User Authentication Process Research Articles

Privacy-preserving attribute aggregation in eID federations

Personalized electronic services, e.g. from the e-government domain, need to reliably identify and authenticate users. During user-authentication processes, the electronic identity of the respective user is determined and required additional attributes, e.g. name and date of birth, linked to this identity are collected. This attribute-collection process can become complex, especially if required attributes are distributed over various attribute providers that are organized in a federated identity-management system. In many cases, these identity management systems rely on different ontologies and make use of different languages. Hence, identity federations, such as the one currently established across the European Union, require effective solutions to collect user attributes from different heterogeneous sources and aggregate them to a holistic user facet. At the same time, these solutions need to comply with minimum disclosure rules to preserve users’ privacy. In this article, we propose and introduce a solution for privacy-preserving attribute aggregation. Our solution combines attributes from different domains using ontology alignment and makes use of locality sensitive hashing functions to preserve users’ privacy. Evaluation results obtained from conducted experiments demonstrate our solution’s advantages for both, service providers and users. While service providers can be provided with a larger set of attributes, users remain in full control of their data and can decide on which of their attributes shall be revealed.

Improved User Authentication Process for Third-Party Identity Management in Distributed Environment

Third-party identity management user authentication process using single sign-on (SSO) in distributed computer networks requires modification as the process of authenticating user to log into relying party (RP) resources by either identity provider (IDP) or hybrid relying party (HRP) depend always on the authentication of user logins. In this research an algorithm is proposed to authenticate user only once by recording and encrypting user credential with one-way hashing algorithm (SHA2), this simplifies user subsequent logins into relying party by confirming user credentials without other authentication by IDP or HRP. Authentication time and response time continuous time plot of the proposed algorithm was plotted with respect to the arrival time of users in which we show the relationship of authentication time and response time with random arrival rate of users.

FingerAuth: 3D magnetic finger motion pattern based implicit authentication for mobile devices

Smart devices, as the most widely used platforms for the mobile cyber–physical system (CPS) applications, such as smart home and health care systems, are becoming the prime targets of various attackers for users’ considerable private and confidential data in them. To fight against side channel attacks aiming to obtain credentials, e.g., passwords, during the process of user authentication, touch pattern based implicit authentication has been proposed. However, such a defensive technique fails to obtain an entire pattern of user operation by deriving user operation data via a touch-enabled screen. Considering that user operations, including on-screen and in-air finger movements, are performed in three-dimensional (3D) space, we propose a novel 3D magnetic finger motion pattern based implicit authentication technique, referred to as FingerAuth. To use FingerAuth, a user operates on her mobile device, e.g., texting a message and browsing websites, with a magnetic ring on the finger she uses. With the help of a built-in three-axis magnetometer on the mobile device, we can derive the 3D magnetic finger motion pattern as a human behavioral feature for implicitly authenticating the user. By using machine learning techniques, a robust 3D magnetic finger motion pattern detection model can be constructed. Two rounds of usability tests are conducted for the evaluation of FingerAuth. In the initial usability test targeting a given group of smart device users, we test the uniqueness of the proposed trait in typing scenario, achieving high average accuracy of 96.38%, low average false acceptance rate (FAR) of 4.06%, and false rejection rate (FRR) of 3.18%. In the second user usability test, we further evaluate the permanence of 3D finger motion pattern in multiple user–device interaction scenarios. There is an interim of two-week period between the training data collection phase and the testing data collection phase. The results of the high accuracy of over 80%, as well as the FAR and FRR of below 15%, indicate the applicability of FingerAuth.

