Implementing Multilevel Graphical Password Authentication Scheme in Combination with One Time Password

Two-factor authentication (2FA) technologies are designed to increase the security and usability of authentication. Adoption of 2FA hardware devices that generate one- time passwords has proven to be effective as a risk mitigating strategy. Despite 2FA addressing user data security concerns, individuals appear either disinterested or unable to adopt 2FA tools. Many institutions are now mandating 2FA to better secure their network and user data. Some have more rigid requirements than others (e.g., offering only one 2FA method vs. offering multiple 2FA options). To better understand the impact of mandatory 2FA policies, we conducted a study of the usability, adoption, and acceptability of 2FA at three different universities. In our study, using the Yubico FIDO U2F security token, we found that mandating the use of 2FA without complementary risk communication is often inadequate. In our interviews, we found that mandatory 2FA did not necessarily increase security, instead leading to less secure user behavior, such as sharing 2FA tokens, storing credentials for a longer time in public devices, and other security avoidance behaviors.

User authentication is necessary to secure the data and process on internet or mobile communications. Most commonly employed system for said purpose is Static alpha-numeric password based authentication system. But they are susceptible to various types of active and passive attacks. One of the promising alternatives is Graphical password based authentication systems which if implemented properly are secure but not as easy to understand or learn.In this paper we propose a varied version of inkblot authentication [1] graphical password system which is secure as well as usable. It generates pseudo random one time passwords using a set of inkblots unique to the user. Properties of one time passwords ensures the resistance towards replay, phishing, shoulder surfing, active and dictionary attacks. We also analyze the results from two experiments we have conducted to confirm that this system is easy to learn and password memorability is high, thus making it a promising authentication mechanism.KeywordsUsable securityAuthenticationOne-time passwordsCueingInterfaces

Todays world is of cloud computing, cloud service provider (CSP) provides different resources and services to the user anytime anywhere over the internet. Due to this feature of cloud maintain security over cloud is complex. Cloud computing security issue are authentication of user, nonrepudiation, authority, confidentiality, privacy, availability, access control and checking the integrity of data. Here we have proposed the secure architecture for cloud which is going to map some cloud security issues that are authentication of user, confidentiality, privacy, access control and checking the integrity of data. For authentication of user system uses One Time Password (OTP), for data integrity check system uses modified SHA-2 hash function. This modified version of SHA-2 will provide better solution for PreImage attack and Collision attack and for encryption and decryption system uses standard Advanced Encryption Standards (AES) algorithm.

The proliferation of mobile cloud services significantly increases the complexity and risks associated with user authentication. Traditional password-based authentication methods are vulnerable to credential theft and account takeover attacks. Although centralized Risk-Based Authentication (RBA) methods enhance security by evaluating login attempt risks, they often compromise user privacy by aggregating sensitive authentication data. To overcome these challenges, this paper proposes a federated trust-based authentication framework utilizing federated learning (FL) integrated with an Artificial Neural Network enhanced by Batch Normalization (ANN-BN). Specifically, our framework calculates a trust score for each login attempt based on user behavior patterns and contextual threat indicators. This trust-based approach enables accurate detection of malicious login attempts while preserving user privacy by performing decentralized model training across multiple client devices. Experiments conducted on a real-world login dataset demonstrate that the proposed federated ANN-BN approach achieves high detection accuracy with a low false-alarm rate, effectively balancing security enhancement and privacy preservation. Our results confirm the effectiveness and practicality of federated learning for secure authentication in mobile cloud environments, highlighting its potential for real-world deployment and motivating future research directions.

Advancement of information technology leads toward a world with process automation to perform a task more efficiently and avail the services with ease. Banking sectors are not an exception and are moving from traditional manual banking system to an electronic entity. The basic functionality of a bank, out of many, is to deposit money into user accounts and retrieve as per account holder’s necessity. However, as time is precious, eventually account holders may not expect to spend too much time in the queue for depositing or retrieving their money. That is why the need for ATM comes into the picture to make the user’s life easier. However, it comes with some questionable possibilities for false attacks as well. Thus, a proper user authentication mechanism is needed to overcome these fraudulent activities. Our proposed method gives a new dimension to this authentication which is a hybrid version of an existing authentication system for the ATM transaction by using a Graphical pattern password along with current PIN code supplied from the bank. This Graphical password is a version, which has been invented by Google’s Android pattern unlock system. In our proposed mechanism, we combine both Graphical pattern and PIN and incorporated security to enhance reliable transactions. More specifically, the secret encryption key is generated from a PIN using the PRESENT algorithm. Finally, the ciphertext is created using digit stream from the Graphical pattern and secret encryption key. This hybrid process to detect intrusion will significantly enhance security. Our primary focus is to develop a robust and flexible user authentication system to avoid common authentication problems. The proposed approach needs no additional hardware and device dependency.

