User Credentials Research Articles

Blockchain assisted encryption scheme for intellectual share estimation using medical research data

SummaryRecently, blockchain utilization with advanced encryption and decryption has gained improved attention over diverse applications. Especially in the medical field, big data storage requires an effective medium for managing user data with high confidentiality. The existing research presents diverse encryption algorithms, but certain drawbacks include sensitive information leakage, ineffective data integrity verification, and increased computational cost and time. The proposed work develops an effective blockchain mechanism for secured data storage to conquer these limitations. This article secures the medical research data from different team members for intellectual share estimation. Initially, the registration process involves user details such as name, contact number, age and so on. Next, a digital signature is generated for every registered user using the SHA‐256 hash algorithm. During data uploading, the data is encrypted using elliptic curve Diffie Hellman encryption scheme to promote security. The audio and video files are stored in inter planetary file system, and texts are stored in the blockchain. The users can retrieve the stored data from the blockchain using the encryption key. The identities and associated public keys are verified using a smart contract to validate the user certificate. Next, a decision form is made to show the polling mechanism using item preference ranking for other users viewing the data. The proposed mechanism ensures intellectual shares for all the users associated with a specified project. The performances are analyzed using PYTHON, and the encryption time obtained in the proposed model is 0.85 s at 140 security bit level.

Password strength verification based on machine learning algorithms and LSTM recurrent neural networks

Objectives. One of the most commonly used authentication methods in computer systems, password authentication is susceptible to various attacks including brute-force and dictionary attacks. This susceptibility requires not only the strict protection of user credentials, but also the definition of criteria for increasing a password’s strength to minimize the possibility of its exploitation by an attacker. Thus, an important task is the development of a verifier for checking passwords for strength and prohibiting the user from setting passwords that are susceptible to cracking. The use of machine learning methods to construct a verifier involves algorithms for formulating requirements for password complexity based on lists of known passwords available for each strength category.Methods. The proposed supervised machine learning algorithms comprise support vector machines, random forest, boosting, and long short-term memory (LSTM) recurrent neural network types. Embedding and term frequency–inverse document frequency (TF-IDF) methods are used for data preprocessing, while cross-validation is used for selecting hyperparameters.Results. Password strength recommendations and requirements from international and Russian standards are described. The existing methods of password strength verification in various operating systems are analyzed. The experimental results based on existing datasets comprising passwords having an associated level of strength are presented.Conclusions. A LSTM recurrent neural network is highlighted as one of the most promising areas for building a password strength verifier.

A mutual certificate-based data privacy scheme for ubiquitous and sustainable computing system users

Ubiquitous sustainable computing systems are deployed for providing complex application services and processing for real-time applications. Data exchange and sharing are confidential for administering user security and privacy. The need for confidentiality is one of the significant obstacles to ubiquitous computing areas like human–machine interfaces and data security. It is crucial in ubiquitous computing to protect user and system security, privacy, and safety. Hence, this article introduces a Linearized Mutual Security Scheme (LMSS) to prevent data leakage and security breaches. The scheme provides mutual authentication based on security requirements depending upon the ubiquitous application. The user credentials are pre-shared with the service providers for determining the security level and certificate sharing. This sharing is updated at fixed intervals for deciding on authentication revocation and strength updates. In this scheme, federated learning is exploited for identifying user security demands and levels administered by different users. Based on the learning recommendations, the key authentication factors are updated in the certificate, preventing anonymous and tracking sessions in the sharing interval. Therefore, the proposed scheme achieves fair anomaly detection of 14.47%, reduces data leakage rate by 13.68%, and halts sessions by 10.26%. Besides, it improves the sharing ratio of 6.92% and application responses.

A study on cloud data access through browser credential migration in Windows environment

Various user data stored in cloud services for data continuity and efficiency is one of the main collection targets in digital forensic investigation. Some forensic tools collect cloud data based on user account and password, or provide data collection functions based on user credentials stored in the web browser. However, because many web services require additional authentication using user devices to protect user data, access using only the account and password is becoming difficult. In the case of credentials generated by auto-login, it does not work or requires re-authentication when moved to the investigator's device. This is so that other devices cannot utilize the credentials that are kept on the device due to security measures. In this paper, we propose a new method to migrate the credentials stored by the web browser to other devices and effectively utilize them, unlike the forensic method that involves using local credentials. Our analysis revealed that the majority of browsers encrypt and store credentials, so we researched credential decryption methods. We proceeded with the migration; move and encrypt the decrypted credentials to the investigator's device, or move the not encrypted credentials simply. As a result, we conducted credentials migration experiments on a total of 28 browsers, among which we have clarified that migration is possible in all browsers except three that do not store data, such as Tor. We verified that it is possible to log in and collect data on 20 types of web services that are frequently used using migrated credentials. Although the approach we propose is straightforward, it allows for effective and efficient cloud data collection in digital forensic investigation.