РАЗРАБОТКА ОБЩЕЙ СТРУКТУРЫ АЛГОРИТМИЧЕСКОГО ОБЕСПЕЧЕНИЯ СБОРА И АНАЛИЗА ДАННЫХ ДЛЯ ОЦЕНКИ ЭМОЦИОНАЛЬНОЙ ЭКСПРЕССИИ ПРИ БИОМЕТРИЧЕСКОЙ АУТЕНТИФИКАЦИИ СУБЪЕКТОВ

Mimicry, emotions and emotional expression of a user of the information system deployed on the automated workplace are considered as biometric characteristics of the authentication system. Specific features of emotional expression of the alleged intruder, whose aim is violating information security through illegal infiltration into the information environment, have been determined. The methods and already implemented systems of automated identification of emotions according to facial expressions of the researched person have been described. It is proposed to modernize and to adapt these methods to solve the problems of information protection, namely, for use in the biometric system. It is suggested to consider the manifestation coefficient, duration of the moment of the onset of the facial muscles activity, duration of the moment of facial muscles activity culmination, and duration of the moment of disappearance of facial muscles activity of each basic emotion of a person (joy, surprise, sadness, fear, anger, contempt and disgust) as biometric characteristics. The developed algorithmic support consists of an algorithm that performs the determination of the minimum and maximum thresholds of each of the biometric characteristics and algorithm of the entire user authentication process and the architecture of the system to protect against unauthorized access to the information system. Also, the article gives an example of a user profile that is stored in a database, processed and improved by the system in the course of its operation.

An Efficient Biometric Based Remote User Authentication Technique for Multi-server Environment

With the increasing demand of remote user authentication process for accessing many Internet based applications, biometrics based authentication mechanisms are highly being adopted. But using biometrics for these authentication mechanisms the features need to be captured and database need to be stored somewhere. Storing such a huge amount of biometric data itself has many security and privacy issues. Like revoking compromised biometric template is impossible. So template security is very important here. But due to low repeatability of biometrics, it is a challenging task to ensure template security while achieving high recognition performance of valid user. Hence, here we have proposed a keystroke based multi-server authentication mechanism which uses bio-hash template security technique. The bio-hash transform a biometric trait in an invariant feature which helps to increase the recognition performance. A comparison of normal keystroke dynamics and bio-hashed keystroke dynamics authentication performance has been done here. The bio-hashed keystroke shows better ERR of 0.15% compared to plain keystroke with 0.231% ERR.

Implementation of a single sign-on system between practice, research and learning systems.

Multiple specialized electronic medical systems are utilized in the health enterprise. Each of these systems has their own user management, authentication and authorization process, which makes it a complex web for navigation and use without a coherent process workflow. Users often have to remember multiple passwords, login/logout between systems that disrupt their clinical workflow. Challenges exist in managing permissions for various cadres of health care providers. This case report describes our experience of implementing a single sign-on system, used between an electronic medical records system and a learning management system at a large academic institution with an informatics department responsible for student education and a medical school affiliated with a hospital system caring for patients and conducting research. At our institution, we use OpenMRS for research registry tracking of interventional radiology patients as well as to provide access to medical records to students studying health informatics. To provide authentication across different users of the system with different permissions, we developed a Central Authentication Service (CAS) module for OpenMRS, released under the Mozilla Public License and deployed it for single sign-on across the academic enterprise. The module has been in implementation since August 2015 to present, and we assessed usability of the registry and education system before and after implementation of the CAS module. 54 students and 3 researchers were interviewed. The module authenticates users with appropriate privileges in the medical records system, providing secure access with minimal disruption to their workflow. No passwords requests were sent and users reported ease of use, with streamlined workflow. The project demonstrates that enterprise-wide single sign-on systems should be used in healthcare to reduce complexity like "password hell", improve usability and user navigation. We plan to extend this to work with other systems used in the health care enterprise.

User identification and authentication system based on a hybrid fuzzy approach

This paper is devoted to organizing the process of user identification and authentication in an automatic system of a university. It is shown that currently available solutions for identification and authentication data mining do not ensure adequate security of the network as a whole. Fuzzy logic is used as the main solution for the problem of analyzing the sets of subjects and objects. Functions for evaluating separability and compactness, as well as an optimized maximin method, are used. An algorithm for clustering indefinite subjects and objects is presented.