Purpose – The Android pattern lock screen (or graphical password) is a popular user authentication method that relies on the advantages provided by the visual representation of a password, which enhance its memorability. Graphical passwords are vulnerable to attacks (e.g. shoulder surfing); thus, the need for more complex passwords becomes apparent. This paper aims to focus on the features that constitute a usable and secure pattern and investigate the existence of heuristic and physical rules that possibly dictate the formation of a pattern. Design/methodology/approach – The authors conducted a survey to study the users’ understanding of the security and usability of the pattern lock screen. The authors developed an Android application that collects graphical passwords, by simulating user authentication in a mobile device. This avoids any potential bias that is introduced when the survey participants are not interacting with a mobile device while forming graphical passwords (e.g. in Web or hard-copy surveys). Findings – The findings verify and enrich previous knowledge for graphical passwords, namely, that users mostly prefer usability than security. Using the survey results, the authors demonstrate how biased input impairs security by shrinking the available password space. Research limitations/implications – The sample’s demographics may affect our findings. Therefore, future work can focus on the replication of our work in a sample with different demographics. Originality/value – The authors define metrics that measure the usability of a pattern (handedness, directionality and symmetry) and investigate their impact to its formation. The authors propose a security assessment scheme using features in a pattern (e.g. the existence of knight moves or overlapping nodes) to evaluate its security strengths.

Cloud computing environment gives people to share resources, services and information. This environment is adopted by large number of organizations, so the rapid transition towards the cloud has fuelled concerns on security perspective. Encryption algorithms play main role in solving such kind of problems in the cloud computing environment. This paper proposes the structure for cloud security with efficient security in communication system and AES based file encryption system. This security architecture can be easily applied on PaaS, IaaS and SaaS and one time password provides extra security in the authenticating users. This paper presents the security of whole cloud computing environment.

많은 웹 서비스에서 편리성을 이유로 패스워드 기반 인증 시스템을 주로 사용한다. 패스워드 기반 인증 시스템은 패스워드 추측공격, 사전식 대입공격, 키 로깅 공격 등 다양한 공격에 취약한 것으로 알려져 왔다. 뿐만 아니라 대부분 웹 기반 인증 시스템은 서버가 사용자를 인증하는 단방향 인증만을 제공하므로 사용자는 현재 접속하여 비밀 정보를 남기고자하는 서버가 적합한지 검증 할 수 없다. 따라서 DNS 스푸핑 공격이나 피싱, 파밍과 같은 공격에 대응하기가 어렵다. 이러한 웹 서비스의 보안 취약점을 개선하기 위해 OTP를 사용하거나 패스워드 길이를 증가시키고, 특수기호를 포함하는 패스워드를 생성하게 하는 방안들이 적용되고 있다. 그러나 OTP 장치의 구입비용 발생, 복잡한 패스워드로 인한 사용자의 편리성 저하 등 실용성의 문제가 있다. 무엇보다 단방향 인증 기반에서는 여전히 취약점이 존재한다. 이를 해결하기 위해 본 논문에서는 QR-Code를 활용한 다중채널, 다중요소 인증시스템을 제안한다. 제안하는 시스템은 상호 인증을 제공하여 피싱이나 파밍과 같은 공격에 대응할 수 있다. 또한 휴대용 스마트 기기를 OTP 생성기로 활용하여 사용자의 편리성을 보장하면서 기존 패스워드 공격들에 대응할 수 있다. Password based authentication systems are most widely used for user convenience in web services. However such authentication systems are known to be vulnerable to various attacks such as password guessing attack, dictionary attack and key logging attack. Besides, many of the web systems just provide user authentication in a one-way fashion such that web clients cannot verify the authenticity of the web server to which they set access and give passwords. Therefore, it is too difficult to protect against DNS spoofing, phishing and pharming attacks. To cope with the security threats, web system adopts several enhanced schemes utilizing one time password (OTP) or long and strong passwords including special characters. However there are still practical issues. Users are required to buy OTP devices and strong passwords are less convenient to use. Above all, one-way authentication schemes generate several vulnerabilities. To solve the problems, we propose a multi-channel, multi-factor authentication scheme by utilizing QR-Code. The proposed scheme supports both user and server authentications mutually, thereby protecting against attacks such as phishing and pharming attacks. Also, the proposed scheme makes use of a portable smart device as a OTP generator so that the system is convenient and secure against traditional password attacks.

