Traditional Password Research Articles

Biometric Cryptosystem Based Energy Attack Analysis

Biometric cryptosystem provides a seamless connection between the biometrics and traditional password, and it represents a new development in the next generation cryptography. Even if the biometric cryptosystem is secure in algorithmic design, it may still be vulnerable to side-channel attack due to the physical leakage. To assess the possible side-channel attack on biometric cryptosystem, a secure biometric cryptosystem is designed and by measuring the energy consumption leaked. The simulation shows that the biometric cryptosystem can be extracted with bits of energy leakages. DOI: http://dx.doi.org/10.11591/telkomnika.v10i5.1285

Cognitive Approaches to Password Memorability – the Possible Role of Story-Based Passwords

The inverse relation between memorability of a password and the strength of a password presents a unique optimization opportunity for cognitive approaches. While graphical passwords have received most of the attention to date, the use of verbal material to create memorable passwords presents some distinct advantages that might make story-based passwords a serious contender in the race to the ultimate “cognitive” password system. In a first pilot study with 385 participants we investigated the memory for different story elements for short (10 min) and long (1 week) retention intervals. Even a non-optimized story yields better long-term performance than traditional alphanumeric passwords and is comparable to the lower end of graphical password systems.

Integrating Geometric Transformation with Cancelable Template

Today biometric play an important role in securing the systems. It has many advantages over traditional password and token-based authentication schemes. Biometrics-based transformation especially fingerprint based authentication receiving a lot of attention. However security and privacy of fingerprint templates still remain an issue. If the biometric identifier is compromised, it is lost forever and possibly for every application where the biometric is used. The proposal of this paper is used to integrate the geometric transformation with cancelable template to overcome the above problem.

Scalable MD5 Crypt Cracker on PetaScale Supercomputer

MD5 Crypt is a cryptographic algorithm used commonly in UNIX system for authentication. Thanks to the additional randomization of the salt and complexity of the scheme, it makes the traditional password cracking techniques invalid on common computing systems so that the security of the system is guaranteed. As a result of the thriving of petaflops heterogeneous supercomputer system in recent decades, the security of MD5 Crypt is facing a threat of brute-force attack again. However, the complexity of heterogeneous programming and the sophistication of large-scale parallelism still hamper the password recovering. In this paper, we implemented brute-force attack of MD5 Crypt on Tianhe-1A，the world’s fastest supercomputer， by organizing the assignment between CPU and GPU reasonably and making several optimizations according to MD5 Crypt for GPU. Based on the experimental results, our algorithm achieves a great scalability. It checked more than 1.8 billion passwords in a second on the full system. Thus it issues a new challenge to the security of MD5 crypt for authentication.

Design of a Wireless Fingerprint Authentication Service Platform Using the SOPC Technology

Fingerprint authentication is becoming an important security requirement in various embedded systems. While traditional identification method, user ID plus password cannot satisfy users’ needs due to various defects, they are increasingly being replaced by biometric technologies such as fingerprint, face, and voice recognition, which are known to provide higher levels of security for user authentication. In this paper, an effective wireless fingerprint authentication system is presented. We designed the wireless fingerprint authentication based on Altera's Nios II processor. The whole system design includes real-time fingerprint image collection, image preprocessing, feature extraction, matching processes, a database and wireless transmission.

Performance Evaluation of Password Authentication using Associative Neural Memory Models

They are many ways of providing security to user resources. Password authentication is a very important system security procedure to secure user resources. In order to solve the problems with traditional password authentication several methods have been introduced to provide password authentication using Associative Memories like Back Propagation Neural Network (BPNN),Hopfield Neural Network(HPNN),Bidirectional Associative Memories(BAM),Brain-State-in-a Box(BSB). Later Password authentication has been provided using Context-Sensitive Associative Memory Method (CSAM). Here in this paper we proposed performance analysis of password authentication schemes using Associative memories and CSAM using graphical Images. We observe that in comparison to existing layered and associative neural network techniques for graphical images as password, the CSAM method provides better accuracy and quicker response time to registration and password changes.

User Authentication using Native Language Passwords

Information security is necessary for any organization. Intrusion prevention is the basic level of security which requires user authentication. User can be authenticated to a machine by passwords. Traditional textual passwords are vulnerable to many attacks. Graphical passwords are introduced as alternatives to textual passwords to overcome these problems. This paper introduces native language passwords for authentication. Native language character set consists of characters with single or multiple strokes. User can select one (or more) character(s) for his password. The shape and strokes of the characters are used for authentication.