User-centered Security for Protecting Patient Privacy for E-health Cloud Computing

E-health is the present communication structure in medicine especially in developed countries. Toward enhancing the quality of care and reduce the health care delivery cost, cloud Computing technology has been adopted. In recent times services such as exchange and share medical data among staff and then to the patients are one the main reasons behind using this technology in e-health. Hence, using cloud computing in e-health has many challenges particularly when dealing with electronic healthcare records (EHR).
 Cloud computing is an agglomeration of technologies, operating systems, storage, networking, virtualisation, each fraught with inherent security issues. For example, browser-based attacks, denial of service attacks and network intrusion become carry-over risks into cloud computing. It differs from traditional computing paradigms as it is scalable which can be encapsulated as an abstract entity to provide different levels of services to the clients.
 In this paper, we identified the users of e-health such as doctors, nurses and family members and then their security requirements are identified. An application with five stages toward encryption and decryption process is designed. Since trust is a critical factor in cloud computing, this project will investigate the obstacles that cause this technology lose its credibility in certain clouds. To enhance user authentication process, two-tier mechanisms are used to identify the user’s identity. While in confidentiality, it should be assured that information is shared only among authorised people or vendors by applying powerful cryptographic concepts. In this prototype application, the user will be able to protect his/her data and is responsible for providing a high level of security as long as these data are highly private and important.

An Anonymous User Authentication and Key Agreement Scheme Based on a Symmetric Cryptosystem in Wireless Sensor Networks.

In wireless sensor networks (WSNs), a registered user can login to the network and use a user authentication protocol to access data collected from the sensor nodes. Since WSNs are typically deployed in unattended environments and sensor nodes have limited resources, many researchers have made considerable efforts to design a secure and efficient user authentication process. Recently, Chen et al. proposed a secure user authentication scheme using symmetric key techniques for WSNs. They claim that their scheme assures high efficiency and security against different types of attacks. After careful analysis, however, we find that Chen et al.’s scheme is still vulnerable to smart card loss attack and is susceptible to denial of service attack, since it is invalid for verification to simply compare an entered ID and a stored ID in smart card. In addition, we also observe that their scheme cannot preserve user anonymity. Furthermore, their scheme cannot quickly detect an incorrect password during login phase, and this flaw wastes both communication and computational overheads. In this paper, we describe how these attacks work, and propose an enhanced anonymous user authentication and key agreement scheme based on a symmetric cryptosystem in WSNs to address all of the aforementioned vulnerabilities in Chen et al.’s scheme. Our analysis shows that the proposed scheme improves the level of security, and is also more efficient relative to other related schemes.

Trust Enhancing Model for Cloud Environment

is a technology in which data can be stored and access at remote server without the installation of software as well as hardware being installed at client side. The quick growth in field of computing has also increased data security concerns. Security is a constant issue for open systems and internet. When we are thinking about security, cloud really suffers a lot. Lack of security is the biggest hurdle in wide adoption of cloud computing. The weakness in user's authentication process, integrity and lack of effective security policy in cloud storage leads to many challenges in cloud computing. This paper proposes a scheme to securely store and access of data via internet. Authors have proposed a double encryption scheme that not only provides security of user's private data during storage and access over the cloud but also provides the authentication feature using Elliptic curve cryptography.

IoT 환경에 적합한 OAuth 기반의 사용자 인증 프레임워크

It is expected that internet of things can be used for various fields such as smart home, smart building and smart city as the representative case of ICT that sensor, communication and interface technologies operate organically and the researches of the technologies regarding internet of things are being carried out in each countries worldwide. However, many problems rise against internet of things continuously in respect of security. Among them, the problem of privacy is the one that should be solved definitely regarding internet of things. If user data does not remain during the process of user authentication, such the privacy problem can be solved. In this paper, we propose the framework of user authentication based on OAuth that is suitable for the environment of internet of things that can solve privacy problem and analyze its security.

AudioAuth

In this paper, the authors describe a novel design alternative to the traditional PIN-based user authentication process, through the selection of a sequence of abstract sounds. The authors conducted two studies as part of the research. The first study examines a user's ability to discriminate between sounds based on the manipulation of various sound characteristics. Results highlighted the benefits of timbre and spatial positioning as differentiators. They also found manipulations of pitch, rhythm, and spatial position further compliment a capacity for discerning between sounds. Using findings from the first study, they conducted a second study, which examined the usability of a sound-based authentication interface, AudioAuth. Finally, the authors conducted retrospective interviews with study participants to investigate the potential applicability of AudioAuth design concepts in a mobile context. The authors' insights gained from the research, including methodological lessons, offer guidance to interface designers interested in exploiting the potential of abstract sounds to support the user authentication workflows.

