Traditional Password Research Articles

Biometric Smartcard Authentication for Fog Computing

In the IoT scenario, things at the edge can create significantly large amounts of data. Fog Computing has recently emerged as the paradigm to address the needs of edge computing in the Internet of Things (IoT) and Industrial Internet of Things (IIoT) applications. In a Fog Computing environment, much of the processing would take place closer to the edge in a router device, rather than having to be transmitted to the Fog. Authentication is an important issue for the security of fog computing since services are offered to massive-scale end users by front fog nodes.Fog computing faces new security and privacy challenges besides those inherited from cloud computing. Authentication helps to ensure and confirms a user's identity. The existing traditional password authentication does not provide enough security for the data and there have been instances when the password-based authentication has been manipulated to gain access into the data. Since the conventional methods such as passwords do not serve the purpose of data security, research worksare focused on biometric user authentication in fog computing environment. In this paper, we present biometric smartcard authentication to protect the fog computing environment.

BIOMETRIC SMARTCARD AUTHENTICATION FOR FOG COMPUTING

In the IoT scenario, things at the edge can create significantly large amounts of data. Fog Computing has recently emerged as the paradigm to address the needs of edge computing in the Internet of Things (IoT) and Industrial Internet of Things (IIoT) applications. In a Fog Computing environment, much of the processing would take place closer to the edge in a router device, rather than having to be transmitted to the Fog. Authentication is an important issue for the security of fog computing since services are offered to massive-scale end users by front fog nodes.Fog computing faces new security and privacy challenges besides those inherited from cloud computing. Authentication helps to ensure and confirms a user's identity. The existing traditional password authentication does not provide enough security for the data and there have been instances when the password-based authentication has been manipulated to gain access into the data. Since the conventional methods such as passwords do not serve the purpose of data security, research worksare focused on biometric user authentication in fog computing environment. In this paper, we present biometric smartcard authentication to protect the fog computing environment.

Biometric re-authentication: an approach towards achieving transparency in user authentication

Providing fixed re-authentication attempts to the user in case of password mismatch is a very old concept. But as password based authentication mechanisms are prone to many security attacks, user’s biometric properties along with passwords are highly in use for user authentication these days. It will be more secure and convenient if re-authentication influenced by the biometric behavior of the user is applied in the authentication system. It is a challenging task to identify a genuine user using behavioral biometric due to its low repeatability and wide variation. So, to increase the efficiency and robustness of the authentication system in case of score mismatch, the clustering of user’s behavior and assigning different re-authentication attempt to different cluster is needed. In this paper, we have proposed a transparent fixed text, keystroke based user authentication framework, which will enhance the security of traditional password based authentication mechanism. A new classification algorithm and dynamic attempt allocation algorithm have been proposed which will make the authentication system smart enough to provide the genuine user a fare authentication attempt.

Designing an Authentication Mechanism using Biometric System

Biometrics" designates "life quantification" but the term is conventionally associated with the utilization of unique physiological characteristics to identify an individual. The application to which most people associate with biometrics is security. A number of biometric traits have been developed and are habituated to authenticate the identity of a person. The conception is to utilize the special characteristics of a person to identify him. By utilizing these special characteristics, we mean utilizing the features such as iris, face, dactylogram, signature etc. The method of identification predicated on biometrics characteristics is preferred over traditional passwords and PIN predicated methods for sundry reasons such as: The person to be identified is required to be physically present at the time-of-identification. Here we have utilized dactylogram and iris traits at feature level extraction. The features are extracted from the pre-processed images of iris and dactylogram. The main goal of optimization in this scenario is to enhance the technique of feature extraction by utilizing better steps.

Integrating Visual Mnemonics and Input Feedback With Passphrases to Improve the Usability and Security of Digital Authentication.

We developed a new authentication system based on passphrases instead of passwords. Our new system incorporates a user-generated mnemonic picture displayed during login, definition tooltips, error correction to reduce typographical errors, a decoy-based input masking technique, and random passphrase generation using either a specialized wordlist or a sentence template. Passphrases exhibit a greater level of security than traditional passwords, but their wider adoption has been hindered by human factors issues. Our assertion is that the added features of our system work particularly well with passphrases and help address these shortcomings. We conducted a study to evaluate our new system with a customized 1,450-word list and our new system with a 6-word sentence structure against the control conditions of a user-created passphrase of at least 24 characters and a system-generated passphrase using a 10,326-word list. Fifty participants completed two sessions so that we could measure the usability and security of the authentication schemes. With the new system conditions, memorability was improved, and security was equivalent to or better than the control conditions. Usability and overall ratings also favored the new system conditions over the control conditions. Our research presents a new authentication system using innovative techniques that improve on the usability and security of existing password and passphrase authentication systems. In computer security, drastic changes should never happen overnight, but we recommend that our contributions be incorporated into current authentication systems to help facilitate a transition from passwords to usable passphrases.

