. The proposed model is compared with the traditional password generation and cracking models. The proposed model takes much time in cracking the password that improves the systems security.

RADIUS Authentication on Unifi Enterprise System Controller using Zero-Handoff Roaming in Wireless Communication

The demand for setting up a wireless LAN internet connectivity is almost mandatory for every commercial building, home, company, and educational institutions. With the growing number and height of buildings as well as the number of users, it has become essential to apply new techniques to provide better wireless network services, especially for security issue with many applications used by an attacker that can decrypt the traditional password to use network resources, that’s lead to poor network performance for providing network services for people authorized to use it. All of that is almost a very challenge issue when applying outdated techniques. In this research a wireless network has been created considering a large number of users in a multi-floor building using a new control system which can solve the problems by setting up RADIUS authentication via that wireless network with a webpage that automatically appears to the user immediately after connecting to the wireless radio signal and automatically gaining an IP address, lead user directly to the temporary page asking him for authentication, if the user has the right username and password or even sometimes a code called Voucher, he will get a package assigned to his priority. This technology will eliminate the vulnerability on the wireless connection and the unauthorized user will be discarded from the router, in addition of that authorized users will get authenticated to make better use of network resources.

A review on performance,security and various biometric template protection schemes for biometric authentication systems

Identifying a person based on their behavioral and biological qualities in an automated manner is called biometrics. The authentication system substituting traditional password and token for authentication and relies gradually on biometric authentication methods for verification of the identity of an individual. This proves the fact that society has started depending on biometric-based authentication systems. Security of biometric authentication needs to be reviewed and discussed as there are multiple points related to integrity and public reception of biometric-based authentication systems. Security and recognition accuracy are the two most important aspects which must be considered while designing biometric authentication systems. During enrollment phase scanning of biometric data is done to determine a set of distinct biometric feature set known as biometric template. Protection of biometric templates from various hacking efforts is a topic of vital importance as unlike passwords or tokens, compromised biometric templates cannot be reissued. Therefore, giving powerful protection techniques for biometric templates and still at that very moment preparing great identification accuracy is a good research problem nowadays, as well as in the future. Furthermore, efficiency under non-ideal conditions is also supposed to be inadequate and thus needs special attention in the design of a biometric authentication system. Disclosure of various biometric traits in miscellaneous applications creates a severe compromise on the privacy of the user. Biometric authentication can be utilized for remote user authentication. In this case, the biometric data of users typically called templates are stored in a server. The uniqueness and stability of biometrics ended it useful over traditional authentication systems. But, a similar thing made the enduring harm of a user’s identity in biometric systems. The architecture of the biometric system leads to several hazards that lead to numerous security concerns and privacy threats. To address this issue, biometric templates are secured using several schemes that are categorized as biometric cryptosystems, cancelable biometrics, hybrid methods, Homomorphic Encryption, visual cryptography based methods. Biometric cryptosystems and cancelable biometrics techniques provide reliable biometric security at a great level. However, there persist numerous concerns and encounters that are being faced during the deployment of these protection technologies. This paper reviews and analyses various biometric template protection methods. This review paper also reflects the limitations of various biometric template protection methods being used in present times and highlights the scope of future work.

Selection of handwritten signature dynamic indicators for user authentication

Selection and evaluation of handwritten signature indicators in user authentication systems are considered. An important and unresolved issue of information security is the effective identification of the user who accesses confidential information. Traditional password protection has a number of disadvantages. As an alternative to the password system or its addition, user identification by biometric characteristics is considered. An identifier that uses biometric characteristics is inextricably linked to the user and it is almost impossible to use it without authorization. The decision about the truth of the user of biometric authentication systems is made on the basis of comparison of his template with the data entered when trying to authenticate. The template is formed on the basis of studying the selected individual characteristics of the user. To do this, we use the biometric characteristics of users, which reflect the dynamic, behavioral characteristics of the person. It is proposed to use a handwritten signature as a biometric characteristic of the user. A handwritten signature is a socially and legally recognized biometric characteristic used for human authentication. It has a rather complex structure and high detail - all this makes solving the problem of user identification by mathematical methods quite complex and requires high computational costs. Another significant disadvantage is that handwritten authentication systems require the installation of additional specialized equipment, which makes the use of such systems as an ordinary means of authentication very expensive. To solve this problem, a scheme for implementing a computer data protection system against unauthorized access based on handwritten signatures using mobile devices based on the Android operating system as signature input devices is proposed. A method of biometric vector generation for use in dynamic biometric user authentication systems is proposed. The optimal characteristics are investigated and the efficiency of using the proposed form biometric characteristics vector is estimated. Certificates of copyrights registration for software applications developed during the work were received.