A Privacy-Aware Authentication Scheme for Distributed Mobile Cloud Computing Services

In modern societies, the number of mobile users has dramatically risen in recent years. In this paper, an efficient authentication scheme for distributed mobile cloud computing services is proposed. The proposed scheme provides security and convenience for mobile users to access multiple mobile cloud computing services from multiple service providers using only a single private key. The security strength of the proposed scheme is based on bilinear pairing cryptosystem and dynamic nonce generation. In addition, the scheme supports mutual authentication, key exchange, user anonymity, and user untraceability. From system implementation point of view, verification tables are not required for the trusted smart card generator (SCG) service and cloud computing service providers when adopting the proposed scheme. In consequence, this scheme reduces the usage of memory spaces on these corresponding service providers. In one mobile user authentication session, only the targeted cloud service provider needs to interact with the service requestor (user). The trusted SCG serves as the secure key distributor for distributed cloud service providers and mobile clients. In the proposed scheme, the trusted SCG service is not involved in individual user authentication process. With this design, our scheme reduces authentication processing time required by communication and computation between cloud service providers and traditional trusted third party service. Formal security proof and performance analyses are conducted to show that the scheme is both secure and efficient.

Reduced Overhead Frequent User Authentication in EAP-Dependent Broadband Wireless Networks

The authentication mechanisms in Broadband Wireless Networks (BWN) are predominantly based on Extensible Authentication Protocol (EAP). However, the complexity of EAP causes an impediment in BWN networks which involve high speed mobility. Even though it provides a highly secured mechanism, the current authentication process has high authentication overheads which affect the Quality of Service (QoS) in time sensitive data applications such as VoIP and VoD. The alternative would be to consider re-authentication approach which reduces the number of full EAP authentications but at the same time provides a secure handoff to the mobile users at a lower latency and hence does not impact the QoS of the applications. The proposed Frequency-based Re-authentication Protocol (FRP) is an extension to EAP, aiming to reduce the network access time and in turn reduce the authentication latency, by taking into account the frequency of visits of a particular mobile user to an access domain. In addition, we also propose a frequent --- User Authentication Process (f-UAP) which when used with FRP significantly minimizes the EAP authentication overhead. A mathematical model is formulated to illustrate the tradeoff achieved when FRP along with EAP is used in the f-UAP approach. The security evaluation of the proposed FRP is carried out using Automated Validation of Internet Security Protocols and Applications (AVISPA) tool. Furthermore, simulation analysis show that the FRP authentication latency is lower compared to the existing re-authentication mechanisms.

Modified USB Security Token for User Authentication

Computer security has been a significant importance in today’s world. Many researches have been done in order to improve the security services with encryption and decryption of sensitive. In addition, Security protocols have been developed to protect accessing the data from the authorized users. One of these protocols is the One-Time Password (OTP) authentication in the USB security tokens. A well-known USB security Token is the Yubikey security tokens. However this token has protocol overhead and time consuming in addition to the speed and memory capacity limitations. In this paper, we have proposed a modification to the Yubikey security protocols in order to enhance the overhead, speed and size limitations in the user authentication process, in addition to increase the security factors that depend on a random number generated from the server and sent to the user via e-mail and SMS to his mobile. Experimental results have been conducted using C# programming language for the user and the server side. All the results show the efficiency improvement of our proposed protocol over the Yubikey security token in the terms of authentication factors, speed and memory size.

Multi-factor User Authentication on Group Communication

Group communications are becoming popular by explosively increased Internet usage, and there are various group communications on Internet applications such as video conferences, on-line text chatting programs, online games and gambling. However, the conventional group key agreement protocols are only focused on how to minimize the computational overhead by concentrating on generating the common group key efficiently. As a result, the common group key is generated efficiently. However, a failure in user authentication permits unknown attackers to obtain valuable information during the group communication. This paper proposes a Media Access Control (MAC)-based authentication in the group key agreement in order to secure the user authentication process in group communications. Without a preliminary agreement, participants in a group communication cannot trust each other in the beginning of the group setup. Therefore, the group controller, who is randomly selected from the group members, needs a security deposit from all members in case an illegitimate user tries to join the group. The user MAC address proposed in this paper can act as a security deposit to provide a secure communication channel while preventing the MAC spoofing problem.