A Novel Approach For Pass Word Authentication Using Bidirectional Associative Memory

Password authentication is a very important system security procedure to gain access to user resources. In the Traditional password authentication methods a server has check the authenticity of the users. In our proposed method users can freely select their passwords from a predefined character set. They can also use a graphical image as password. The password may be a character or an image it will be converted into binary form and the binary values will be normalized. Associative memories have been used recently for password authentication in order to overcome drawbacks of the traditional password authentication methods. In this paper we proposed a method using Bidirectional Associative Memory algorithm for both alphanumeric (Text) and graphical password. By doing so the amount of security what we provide for the user can be enhanced. This paper along with test results show that converting user password in to Probabilistic values and giving them as input for BAM improves the security of the system

An enhanced drawing reproduction graphical password strategy

Passwords are used in the vast majority of computer and communication systems for authentlcation. The greater security and memorability of graphical passwords make them a possible alternative to traditional textual passwords. In this paper we propose a new graphical password scheme called YAGP, which is an extension of the Draw-A-Secret (DAS) scheme. The main difference between YAGP and DAS is soft matching. The concepts of the stroke-box, image-box, trend quadrant, and similarity are used to describe the images characteristics for soft matching. The reduction in strict user input rules in soft matching improves the usability and therefore creates a great advantage. The denser grid granubtrity enables users to design a longer password, enlarging the practical password space and enhancing security. Meanwhile, YAGP adopts a triple-register process to create multi-templates, increasing the accuracy and memorability of characteristics extraction. Experiments illustrate the effectiveness of YAGP.

On designing usable and secure recognition-based graphical authentication mechanisms

In this article we present the development of a new, web-based, graphical authentication mechanism called ImagePass. The authentication mechanism introduces a novel feature based on one-time passwords that increases the security of the system without compromising its usability. Regarding usability, we explore the users’ perception of recognition-based, graphical authentication mechanisms in a web environment. Specifically, we investigate whether the memorability of recognition-based authentication keys is influenced by image content. We also examine how the frequency of use affects the usability of the system and whether user training via mnemonic instructions improves the graphical password recognition rate. The design and development process of the proposed system began with a study that assessed how the users remember abstract, face or single-object images, and showed that single-object images have a higher memorability rate. We then proceeded with the design and development of a recognition-based graphical authentication mechanism, ImagePass, which uses single-objects as the image content and follows usable security guidelines. To conclude the research, in a follow-up study we evaluated the performance of 151 participants under different conditions. We discovered that the frequency of use had a great impact on users’ performance, while the users’ gender had a limited task-specific effect. In contrast, user training through mnemonic instructions showed no differences in the users’ authentication metrics. However, a post-study, focus-group analysis revealed that these instructions greatly influenced the users’ perception for memorability and the usability of the graphical authentication. In general, the results of these studies suggest that single-object graphical authentication can be a complementary replacement for traditional passwords, especially in ubiquitous environments and mobile devices.

Inverse Cookie-based Virtual Password Authentication Protocol

Password is the most commonly used authentication technique to authenticate the users on the web. Password based authentication protocols are susceptible to dictionary attacks by means of automated programs because most of the user chosen passwords are limited to the user's personal domain. In this paper, we propose an inverse cookie based virtual password authentication protocol that preserves the advantages of basic password authentication and simultaneously increasing the efforts required for online dictionary attacks. The Web server stores the cookie on the client's computer when the client has not submitted correct identity and password for its authentication to the Web server. The legitimate client can easily authenticate itself to the Web server from any computer irrespective of whether that computer contains cookie or not. However, the computational efforts required from the attacker during login on to the Web server increases with each login failure. The client generated virtual password is different for the same user in different sessions of Secure Socket Layer (SSL) protocol. The concept used in this paper is to combine traditional password authentication with a challenge that is easy to answer by the legitimate client and the computational cost of authentication increases for the attacker with each login failure. Therefore, even the automated programs can not launch online dictionary attacks on the proposed protocol. This protocol provides better protection against different types of attacks launched by the attacker. The proposed protocol is easy to implement and it removes some of the deficiencies of previously suggested password based authentication protocols.

