A Theoretical Framework for Password Security against Offline Guessability Attacks

In this paper Image Based Authentication application is applied on folder's (folders that are confidential to user) ,since the studies till date have shown that textual passwords are more prone that they are well hacked by hackers through easily available software's or programming different code to hack the password. The textual passwords use languages that can be identified using the grammar that they use, therefore our project focuses on Graphical passwords , because as such it has been observed that human brains is better at re-collecting and recognizing images than text, the images are well captured and stored rather than text. There have been phases in creating a strong graphical password scheme from 1999, with the promise that the graphical passwords would provide improved password memorability and usability. The technique that we use here is PCCP (PERSUASIVE CUED CLICK POINTS), this is a combination of recall and recognition based techniques with the implementation of SHA1 (Secure Hash Algorithm). Here PCCP is used for user to have better strong passwords by expanding password space and SHA1 is used to ensure security to folder. Keyword: Authentication, Graphical Password, Hotspot, Passpoints, Secure Hash Algorithm,

Password-based key derivation functions are of particular interest in cryptography because they (a) input a password/passphrase (which usually is short and lacks enough entropy) and derive a cryptographic key; (b) slow down brute force and dictionary attacks as much as possible. In PKCS#5 [17], RSA Laboratories described a password based key derivation function called PBKDF2 that has been widely adopted in many security related applications [6, 7, 11]. In order to slow down brute force attacks, PBKDF2 introduce CPU-intensive operations based on an iterated pseudorandom function. Such a pseudorandom function is HMAC-SHA-1 by default. In this paper we show that, if HMAC-SHA-1 is computed in a standard mode without following the performance improvements described in the implementation note of RFC 2104 [13] and FIPS 198-1 [14], an attacker is able to avoid 50 % of PBKDF2’s CPU intensive operations, by replacing them with precomputed values. We note that a number of well-known and widely-used crypto libraries are subject to this vulnerability.In addition to such a vulnerability, we describe some other minor optimizations that an attacker can exploit to reduce even more the key derivation time.

The most common method of authentication or protection against intrusion in a computer system is to use alphanumeric usernames and password. Choosing a strong password and protecting the chosen password has always been a popular topic among security researchers. Traditionally strong password schemes could provide with certain degree of security but strong password leads complexity and difficult to memorize and often leads their owner to write them down on paper. As a result, security becomes compromised. Also a good password is one which can be typed quickly, so someone else can't look over your shoulder. In this paper we explore some techniques of protecting the passwords and try to eliminate the shouldering problem. We also try to eliminate the dictionary attacks and brute-force attacks. Later on we tried to evolve a password scheme with some graphic technique which can be used in highly secured applications.

Text-based passwords are widely used for the authentication of digital assets. Typically, password security and usability is a trade-off, i.e. easy-to-remember passwords have higher usability that makes them vulnerable to brute-force and dictionary attacks. Complex passwords have stronger security but poor usability. In order to strengthen the security in conjunction with the improved usability, we hereby propose a novel graphical authentication system. This system is a picture-based password scheme which comprises of the method of image splicing. Authentication data were collected from 33 different users. The usability of the method was evaluated via a comparison between the number of correct and incorrect authentication attempts and time taken. Additionally, a comparison was made between our proposed method and a complex text-based password authentication method using the authentication success rate. Authentication using image splicing proved to be resilient to brute-force attacks since the processing of images consumes a voluminous password space. The evaluation of the usability revealed that graphical passwords were easy-to-remember, resulting in a higher number of correct attempts. The proposed method produced 50% higher success rate compared to the text-based method. Findings motivate the use of the proposed method for securing digital assets.

Individuals using various online services are increasingly concerned with securing and protecting their personal information from unauthorized access. There are numerous authentication systems available to safeguard data, with password-based authentication being one of the most common. Given the rise in information sharing, internet usage, e- commerce, and data transfer, ensuring the security and effectiveness of passwords has become crucial. However, the complexity of strong passwords leads to users forgetting them. To address this issue, this study proposes a novel algorithm for generating robust passwords, differing from existing random password generators. This study utilizes user-provided information to create passwords that are easier for users to remember. This system is tested with various synthetic input data and verified the strength of the generated passwords using four popular online password checkers. The results indicate that the passwords are highly reliable. Furthermore, this system effectively defends against two common types of password attacks: the dictionary attack and the brute force attack. This system is implemented in Python. The passwords generated by this system are not only easy for users to recall but also possess strong, secure characteristics that make them resistant to cracking attempts.