Openmenot: A Google Chrome Extension for Detecting Phishing Websites Using Deep Learning

Abstract: With the advent of internet as a major medium right from inter-personal communication to how business transactions occur, the need to focus on research and development of various cyber security techniques rises. Phishing is one of the most common social engineering methods faced by public internet users, governments and businesses. There are several types of phishing by which users are directed to fake websites that resemble the legit ones. These fake websites collect the user credentials and use them for illegal purposes. In this project, a three-fold detection model using deep learning techniques like (Gradient Booster) for lexical and domain feature extraction ,(LSTM) for hyperlink extraction and (CNN) for content based extraction to detect phishing websites is proposed. This model is deployed by developing a google chrome extension that classifies and alerts the user when he/she is directed to a website that is not legit

Secure Tandem Authentication System

Abstract: This paper describes a method of implementing two factor authentication using password authentication and face authentication. The proposed method guarantees secure authentication to online banking and other areas of utilizing user credentials with the help of knowledge factor and biometric factor. The proposed method has been implemented and tested.

Backdoor Entry to a Windows Computer

On any computer, there are two access points that can be used for remote access. One requires user credentials to connect while the other access point is also known as backdoor access point. It allows users to bypass security checks to log in. The backdoor is a simple executable that gets installed on the target computer to get a reverse shell if needed. There are several ways to create a backdoor to a computer. A savvy attacker can easily create a custom backdoor. Most of these custom backdoors are easily recognized as malicious files by Windows security system. To solve this problem, we have developed an advanced backdoor that works like a normal file but works like a backdoor. Once installed, the backdoor allows an attacker to retain access to the computer and make changes to it. Initially, access to the reverse shell obtained through the backdoor will have user privileges, and privilege escalation methods are used to access an administrator privilege shell. It is used to remotely access a computer using an RCE (Remote Code Execution) vulnerability

Blockchain and Cryptography Communication System

Abstract: Blockchain is an innovative technology that overcomes these threats, allowing sensitive operations to be decentralized while maintaining a high level of security. Eliminate the need for trusted intermediaries. The blockchain is accessible to network nodes and keeps track of all transactions that have taken place. The goal of our work is to offer a secure communication solution based on blockchain technology. In this project, we explain why blockchain should secure communications and offer a blockchain-based messaging design pattern that maintains the performance and security of data stored on the blockchain by using a smart contract to protect identity and associated verify public key and validate a user certificate. The system is entirely a combination of blockchain and cryptography for communication systems

A Multi-Blockchain-Based Cross-Domain Authentication and Authorization Scheme for Energy Internet

The expansion of the scale of the Power Internet of Things stimulated by the development of the Energy Internet makes the growth in demand for the effective authentication and access control technologies in the cross-domain data exchange. Based on the cross-chain technology of the blockchain and the cuckoo filter, this paper proposes a cross-domain authentication scheme for Power Internet of Things. Firstly, a cross-chain authentication architecture is established. Combined with the existing authentication technologies used in intra-domain authentication, a cross-domain authentication process based on the cross-chain technology is proposed to realize the automatic transmission of the authentication credentials from application domain to authentication domain. The cuckoo filter is deployed on the blockchain as smart contracts, and the user certificate fingerprint is inserted into the filter to realize user registration, query, and revocation, which reduces the cost of the user certificate management. Experimental results show the effectiveness and feasibility of our scheme. Based on the proposed authentication scheme, a cross-domain access control scheme based on roles and object classes is presented, by treating the object classes as controlled objects and then applying the role-based access control to the object classes, on the condition that the heterogeneous domains in the Energy Internet have the same kinds of resources.