Using trusted computing for privacy preserving keystroke-based authentication in smartphones

Smartphones are increasingly being used to store personal information as well as to access sensitive data from the Internet and the cloud. Establishment of the identity of a user requesting information from smartphones is a prerequisite for secure systems in such scenarios. In the past, keystroke-based user identification has been successfully deployed on production-level mobile devices to mitigate the risks associated with naive username/password based authentication. However, these approaches have two major limitations: they are not applicable to services where authentication occurs outside the domain of the mobile device--such as web-based services; and they often overly tax the limited computational capabilities of mobile devices. In this paper, we propose a protocol for keystroke dynamics analysis which allows web-based applications to make use of remote attestation and delegated keystroke analysis. The end result is an efficient keystroke-based user identification mechanism that strengthens traditional password protected services while mitigating the risks of user profiling by collaborating malicious web services. We present a prototype implementation of our protocol using the popular Android operating system for smartphones.

Cookie-Based Virtual Password Authentication Protocol

ABSTRACT The password is the most common technique used to authenticate Web users. Password-based authentication protocols are susceptible to automated dictionary attacks because most passwords are chosen by users from their personal domain. In this paper, we propose a cookie-based virtual password authentication protocol that preserves the advantages of conventional password authentication while simultaneously increasing the efforts required for online dictionary attacks. The Web server stores the cookie on the user's machine if the legitimate user authenticates to the Web server. Thereafter, the legitimate user can easily authenticate to the Web server from a machine that contains the cookie. However, the legitimate user requires some additional computational efforts during login from a machine that does not contain the cookie. The computation efforts required from the attacker during login to the Web server increases exponentially with each login failure. The user generated virtual password is different for the same user in different sessions of Secure Socket Layer (SSL) protocol. The concept used in this paper is to combine traditional password authentication with a challenge that is easy to answer by the legitimate user but computational cost increases for the attacker with each login failure. Therefore, even the automated programs cannot launch online dictionary attacks on the proposed protocol. This protocol provides good security against different types of attacks launched by the attacker. The proposed protocol is easy to implement and removes some of the drawbacks of earlier proposed password-based authentication protocols.

A Comprehensive Agent-Based Safety Solution Meeting the Controllable Work System

This paper proposes and implements a comprehensive software system based on agents and mobile agents techniques, which firstly deals with the network admission control and authorization, adopting the traditional password authentication schema and an intelligent, flexible sensor whose kernel is the NDIS-hooking driver. Agent Message Protocol over UDP/TCP is proposed to secure and encrypt the communication data among stationary agents and server components, which eradicates malicious codes embedded or spread in the internal network. In order to avoid the above software agents mangled or destroyed, the proactive method of Grid Scanning model based on the Agent Message Protocol and Address Resolution Protocol can detect and spoof those clients whose agents are mangled; and if the users forge the logon info, this system can prevent the clients escaping from the control with the dual verification mechanism. Finally, the mobile agent infrastructure with flexible and effortless integration with this security system is introduced and implemented, which supports security access to resources on the controllable clients. Such solution in the internal network satisfies the security-related requirements of availability, expansibility, responsibility, and self-defense, as well as the non-security-related requirements of real-time, veracity, stability and flexibility.

Advanced smart card based password authentication protocol

Password-based authentication is widely used for systems that control remote access to computer networks. In order to address some of the security and management problems that occur in traditional password authentication protocols, research in recent decades has focused on smart card based password authentication. In this paper, we show that the improved smart card authentication scheme proposed by Xu-Zhu-Feng is vulnerable to internal and impersonation attacks. We propose an improvement of their solution, present a new efficient strong smart card authentication protocol, and demonstrate that the new protocol satisfies the requirements of strong smart card authentication and is more efficient.

Retina and Iris Based Multimodal Biometric Fuzzy Vault

authentication technology is gaining much importance as it serves as a powerful alternative for traditional password based authentication. In the current scenario securing the biometric template against attack is an important issue. Fuzzy vault is a proven biometric crypto system that is used to protect biometric templates and secret data. Multi biometric systems are more secure compared to their single biometric counterparts. In this work, fuzzy vault framework is used to secure both retina and iris template. Retina and iris can be used in high security applications like access control, military applications, border security control. The proposed multimodal fuzzy vault is constructed with feature points extracted from retina and iris. Combination of retina and iris enhances the user convenience as they can be captured from the user by the same device. This work measures the security of the resultant vault by using min-entropy.