Authentication is a ubiquitous task in users' daily lives. The dominant form of user authentication are text passwords. They protect private accounts like online banking, gaming, and email, but also assets in organisations. Yet, many issues are associated with text passwords, leading to challenges faced by both, users and organisations. This thesis contributes to the body of research enabling secure and usable user authentication, benefiting both, users and organisations. To that end, it addresses three distinct challenges. The first challenge addressed in this thesis is the creation of correct, complete, understandable, and effective password security awareness materials. To this end, a systematic process for the creation of awareness materials was developed and applied to create a password security awareness material. This process comprises four steps. First, relevant content for an initial version is aggregated (i.e. descriptions of attacks on passwords and user accounts, descriptions of defences to these attacks, and common misconceptions about password and user account security). Then, feedback from information security experts is gathered to ensure the correctness and completeness of the awareness material. Thereafter, feedback from lay-users is gathered to ensure the understandability of the awareness material. Finally, a formal evaluation of the awareness material is conducted to ensure its effectiveness (i.e. whether the material improves participant's ability to assess the security of passwords as well as password-related behaviour and decreases the prevalence of common misconceptions about password and user account security). The results of the evaluation show the effectiveness of the awareness material: it significantly improved the participants' ability to assess the security of password-related behaviour as well as passwords and significantly decreased the prevalence of misconceptions about password and user account security. The second challenge addressed in this thesis is shoulder-surfing resistant text password entry with gamepads (as an example of very constrained input devices) in shared spaces. To this end, the very first investigation of text password entry with gamepads is conducted. First, the requirements of authentication in the gamepad context are described. Then, these requirements are applied to assess schemes already deployed in the gamepad context and shoulder-surfing resistant authentication schemes from the literature proposed for non-gamepad contexts. The results of this assessment show that none of the currently deployed and only four of the proposals in the literature fulfil all requirements. Furthermore, the results of the assessment also indicate a need for an empirical evaluation in order to exactly gauge the shoulder-surfing threat in the gamepad context and compare alternatives to the incumbent on-screen keyboard. Based on these results, two user studies (one online study and one lab study) are conducted to investigate the shoulder-surfing resistance and usability of three authentication schemes in the gamepad context: the on-screen keyboard (as de-facto standard in this context), the grid-based scheme (an existing proposal from the literature identified as the most viable candidate adaptable to the gamepad context during the assessment), and Colorwheels (a novel shoulder-surfing resistant authentication scheme specifically designed for the gamepad context). The results of these two user studies show that on-screen keyboards are highly susceptible to opportunistic shoulder-surfing, but also show the most favourable usability properties among the three schemes. Colorwheels offers the most robust shoulder-surfing resistance and scores highest with respect to participants' intention to use it in the future, while showing more favourable usability results than the grid-based scheme. The third challenge addressed in this thesis is secure and efficient storage of passwords in portfolio authentication schemes. Portfolio authentication is used to counter capture attacks such as shoulder-surfing or eavesdropping on network traffic. While usability studies of portfolio authentication schemes showed promising results, a verification scheme which allows secure and efficient storage of the portfolio authentication secret had been missing until now. To remedy this problem, the (t,n)-threshold verification scheme is proposed. It is based on secret sharing and key derivation functions. The security as well as the efficiency properties of two variants of the scheme (one based on Blakley secret sharing and one based on Shamir secret sharing) are evaluated against each other and against a naive approach. These evaluations show that the two (t,n)-threshold verification scheme variants always exhibit more favourable properties than the naive approach and that when deciding between the two variants, the exact application scenario must be considered. Three use cases illustrate as exemplary application scenarios the versatility of the proposed (t,n)-threshold verification scheme. By addressing the aforementioned three distinct challenges, this thesis demonstrates the breadth of the field of usable and secure user authentication ranging from awareness materials, to the assessment and evaluation of authentication schemes, to applying cryptography to craft secure password storage solutions. The research processes, results, and insights described in this thesis represent important and meaningful contributions to the state of the art in the research on usable and secure user authentication, offering benefits for users, organisations, and researchers alike.

This paper presents results of empirical study of passwords really used on internet. These passwords were obtained during two data acquisitions in three years period. In this paper a method for the evaluation of password security against a dictionary attack and a brute force attack is suggested and used for security evaluation of these passwords. The method is based on a mathematical model and a simulation of dictionary attack and a brute force attack. In the paper trends of password selecting are identified and expected progress is outlined. Simultaneously truly used passwords are investigated by statistic methods.