Authentication Database Leakage Detection

Authentication is the first step for any important applications. Password verification is widely employed in the Internet. Some advanced mechanisms including bio features, such as fingerprints or retina. However, digital password authentication credential is commonly used in the public. In other words, traditional password verification is still an important authentication credential mechanism for today’s online services. Password database may be compromised. Once if the database is stolen, it is dangerous and critical for any services. Consequently, password database leakage becomes an important issue. Detection and countermeasure are essential for such a disaster. Our research proposing a scheme based on a authentication database storage mapping method to detect possible leakage of authentication database. By multiple mapping mechanism, if the authentication database is stolen, an attacker could not know any user’s correct password. This method can reduce additional space of storing passwords with ability to detect security event for stolen authentication databases.

UIPA: User authentication method based on user interface preferences for account recovery process

Because of the global increment of various computer implementation, the usage of the internet has increased significantly. This phenomenon has mainly contributed to the growing usage of the World Wide Web, which is considered as one of the inventions in computer technology that changed the modes of human communication and exchange of information. As new work tools, an increasing number of people are using online systems. Accordingly, user authentication has become a significant issue in the online environment. The traditional password is still the most common means to verify user identity. However, strong passwords are sometimes difficult to remember, and thus a recovery procedure is needed. It can be said that the majority of online systems apply different methods of recovery, such as using challenging questions besides the out-of-band communication (i.e., email or SMS). Nevertheless, these approaches are still suffering from security and usability problems. This study therefore proposes a novel authentication method based on user interface (UI) preferences, called the User Interface Preferences Authentication (UIPA). This method can be applied with online systems that offer UI designs since it provides users with the chance to choose a preferred design of the interface on the basis of their personal characteristics. Hence, the user identity is then verified based on that interface. The performance, security, and usability of UIPA have been evaluated. The results of the experiments show that UIPA has a false positive rate of 0.416% and a false negative rate of 0%. Moreover, a user acceptance questionnaire, which has been designed based on the technology acceptance model, shows that users are pleased and willing to accept the proposed technique. To conclude, UIPA can be applied as an efficient account recovery method compared with the currently used methods. It could also help in addressing the security–usability trade-off problem.

The Surfing Attacks Secured Password Authentication System

People enjoy the convenience of on-line services, but online environments may bring many risks. We propose a virtual password concept involving a small amount of human computing to secure users’ passwords in on-line environments. We adopt user determined randomized linear generation functions to secure users’ passwords based on the fact that a server has more information than any adversary does. We analyze how the proposed scheme defends against phishing, key logger, and shoulder-surfing attacks. To the best of our knowledge, our virtual password mechanism is the first one which is able to defend against all three attacks together. In this work, we discussed how to prevent users’ passwords from being stolen by adversaries. We proposed a virtual password concept involving a small amount of human computing to secure users’ passwords in on-line environments. We also implemented the system to do some tests and survey feedback indicates the feasibility of such a system. In this paper, we discuss how to prevent users’ passwords from being stolen by adversaries in online environments and automated teller machines. We propose differentiated virtual password mechanisms in which a user has the freedom to choose a virtual password scheme ranging from weak security to strong security, where a virtual password requires a small amount of human computing to secure users’ passwords. Among the schemes, we have a default method (i.e., traditional password scheme), system recommended functions, user-specified functions, user-specified programs, and so on. A function/program is used to implement the virtual password concept with a tradeoff of security for complexity requiring a small amount of human computing

A New Deep Neural Architecture Search Pipeline for Face Recognition

With the widespread popularity of electronic devices, the emergence of biometric technology has brought significant convenience to user authentication compared with the traditional password and mode unlocking. Among many biological characteristics, the face is a universal and irreplaceable feature with simple detection methods and good recognition accuracy. Face recognition is one of the main functions of electronic equipment propaganda. The previous work in this field mainly focused on converting loss function in traditional deep convolution neural networks without changing the network structure. With the development of AutoML, neural architecture search (NAS) has shown remarkable performance in image classification tasks. In this paper, we first propose a new deep neural architecture search pipeline combined with NAS technology and reinforcement learning strategy into face recognition. We quote the framework of NAS, which trains the child and controller networks alternately. At the same time, we optimize NAS by incorporating evaluation latency into rewards of reinforcement learning and utilize the policy gradient algorithm to search the architecture automatically with the cross-entropy loss. The network architectures we searched out have achieved state-of-the-art accuracy in the large-scale face dataset, which achieved 98.77% top-1 in the MS-Celeb-1M dataset and 99.89% in LFW dataset with relatively small network size.

Killing the Password and Preserving Privacy With Device-Centric and Attribute-Based Authentication

Current authentication methods on the Web have serious weaknesses. First, services heavily rely on the traditional password paradigm, which diminishes the end-users' security and usability. Second, the lack of attribute-based authentication does not allow anonymity-preserving access to services. Third, users have multiple online accounts that often reflect distinct identity aspects. This makes proving combinations of identity attributes hard on the users. In this paper, we address these weaknesses by proposing a privacy-preserving architecture for device-centric and attribute-based authentication based on: 1) the seamless integration between usable/strong device-centric authentication methods and federated login solutions; 2) the separation of the concerns for Authorization, Authentication, Behavioral Authentication and Identification to facilitate incremental deployability, wide adoption and compliance with NIST assurance levels; and 3) a novel centralized component that allows end-users to perform identity profile and consent management, to prove combinations of fragmented identity aspects, and to perform account recovery in case of device loss. To the best of our knowledge, this is the first effort towards fusing the aforementioned techniques under an integrated architecture. This architecture effectively deems the password paradigm obsolete with minimal modification on the service provider's software stack.