Enhancing security behaviour by supporting the user

Although the role of users in maintaining security is regularly emphasised, this is often not matched by an accompanying level of support. Indeed, users are frequently given insufficient guidance to enable effective security choices and decisions, which can lead to perceived bad behaviour as a consequence. This paper discusses the forms of support that are possible, and seeks to investigate the effect of doing so in practice. Specifically, it presents findings from two experimental studies that investigate how variations in password meter usage and feedback can positively affect the resulting password choices. The first experiment examines the difference between passwords selected by unguided users and those receiving guidance and alternative forms of feedback (ranging from a traditional password meter through to an emoji-based approach). The findings reveal a 30% drop in weak password choices between unguided and guided usage, with the varying meters then delivering up to 10% further improvement. The second experiment then considers variations in the form of feedback message that users may receive in addition to a meter-based rating. It is shown that by providing richer information (e.g. based upon the time required to crack a password, its relative ranking against other choices, or the probability of it being cracked), users are more motivated towards making strong choices and changing initially weak ones. While the specifics of the experimental findings were focused upon passwords, the discussion also considers the benefits that may be gained by applying the same principles of nudging and guidance to other areas of security in which users are often found to have weak behaviours.

Seed-based authentication for mobile clients across multiple devices

ABSTRACTAuthenticating users for mobile cloud apps has been a major security issue in recent years. Traditional passwords ensure the security of mobile applications, but it also requires extra effort from users to memorize complex passwords. Seed-based authentication can simplify the process of authentication for mobile users. In the seed-based authentication, images can be used as credentials for a mobile app. A seed is extracted from an image and used to generate one-time tokens for login. Compared to complex passwords, images are more friendly to mobile users. Previous work had been done in seed-based authentication which focused on providing authentication from a single device. It is common that a mobile user may have two or more mobile devices. Authenticating the same user on different devices is challenging due to several aspects, such as maintaining the same credential for multiple devices and distinguishing different users. In this article, we aimed at developing a solution to address these issues. We proposed multiple-device authentication algorithms to identify users. We adopted a one-time token paradigm to ensure the security of mobile applications. In addition, we tried to minimize the authentication latency for better performance. Our simulation showed that the proposed algorithms can improve the average latency of authentication for 40% at most, compared to single-device solutions.

A novel approach to classify users based on keystroke behavior

The contemporary society has been posing several security threats with evolution of modern devices. Keystroke dynamics is a behavioral biometrics that can be bolstered with the existing traditional password typing to validate the identity of the user. In the previous research a three dimensional model was constructed based on dwell time, pressure and tolerance. This paper extends the previous research focusing to improve the classification accuracy. It makes use of an unsupervised technique called self-organizing maps to cluster the data from a three dimensional space to a two dimensional space followed by a learning vector quantization algorithm to classify the user and learn from the feedback obtained. It provides simple but efficient stochastic learning to improve classification accuracy. Results show that the proposed approach leverages existing techniques with higher precision in identifying the user.

Behavioral Biometrics for User Authentication Using Self-Refreshing SOM

Password protection has been a crucial issue in computer security. Traditional password protection using string does not provide sufficient security for user authentication. On the other hand, implementation of static biometrics in replace of password protection is costly as specific devices are needed. This research proposes the use of Self-Organizing Map (SOM) method for keystroke pattern recognition as an alternative to password protection. A self-refreshing SOM method was also implemented to increase the adaptability of SOM toward inconsistencies in typing pattern. Two main experiments were conducted to examine the ability of SOM for user recognition and the ability of self-refreshing SOM to deal with typing pattern inconsistencies. The first experiment shows the ability of SOM to authenticate users with very accurate classification. Users were successfully recognized and non-users were successfully rejected. Second experiment shows the ability of selfrefreshing SOM to deal with inconsistencies in typing pattern of a same user in which smoother transition of data trend was obtained.