Toward an SDN-enabled NFV architecture

This article presents the progressive evolution of NFV from the initial SDN-agnostic initiative to a fully SDN-enabled NFV solution, where SDN is not only used as infrastructure support but also influences how virtual network functions (VNFs) are designed. In the latest approach, when possible, stateless processing in the VNF shifts from the computing element to the networking element. To support these claims, the article presents the implementation of a flowbased network access control solution, with an SDN-enabled VNF built on IEEE 802.1x, which establishes services as sets of flow definitions that are authorized as the result of an end user authentication process. Enforcing the access to the network is done at the network element, while the authentication and authorization state is maintained at the compute element. The application of this proposal allows the performance to be enhanced, while traffic in the control channel is reduced to a minimum. The SDN-enabled NFV approach sets the foundation to increase the areas of application of NFV, in particular in those areas where massive stateless processing of packets is expected.

Verifying Online User Identity using Stylometric Analysis for Short Messages

Stylometry consists of the analysis of linguistic styles and writing characteristics of the authors for identification, characterization, or verification purposes. In this paper, we investigate authorship verification for the purpose of user authentication process. In this setting, authentication consists of comparing sample writing of an individual against the model or profile associated with the identity claimed by that individual at login time (i.e. 1-to-1 identity matching). In addition, the authentication process must be done in a short period of time, which means analyzing short messages. Although a significant amount of literature has been produced showing high accuracy rates for long documents, it is still challenging to identify accurately authors of short unstructured documents, in particular when dealing with large authors populations. In this paper, we pose some steps toward achieving that goal by proposing a supervised learning technique combined with n-grams analysis for authorship verification for short texts. We introduce a new n-gram metric and study several sizes of n-grams using a relatively large dataset. The experimental evaluation shows increased effectiveness of our approach compared to the existing approaches published in the literature.

Assessment Of User Authentication Risks In A Healthcare Knowledge Management System

Risk management is a concept which has becomes very popular with a number of national and international businesses. Many companies often establish a risk management procedure in their projects for improving performance and increasing profits. Projects undertaken in the construction sector are widely complex, often having significant budgets; therefore, reducing risks associated with projects should be a priority for each project manager. Patient information security has become a matter of interest to healthcare professionals, governments and researchers worldwide. This paper proposes a comprehensive risk assessment methodology that provides a decision support tool, directed to a healthcare system, which can be utilized for evaluating risk involved during user authorization and authentication procedures. Within this context, a process technique was implemented to develop a risk assessment model, which is used to derive the relative priorities of the risk factors associated with a healthcare knowledge management system. The study showed risks involved when users are accessing a healthcare system. It proposes a model for assessing each risk occurring during the user authorization and authentication process. The results of the knowledge generated from the risk assessment provide a basis for deriving a system performance that is desirable for evaluating risk.

무선 센서 네트워크를 위한 생체 정보 기반 사용자 인증 스킴의 보안 취약점 분석

The numerous improved schemes of remote user authentication based on password have been proposed in order to overcome the security weakness in user authentication process. Recently, some of biometric-based user authentication schemes to use personal biometric information have been introduced and they have shown the relatively higher security and the enhanced convenience as compared to traditional password-based schemes. These days wireless sensor network is a fundamental technology in face of the ubiquitous era. The wireless sensor networks to collect and process the data from sensor nodes in increasing high-tech applications require important security issues to prevent the data access from the unauthorized person. Accordingly, the research to apply to the user authentication to the wireless sensor networks has been under the progress. In 2010, Yuan et al. proposed a biometric-based user authentication scheme to be applicable for wireless sensor networks. Yuan et al. claimed that their scheme is effectively secure against the various security flaws including the stolen verifier attack. In this paper, author will prove that Yuan et al.`s scheme is still vulnerable to the password guessing attack, user impersonation attack and the replay attack, by analyzing their security weakness.