A Robust Multimodel Biometric Crypto System

Biometric based authentication has several advantages over traditional password or PIN based authentication process because biometric is consists of physical or behavioural characteristics i.e fingerprint, face, Finger Knuckle Print (FKP), iris, voice etc. Unimodal biometric system h as some drawbacks i.e non universality, inter-class variation, intra-class variation; system can be circumvented by the skilled imposter etc. These drawbacks can overcome by multimodal biometric system as it combines more than one modality for authentication. When multimodal system combined with cryptography it makes system more robust and secure. In this paper, a robust multimodal biometric crypto system has been proposed, in which two modalities (FKP and face) are used for authentication of a person and one modality (fingerprint) is used for key generation. AES algorithm with fingerprint based key is used for securing the biometric templates. At authentication time, decision level fusion with AND rule is used for making the final decision. The proposed multimodal biometric crypto system is more robust and secure as compare with other multimodal biometric systems. Experimental results are shown with the help of MATLAB3. 2017b.

Fingerprint Protected Password Authentication Protocol

With the rapid development of industrial Internet of things (IIOT), a variety of cloud services have been deployed to store and process the big data of IIOT. The traditional password only authentication is unable to meet the needs of security situation in IIOT. Therefore, a lot of mobile phone assisted password authentication schemes have been proposed. However, in existing schemes, the secret information is required to be stored in the user’s mobile phone. Once the phone is lost, the secret information may be obtained by the opponent, which will bring irreparable loss to the user. To address the above problems, we propose a fingerprint protected password authentication scheme which has no need to store the secret parameter in the mobile phone. When a user logs in, he uses his mobile phone to generate the private key which is used to decrypt the encrypted text generated during the registration phase. The process of generating the private key needs to enter the password and the fingerprint. When the computer interacts with the mobile phone, the user’s password will be blinded so that it can protect the user’s password from adversary’s attacks. Theoretical analysis and experimental results show that our scheme improves the security of the user’s secret. Meanwhile, our scheme can resist the opponent’s dictionary attacks, replay attacks, and phishing attack. Our scheme can reduce the storage pressure of the mobile phone and is easy to deploy.

G-RAT | A Novel Graphical Randomized Authentication Technique for Consumer Smart Devices

User authentication is the process that is exercised millions of times around the globe by using different techniques and methods. The most prominent way of authentication is alphanumerical password forms that have been used for decades. Authorized access is becoming a challenging issue because of the introduction of modern technologies. In addition, traditional alphanumerical passwords have significant security issues, for example, humans forget the combination of keys due to the selection of a difficult key combination. Moreover, when they choose an easy key combination, this helps hackers to crack their passwords easily. Traditional passwords are also vulnerable to several types of attacks, for example, dictionary attack, brute force attack, and malware. To provide an easy and more secure authentication technique, a graphical password has been introduced in this paper for consumer electronic devices, which uses an image or a set of images for authentication. We have categorized the existing graphical password methods into recognition-based, cued-recall-based, pure-recall-based, and hybrid techniques. Due to the limitations of the existing graphical passwords, we have introduced a new technique, named graphical random authentication technique (gRAT), which generates a randomized set of images every time a user tries to authenticate him/herself by maintaining the security and usability at the same time. The gRAT technique is also tested by user-centric evaluation in terms of security, usability, usefulness, and utility, and the experimental results show that the proposed technique is more secure and useful in the real-life authentication applications.

Security and Accuracy of Fingerprint-Based Biometrics: A Review

Biometric systems are increasingly replacing traditional password- and token-based authentication systems. Security and recognition accuracy are the two most important aspects to consider in designing a biometric system. In this paper, a comprehensive review is presented to shed light on the latest developments in the study of fingerprint-based biometrics covering these two aspects with a view to improving system security and recognition accuracy. Based on a thorough analysis and discussion, limitations of existing research work are outlined and suggestions for future work are provided. It is shown in the paper that researchers continue to face challenges in tackling the two most critical attacks to biometric systems, namely, attacks to the user interface and template databases. How to design proper countermeasures to thwart these attacks, thereby providing strong security and yet at the same time maintaining high recognition accuracy, is a hot research topic currently, as well as in the foreseeable future. Moreover, recognition accuracy under non-ideal conditions is more likely to be unsatisfactory and thus needs particular attention in biometric system design. Related challenges and current research trends are also outlined in this paper.