Security analysis of password hardened multimodal biometric fuzzy vault with combined feature points extracted from fingerprint, iris and retina for high security applications

Establishing the identity of an individual is very crucial in the present times. Biometric authentication has proved itself superior compared to the traditional password based authentication in many respects. Nevertheless, biometric systems are prone to a variety of attacks. The stored biometric template attack is the most severe of all the attacks. Hence providing security to this form is of prime importance. Moreover, biometric templates may reveal private information about diseases and disorders of a person. Biometric templates cannot be reissued on spoofing. Therefore, apart from security; biometric templates should be imparted with revocability. This work secures the multimodal biometric templates by the crypto biometric fuzzy vault framework. Fuzzy vault suffers from certain limitations like non-revocability, cross matching and lack of diversity. The fuzzy vault is hardened with a password to overcome these limitations. Multi biometric systems are more resistive towards spoof attacks compared to their unimodal counterparts. This work extracts feature points from three different biometric modalities namely fingerprint, iris and retina. The password-hardened revocable templates are then secured in a multimodal biometric fuzzy vault. Passwords act as an additional layer of security apart from providing revocability. Combining the retina with the iris improves user convenience as both the capturing devices can be mounted in a single device. Users having problems with eye biometrics can utilize fingerprint and vice versa. The security of the multimodal password hardened fuzzy vault is measured using min-entropy. The number of computations required to compromise the vault by brute force attack is also calculated.

Securing traffic at QoS-aware residential gateway using biometric signatures

Home networks are becoming ubiquitous. Multimedia is a primary home network application that is challenging bandwidth capabilities with respect to QoS and also creating issues regarding authorized access to the home network and its digital content. To deal with these issues, this study presents an embedded QoS-aware residential gateway (EmQRG) in the home network which classifies forwarded traffic for optimal use of bounded network bandwidth resources and, instead of traditional password methodology, requires bimodal biometric recognition of users. A laboratory EmQRG testbed with bimodal biometric recognition system (BBRS) is implemented via class-based queuing (CBQ) bandwidth management in a 3-PC network including a real DiffServ-capable CBQ-capable router, CCD camera and optical fingerprint reader. Novel computational methods are used for face and fingerprint analysis and recognition. It is confirmed that combining two biometric modalities improves performance, particularly for the false acceptance rate (FAR) that is considered the most serious home security problem. Experimental results demonstrate efficiency and robustness of both the EmQRG and the BBRS.

Delayed password disclosure

We present a new authentication protocol called Delayed Password Disclosure (DPD). Based on the traditional username and password paradigm, the protocol's goal is aimed at reducing the effectiveness of phishing/spoofing attacks that are becoming increasingly problematic for Internet users. This is done by providing the user with dynamic feedback while password entry occurs. While this is a process that would normally be frowned upon by the cryptographic community, we argue that it may result in more effective security than that offered by currently proposed 'cryptographically acceptable' alternatives. While the protocol cannot prevent partial disclosure of one's password to the phisher, it does provide a user with the tools necessary to recognise an ongoing phishing attack, and prevent the disclosure of his/her entire password, providing graceful security degradation.

Generating Cancelable Fingerprint Templates

Biometrics-based authentication systems offer obvious usability advantages over traditional password and token-based authentication schemes. However, biometrics raises several privacy concerns. A biometric is permanently associated with a user and cannot be changed. Hence, if a biometric identifier is compromised, it is lost forever and possibly for every application where the biometric is used. Moreover, if the same biometric is used in multiple applications, a user can potentially be tracked from one application to the next by cross-matching biometric databases. In this paper, we demonstrate several methods to generate multiple cancelable identifiers from fingerprint images to overcome these problems. In essence, a user can be given as many biometric identifiers as needed by issuing a new transformation "key." The identifiers can be cancelled and replaced when compromised. We empirically compare the performance of several algorithms such as Cartesian, polar, and surface folding transformations of the minutiae positions. It is demonstrated through multiple experiments that we can achieve revocability and prevent cross-matching of biometric databases. It is also shown that the transforms are noninvertible by demonstrating that it is computationally as hard to recover the original biometric identifier from a transformed version as by randomly guessing. Based on these empirical results and a theoretical analysis we conclude that feature-level cancelable biometric construction is practicable in large biometric deployments.