A Theoretical Framework for Password Security against Offline Guessability Attacks

Objectives: Security of textual passwords is increased against offline guessability attacks by using different encryption methods. However, even after encryption textual passwords may be guessed through brute-force or dictionary attacks. Method: In this paper, a theoretical framework is developed which provides guidelines for improving password security against offline guessability attacks such as brute force and dictionary attacks. In the proposed framework different password security layers are defined which convert a password into a form which is very difficult to crack through offline guessability attacks. The framework layers are implemented at application and database level. Findings: In the proposed framework a short and easy to remember password string is converted into a long and random string which does not provide any hint of original password. However, it is important that the methodology or logic used for implementing the framework layers should be hidden from the attackers because the layers’ methodology may provide a clue for password cracking. Layers of the proposed framework can be implemented with different logics, which are helpful in hiding the implementation details of the layers. Application/Improvements: Proposed framework is not only helpful for improving security of traditional textual password scheme but it can also improve the security for graphical password schemes against offline guessability attacks. Keywords: Authentication, Guessability Attacks, Privacy, Password Security, Textual Passwords

Access right management by extended password capabilities

With reference to a classic protection system featuring active subjects that reference protected objects, we approach the problem of identifying the objects that each subject can access, and the operations that the subject can carry out on these objects. Password capabilities are a classical solution to this problem. We propose a new form of password capability, called extended password capability (or e-capability, for short). An e-capability can specify any combination of access rights. A subject that holds a given e-capability can generate new e-capabilities for reduced sets of access rights. Furthermore, a subject that created a given object is in a position to revoke the access permissions granted by every e-capability referencing this object, completely or in part. The size of an e-capability is comparable to that of a traditional password capability. The number of passwords that need to be stored in memory permanently is kept to a minimum, and is equal to a single password for each object.

The Effect of Baroque Music on the Passpoints Graphical Password

Graphical passwords have been demonstrated to be the possible alternatives to traditional alphanumeric passwords. However, they still tend to follow predictable patterns that are easier to attack. The crux of the problem is users’ memory limitations. Users are the weakest link in password authentication mechanism. It shows that baroque music has positive effects on human memorizing and learning. We introduce baroque music to the PassPoints graphical password scheme and conduct a laboratory study in this paper. Results shown that there is no statistic difference between the music group and the control group without music in shortterm recall experiments, both had high recall success rates. But in long-term recall, the music group performed signifi- cantly better. We also found that the music group tended to set significantly more complicated passwords, which are usually more resistant to dictionary and other guess attacks. But compared with the control group, the music group took more time to log in both in short-term and long-term tests. Besides, it appears that background music does not work in terms of hotspots.

Strongly (k, d)-Graphical Labellings For Designing Graphical Passwords In Communication

The safety of the traditional text passwords is questioned by many users in the present information research. Graphical passwords become new research object of many researchers, who hope they can replace the existing text passwords and improve user account security. We are studying Topsnut-graphical passwords, which can be traced back to an idea of “topological structure plus number theory” proposed first by Hongyu Wang with her colleagues, and we found the equivalence between with Topsnut-graphics passwords of the trees having perfect matching. Through designing new parametric graphical labellings, we hope to enrich the variety of Topsnut-graphical passwords, and study the relationship between new parametric graphic labellings and existing labellings on trees having perfect matching. In addition, we also found, by two kinds of special operations, trees having perfect matching can be converted into paths perfect matching, and the nature of the original passwords remains unchanged. Our results can be provided to two or more banking users, and our method can easily be converted into polynomial time algorithms.

A secure one time password protocol schema

Since the invention of the internet, text-based passwords have been utilised to authenticate users. This method is the most prevalent form of authentication but it has many drawbacks. An alternative password protocol is necessary to overcome the drawbacks in the traditional password system. This research proposes a novel password protocol that overcomes most password attacks. This research highlights many password attacks and shows how the proposed protocol mitigates them. Instead of a single static password being used to authenticate an individual, passwords are created based on the user's input in three password boxes and the proposed protocol reorders the textboxes randomly. A hacker can capture a password generated by login requests, but password attacks will be mitigated due to the non-deterministic random order in each login request. The proposed password protocol architecture makes any captured data worthless.

A secure one time password protocol schema

Since the invention of the internet, text-based passwords have been utilised to authenticate users. This method is the most prevalent form of authentication but it has many drawbacks. An alternative password protocol is necessary to overcome the drawbacks in the traditional password system. This research proposes a novel password protocol that overcomes most password attacks. This research highlights many password attacks and shows how the proposed protocol mitigates them. Instead of a single static password being used to authenticate an individual, passwords are created based on the user's input in three password boxes and the proposed protocol reorders the textboxes randomly. A hacker can capture a password generated by login requests, but password attacks will be mitigated due to the non-deterministic random order in each login request. The proposed password protocol architecture makes any captured data worthless.