EdgeAuth: An intelligent token‐based collaborative authentication scheme

AbstractEdge computing is regarded as an extension of cloud computing that brings computing and storage resources to the network edge. For some Industrial Internet of Things (IIoT) applications such as supply‐chain supervision and collaboration, Internet of Vehicles, real‐time video analysis and so forth, users should be authenticated before visiting the geographically distributed edge servers. Limited by the considerable latency between the cloud and edge servers, and the limited capacity of edge servers, it is infeasible to copy the authentication method from cloud servers when users are authenticated in edge servers. In view of this challenge, this paper proposes a novel token‐based authentication scheme, named EdgeAuth, that enables fast edge user authentication through collaboration among cloud servers and edge servers. Under the EdgeAuth scheme, edge servers can rapidly verify the credentials of users who have been authenticated by the cloud server. EdgeAuth can also protect users from a series of authentication attacks, for example, the replay attack, DoS attack and man‐in‐the‐middle attack. The results of experiments conducted on a simulated edge computing environment validate the usefulness of EdgeAuth through a comparison in latency and throughput against two baseline schemes.

Trusted Framework for Online Banking in Public Cloud Using Multi-Factor Authentication Using Block-Chain Framework

There are always potential hazards from hackers, adware, malware, and viruses. Many big international corporations have experienced hacking and security breaches in the previous few years. In certain instances, this has resulted in the leakage of private and confidential information, such as bank account information, addresses, and transactions, but there are security measures in place that can block these things before they get too close to the company's private data. This is crucial for both secrecy and to avoid paying the steep fines levied on businesses that fail to adequately safeguard customer information. The project is a verification mechanism that only allows users with the proper input credentials to access the system. The project involves modules or user certificates. Security credentials come in a variety of forms. Thus, we incorporate a unique blockchain for banking security and user authentication in this proposed methodology. This degree of authentication reduces the possibility of hacking and the loss of sensitive data. Also, in the current environment, safer bank transactions are necessary due to advancements in security technologies. They have also made advances into industries, healthcare, telecommunications, and home automation, among others. A distributed ledger is basically what a blockchain is. It can keep information about who owns a certain piece of property or, for example, a bond. A permanent record of ownership can be maintained using technology, which also makes it possible for parties with a low level of trust to exchange the asset. Key Words: Custom Blockchain, Distributed Ledger, Authentications, Confidentiality, Transactions, Security System, Credentials, Banking Security, etc.

General-purpose Unsupervised Cyber Anomaly Detection via Non-negative Tensor Factorization

Distinguishing malicious anomalous activities from unusual but benign activities is a fundamental challenge for cyber defenders. Prior studies have shown that statistical user behavior analysis yields accurate detections by learning behavior profiles from observed user activity. These unsupervised models are able to generalize to unseen types of attacks by detecting deviations from normal behavior without knowledge of specific attack signatures. However, approaches proposed to date based on probabilistic matrix factorization are limited by the information conveyed in a two-dimensional space. Non-negative tensor factorization, however, is a powerful unsupervised machine learning method that naturally models multi-dimensional data, capturing complex and multi-faceted details of behavior profiles. Our new unsupervised statistical anomaly detection methodology matches or surpasses state-of-the-art supervised learning baselines across several challenging and diverse cyber application areas, including detection of compromised user credentials, botnets, spam e-mails, and fraudulent credit card transactions.

Authentication and Authorization in Web Applications

This article navigates through the landscape of OAuth 2.0, a pivotal authentication and authorization protocol widely adopted in web applications. By demystifying the core components – namely the Resource Owner, Client, Resource Server, Authorization Server, Access Token, and Refresh Token – the article sheds light on their distinct roles and interplay in safeguarding user credentials while permitting authorized access to protected resources. Furthermore, it delves into the various authorization flows, elucidating mechanisms that guide secure interactions between users, applications, and resource servers. With an adjunct focus on security considerations and challenges, the article provides a holistic view of implementing OAuth 2.0. It aims to give developers and IT professionals comprehensive insights into effectively leveraging this protocol while mitigating potential vulnerabilities. A balanced perspective juxtaposes the protocol's robustness and complexity, striving to offer a thorough understanding of employing OAuth 2.0 in diverse web application scenarios.

Prevention of Fake Comments using web3

The volume of information on the internet is currently rising dramatically. Social media platforms/e-commerce market place is producing a lot of data, including reviews, comments, and opinions, every day. As there are a number of fake reviews should incorporate Spam detection to produce a genuine opinion. Fake reviews are growing problem in online shopping, and they have a significant impact on consumer’s decision-making. Many people today base their decisions when choosing a product or service on social media opinions. Because so many false or phoney evaluations have been written by businesses or individuals for a variety of reasons, detecting opinion spam is a difficult and time-consuming task. They produce fictitious reviews to deceive users or automated detection systems by elevating or degrading the reputations of their target products in order to elevate or lower them. In this article, we’ll regulate it by leveraging blockchain technology to make the review system more authentic by allowing only legitimate product purchasers to submit evaluations using their account credentials. We use the Ethereum blockchain to authenticate user credentials, and we only permit verified users to purchase things. Also, we only permit customers to leave reviews or comments on products, ensuring that the reviews are accurate.