User authentication is an essential step in information security. Textual passwords are the most traditional ways used in most user authentication systems to achieve the security of information, but textual passwords are vulnerable to many types of attacks such as: dictionary attacks, shoulder surfing, and spyware. Graphical password can overcome the shortcomings of the textual passwords, but it still vulnerable to shouldersurfing attacks, takes much space in the system and sometimes user takes a long time to enter. By using Emoji-pictures, a new technique that overcomes the drawbacks of both textual and graphical passwords was presented in this paper. The proposed technique is resistant to dictionary attacks, shoulder surfing, and spyware in addition to that it doesn't take large space in the system's database and provides a safe and enjoyable session for users during entering the password.

The number of internet users is growing at a rapid rate and this means users now have to remember passwords for many different accounts. The side effects of this increase of user accounts is that users are putting password usability before password security in order to remember these passwords. This paper outlines a novel password creation scheme for creating strong, secure unique passwords that are easier for users to remember on multiple sites. The scheme includes features to more easily create a secure password and recall this password, whilst including multiple layers of security against a targeted attack by an adversary. Results showed that users who did not use a scheme had a much lower login success rate for their accounts than the users who used the created scheme. They also showed that the average password length for each group of users was the same meaning the created scheme passwords in this sample has no greater protection against brute-force attacks, but in terms of dictionary and hybrid attacks the scheme passwords generally seemed to have a lot more protection.

Authentication is vital for maintaining system secu- rity. Graphical password-based authentication systems provide a promising alternative to traditional authentication methods such as alphanumeric or text-based passwords. Conventional authentication systems are susceptible to brute force attacks, dictionary attacks, password guessing and user memory fatigue. Users create a personalized password by selecting a sequence of images or points in an image grid, which enhances security due to the complexity of graphical choices over traditional textual passwords. Graphical Password Based Authentication (GPA) incorporates a combination of image-based cues and persuasive elements which encourages a user to select a secure password. Our system addresses a major security concern, shoulder surfing, by creating and using hybrid images. Index Terms—Password Space, Click-Point Distribution, Guessing Attacks, Recall Study, Shoulder Surfing Attacks, PCCP (Persuasive Cued Click Points), Hotspots, Hybrid Images, Cued Recall, False Accept Points, Deep Residual Networks (DRN), Edge Detection, Hybrid Textual-Graphical Authentication, Brute- force Attacks, Pattern Matching .

Intelligent approaches for security technologies

Most encryption techniques have one essential problem that is they are vulnerable to brute-force attacks. Techniques used to prevent brute force attacks are increasing password length, password complexity, limit login attempts, using captcha, two factor authentication etc. A new mechanism to prevent against brute-force attack was introduced and this mechanism is known as Deception Model. Deception-based security mechanisms focus on altering adversaries perception in a way that can confuse them and waste their time and resources. This technique exploit adversaries biases and present them with a plausible looking but fake data. This technique can be used to serve for encrypting e-mail messages, human-generated messages and documents that are stored at different platforms. This paper will offer an detailed study of the current situation of Deception Model.

Passwords are still the most used method of user authentication in the usage of information systems, and they have an important role in practical security. Despite the fact that researchers have discovered various vulnerabilities in the usage of passwords, this authentication method is still frequently used. The main issue with passwords is their quality or strength, i.e., how hard they can be guessed by an attacker, and there are various password strength metrics have been proposed so far. In this paper, we propose a new metric for password strength that takes into account the risk of dictionary attacks. We create datasets from leaked password lists and regard them as Markov information sources. Then we calculate the password self-information and compare it to the threshold value we specified to determine the password strength. With this numerical value, we can know how risky a password has against dictionary attacks, and can easily compare the strength of several passwords. Through experimental results, we show that our method is very effective, does not require huge computational resources, and can effectively help users create stronger passwords.KeywordsPassword strengthSecurity riskDictionary attackSelf-information

A secure data transmission framework for IoT enabled healthcare

Cloud computing is drastically growing technology which provides an on-demand software, hardware, infrastructure and data storage as services. This technology is used worldwide to improve the business infrastructure and performance. However, to utilize these services by intended customer, it is necessary to have strong password authentication. At present, cloud password authentication can be done in several ways, such as, textual password, graphical and 3D password. In this paper, we are proposing the strong password generation technique by considering multiple input parameters of cloud paradigm referred as a multidimensional password. This paper presents the multidimensional password generation technique along with architecture, sequence diagrams, algorithms and typical user interfaces. At the end, we derive the probability of breaking our authentication system.