PBUA: A Dynamic User Authentication Mechanism for Secure MobiCloud Environment

Objectives: Authenticating the MobiCloud users using traditional passwords, biometrics is prone to shoulder surfing attack and need external device. Pattern Based User Authentication (PBUA) mechanism is introduced to identify and authenticate the users in MobiCloud environment. Methods/ Statistical Analysis: To authenticate the users, the whole process is divided into two phases namely, identification and authentication. Dynamic patterns are generated using random mathematical function to select the patterns from the Identity Management (IdM) Server. Pattern matching operation is done using the hash-based technique to match the image pattern sequences quickly with the actual pattern. Findings: Experimental results show that the proposed PBUA is strong enough against shoulder surfing attack. The time taken for pattern matching is very less when compared to existing pattern matching mechanisms. Application/Improvement: PBUA does not need any intermediate table as the patterns are matched directly with original patterns. The complexity of the algorithm is reduced by , thus the efficiency is improved n2 times. Pattern updation is not required which reduces the user’s burden.

Utilizing Keystroke Dynamics as an Additional Security Measure to Password Security in Computer Web-based Applications - A Case Study of UEW

Keystroke Dynamics is one of the well-known and economical behavioral biometric developments that attempt to recognize the genuineness of a client when the client invokes his keystrokes from a computer keyboard. The keystrokes pattern helps to determine the typing behaviour of users of the system thus serves as the benchmark for identity verification. This paper displays the use of biometrics to augment traditional passwords security in computer web-based application systems. The system was evaluated base on these criteria; authenticating legitimate user against imposter user and a guess imposter user of the system. Also, evaluation of character timings was performed to know the best combination of strings to use in setting passwords in systems where keystroke dynamics would be applied in order to achieve high efficiency. This study concludes that the use of keystrokes dynamics in augmenting password security in computer web-based applications should be embraced. General Terms Keystroke dynamics web-based application.

Password Entry Times for Recognition-based Graphical Passwords

Graphical passwords offer a more memorable alternative to traditional, text-based passwords. Among current contenders, cued-recall based click-point or gesture centered authentication systems like Microsoft’s picture gesture authentication (PGA) have been commercially more successful than recognition based systems (e.g., PassFaces). One perceived drawback of graphical authentication systems in general and especially recognition based authentication is the assumption that graphical authentication is slower and thus less user-friendly than traditional password entry via keyboard. This paper addresses these concerns and demonstrates a lower limit for recognition-based password entry times achievable with sufficient practice. While slightly slower than traditional keyboard based passwords, the entry speed of often-used graphical passwords is shown to reach 10 bits/s in an optimized configuration, which is sufficient for everyday use (3-6s per authentication sequence @ 36 bits) and exceeds the reported speed of similarly secure text-based passwords on non-traditional devices using virtual keyboards.

Biometrics Systems and Technologies: A survey

In a nutshell, a biometric security system requires a user to provide some biometric features which are then verified against some stored biometric templates. Nowadays, the traditional password based authentication method tends to be replaced by advanced biometrics technologies. Biometric based authentication is becoming increasingly appealing and common for most of the human-computer interaction devices. To give only one recent example, Microsoft augmented its brand new Windows 10 OS version with the capability of supporting face recognition when the user login in. This chapter does not intend to cover a comprehensive and detailed list of biometric techniques. The chapter rather aims at briefly discussing biometric related items, including principles, definitions, biometric modalities and technologies along with their advantages, disadvantages or limitations, and biometric standards, targeting unfamiliar readers. It also mentions the attributes of a biometric system as well as attacks on biometrics. Important reference sources are pointed out so that the interested reader may gain deeper in-depth knowledge by consulting them.

A Review on Noisy Password, Voiceprint Biometric and One-Time-Password

In this paper, we review the Noisy password, Voiceprint biometric and One-Time-Password. The most common method used for authentication is static passwords. The traditional passwords are vulnerable to dictionary attacks, shoulder surfing and eves dropping. The noisy passwords can be used as an alternative to the static password. The noisy password attempts to mitigate above mentioned problems. The biometric technique like fingerprints, palm-vein scan, etc. can be used for personal recognition. But as compared to other biometric, Voiceprint requires less implementation cost. E-commerce application uses One-Time-Password to perform E-transaction. Hence it becomes necessary to provide security while transmitting the OTP.