LightCert4IoTs: Blockchain-Based Lightweight Certificates Authentication for IoT Applications

These in recent days, the proliferation of the internet of things (IoT) within the emergence of five-generation (5G) networks has received a huge attention in both industrial and academic domains. A 5G network is a cornerstone of realizing the full potential of the IoT, which interconnects billions of devices wirelessly. However, wireless communication in IoT devices reveals tremendous security risks in different dimensions and precisely in the distribution of the user certificates. The existing X.509 PKI, or the proposed decentralized PKI based on blockchain solutions have lacked practicality, and continue to have security flaws, or have not yet gained widespread acceptance owing to complexity and deployment issues. We present a lightweight certificate in size (LightCert4IoTs) that is not issued by Certification Authorities (CAs) due to the cost and complexity of the assignment of a signed certificate. In LightCert4IoTs first, an end-user (i.e., mobile and IoT devices) issues a self-signed certificate and lets Local Registration Authorities (LRAs)/EDGE nodes to verify and validate the binding identity-self signed certificate of the users through the Ethereum blockchain where The Ethereum network is used as the global notary for the IoT light certificates by saving them in the blockchain immutable ledger. The LightCert4IoTs leverages the advantages of blockchain technology and smart contracts to address the existing challenges of PKI certificates in IoT devices, which neatly achieve certificate issuance, update, and revocation more securely and efficiently. Finally, the LightCert4IoTs experimental results show that LightCert, as compared to relevant solutions/baselines, achieves reasonable overheads and is suitable for use in low- constrained IoT devices where the memory and processor power are optimized.

The Investment Case for Land Tenure Security in Sub-Saharan Africa: A Cost–Benefit Analysis

AbstractGovernment is the custodian of the most critical (and limited) factor of production, namely, land. Assuring the security of tenure, arbitrating disputes, and facilitating the transfer or sales of titles renders the land market more efficient and less volatile, attracting investors and promoting sustainable urban development. Land tenure security is also a critical government service that has repercussions on agricultural productivity, housing development, business investment, and the development of urban areas. However, land administration is mired in corruptive practices, elite capture, and inefficient allocation. Globally, only 24% of rural areas are mapped (46 in urban areas), with approximately the same percentage registered, that is, 22%. In Africa, only about 14% of rural land is formally recorded in a public register. Land tenure security can take a variety of forms depending on national regulatory frameworks that allocate land and specify its use. Success stories include transferable user certificates in China and individual land titles in Rwanda. Systematic evaluation of the evidence on tenure programs demonstrates that improved tenure security increases agricultural output (40% on average), increases urban land values (25% on average), and increases household welfare (15% on average). Other observed country-specific benefits include additional years of schooling, better academic performance, access to credit, reforestation, and improved household nutrition. The costs of establishing tenure security in Sub-Saharan Africa include the separate costs of rural (US$ 3 billion) and urban (US$ 2.2 billion) land registration; the cost of digitizing land registries and information to improve efficiency and transparency (US$ 880 million), the cost of strengthening institutions and systems to resolve land disputes and manage expropriations (US$ 960 million) over a ten-year implementation period, and land administration operations and land records maintenance over 30 years (US$ 64 billion). The net present value (8%) of costs is US$ 21.7 billion for rural land tenure and US$ 5.3 billion for urban areas. The benefits of rural land registration were based on the observed 15% household wealth effect noted in the literature. The net present value (8%) of a 30-year benefits stream is US$ 396 billion. The benefit–cost ratio of completing and modernizing land registration and improving land administration coverage and effectiveness in rural Sub-Saharan Africa is 18. The benefits of urban land registration were based on the average 25% increase in property values observed in the literature. Using housing prices for the 20 largest, Sub-Saharan African countries, the net present value (8%) of the benefits over a 30-year period is US$ 237 billion, yielding a benefit–cost ratio of 45 when the average housing price is used. When the population-weighted housing price is used, benefits are valued at US$ 160 billion, yielding a benefit–cost ratio of 30.

Phishing Detection with Machine Learning

Abstract: The goal of our project is to implement a machine learning solution to the problem of detect- ing phishing and malicious web links. The end result of our project will be a software product which uses a machine learning algorithm to detect malicious URLs. Phishing is the technique of extracting user credentials and sensitive data from users by masquerading as a genuine website. In phishing, the user is provided with a mirror website which is identical to the legitimate one but with malicious code to extract and send user credentials to phishers. Phishing attacks can lead to huge financial losses for customers of banking and financial services. The traditional approach to phishing detection has been to either to use a blacklist of known phishing links or heuristically evaluate the attributes in a suspected phishing page to detect the presence of malicious codes. The heuristic function relies on trial and error to define the threshold, which is used to classify malicious links from benign ones. The drawback to this approach is poor accuracy and low adapt- ability to new phishing links. We plan to use machine learning to overcome these drawbacks by implementing some classification algorithms and comparing the performance of these algorithms on our dataset. We will test algorithms such as Logistic Regression, SVM, Decision Trees and Neural Networks on a dataset of phishing links from UCI Machine Learning repository and pick the best model to develop a browser plugin, which can be published as a browser extension.

Auto Attendance System

Abstract: The goal of this study is to develop a computerized attendance system that tracks attendance and recognises users using facial recognition. The goal of the technique is to hold decision-makers, including administrators, more accountable for maintaining an educational institution's attendance. Our aim is to minimise human contacts while collecting attendance, not to completely remove them. When done manually, this procedure is laborious, time-consuming, and requires supplies like paper. The application of modern a step toward a prosperous and well-managed future in the industry whose activities rely on automation can be observed in technology that supports, develops, or reinstates the conventional technique of accounting attendance. Face recognition software has made access easier multimedia content. While enhancing human-computer interactions, the use of It's challenging for hackers to enter networks using facial recognition technology steal user credentials. These benefits are what facial recognition attendance systems offer, and they are what propels them up the global popularity ladder bring to the table which makes it climb the ladder higher in popularity in the world.

TikTok: Is It Time to Start Trending with #PlasticSurgery?

TikTok is a short-form video social media platform created in 2016 that has rapidly grown in popularity. The aim of this study was to examine trending plastic surgery videos on TikTok and to understand the dynamics of the #PlasticSurgery conversation on this relatively new social media platform. A prospective analysis of TikTok videos identified by directly querying the platform using #PlasticSurgery was performed during November of 2020. Top trending videos at time of data collection, defined as having more than 100,000 likes, were included. Videos were analyzed for user credentials, video engagement (number of views, likes, shares, and comments), associated hashtags, and video purpose and content. The top 376 trending videos were viewed a total of 1,680,910,700 times at time of analysis. Videos made by board-certified plastic surgeons were, on average, more popular than videos made by non-plastic surgeons [490.4 versus 378.6 million likes ( P = 0.006); 5.1 versus 3.8 billion views ( P = 0.046)]. The most popular procedures featured were augmentation mammaplasty (531,143,800 views; 42,825,400 likes), followed by body contouring procedures such as liposuction and abdominoplasty (276,810,500 views; 22,362,000 likes) and rhinoplasty (243,724,100 views; 27,588,200 likes). Educational videos on average had significantly higher levels of engagement than entertainment-focused videos [549,336 versus 340,163 likes ( P = 0.002); 6.3 versus 2.9 million views ( P < 0.001)]. Videos about plastic surgery, particularly educational videos by board-certified plastic surgeons, perform exceptionally well on the TikTok platform. TikTok presents an opportunity for plastic surgeons to educate patients about plastic surgery procedures and to present themselves as board-certified plastic surgeons.

Decentralized Identity Authentication with Auditability and Privacy

Decentralized identity (DID) systems aim to give users full control over their identities by using completely decentralized technologies, such as blockchain or distributed ledgers, as identity providers. However, when user credentials are compromised, it is impossible in existing DID systems for the users to detect credential misuse. In this paper, we propose new DID authentication protocols with two properties: auditability and privacy. The former enables the detection of malicious authentication events, while the latter prevents an adversary from linking an authentication event to the corresponding user and service provider. We present two protocols that achieve auditability with varying privacy and performance guarantees. The first protocol has high performance, but it reveals information about the user. The second protocol achieves full privacy, but it incurs a higher performance overhead. We present a formal security analysis of our privacy-preserving protocols by using the Tamarin prover. We implemented them and evaluated their performance with a permissioned blockchain deployed over the Amazon AWS and a local cloud infrastructure. The results demonstrate that the first protocol is able to support realistic authentication workloads, while the second is nearly practical.