OTP(One Time Password) is for user authentication of Internet banking and users should carry their security card or OTP generator to use OTP. If they lost their security card or OTP generator, there is at risk for OTP leak. This paper suggests a new User Authentication Framework using personal health information from diverse technology of u-Health. It will cover the problem of OTP loss and illegal reproduction A User Authentication Framework is worthy of use because it uses various combinations of user`s physical condition which is inconstant. This protocol is also safe from leaking information due to encryption of reliable institutes. Users don`t need to bring their OTP generator or card when they use bank, shopping mall, and game site where existing OTP is used.

An alternative authentication method to traditional alphanumeric passwords is graphical password authentication, also known as graphical authentication, for which one of the most valuable cued-recall techniques is PassPoints. This technique stands out for its security and usability. However, it can be violated if the user follows a predefined pattern when selecting the five points in an image as their passwords, such as the DIAG and LINE patterns. Dictionary attacks can be built using these two patterns to compromise graphical passwords. So far, no reports have been found in the state of the art about any test capable of detecting graphical passwords with DIAG or LINE patterns in PassPoints. Studies carried out in other scenarios have shown the effectiveness of the characteristics of Delaunay triangulations in extracting information about the dependence between the points. In this work, graphical passwords formed by five randomly selected points on an image are compared with passwords whose points contain patterns of the DIAG or LINE type. The comparison is based on building for each password its Delaunay triangulation and calculating the mean value of the maximum angles of the triangles obtained; such a mean value is denoted by amadt. It is experimentally shown that in passwords containing DIAG and LINE patterns, the value of amadt is higher than the one obtained in passwords formed by random dots. From this result, it is proposed to use this amadt value as a statistic to build a test of means. This result constitutes the work’s main contribution: The proposal of a spatial randomness test to detect weak graphic passwords that contain DIAG and LINE type patterns. The importance and novelty of this result become evident when two aspects are taken into account: First, these weak passwords can be exploited by attackers to improve the effectiveness of their attacks; second, there are no prior criteria to detect this type of weak password. The practical application of said test contributes to increasing PassPoints security without substantially affecting its efficiency.

Graphical passwords are an alternative form of authentication that use images for login, and leverage the picture superiority effect for good usability and memorability. Categories of graphical passwords have been distinguished on the basis of different kinds of memory retrieval (recall, cued-recall, and recognition). Psychological research suggests that leveraging recognition memory should be best, but this remains an open question in the password literature. This paper examines how different kinds of memory retrieval affect the memorability and usability of random assigned graphical passwords. A series of five studies of graphical and text passwords showed that participants were able to better remember recognition-based graphical passwords, but their usability was limited by slow login times. A graphical password scheme that leveraged recognition and recall memory was most successful at combining memorability and usability.

텍스트 기반 패스워드 인증의 문제점을 해결하기 위해서 이미지를 사용하는 그래픽 패스워드가 발전 하였다. 기본적으로 그래픽 패스워드는 화면에 보이는 이미지 위의 정확한 점의 위치를 순서대로 선택(클릭)하여 인증을 처리하는 방식이다. 이러한 기존의 그래픽 패스워드 방식은 화면상의 정확한 지점을 선택하여 클릭하지 못하면 인식에 실패한다. 본 논문에서는 이러한 단점을 개선한 신 개념의 그래픽 패스워드 방식인 PassPositions를 소개한다. PassPositions는 지금까지의 그래픽 패스워드 방식에서 사용하지 않았던 상대위치를 패스워드 생성에 사용한 신개념의 그래픽 패스워드 기법이다. PassPositions는 유니버설 디자인에 기반을 둔 그래픽 패스워드 기법으로 사용자의 신체적 조건에 관계없이 모두가 편리하게 사용할 수 있다. Graphical passwords using images have been developed to solve problems in text based password recognition. The basic recognition process scheme of graphical passwords is clicking certain points on the screen image in correct order. In this pre-developed method of graphical passwords the recognition will fail if the precise positions are not clicked. A new graphical password system called PassPositions is introduced in this paper. PassPositions is a new graphical password scheme which is using relative positions never used earlier graphical password schemes. PassPositions is a graphical password scheme based on universal design that everybody can use conveniently without regarding their physical conditions.

One Time Passwords (OTPs) are used to increase the security of the authentication process of networked applications. Smartphone based OTP schemes already brought usable and affordable multi-factor authentication to web applications. These schemes are also a promising approach for authentication in industrial applications. This paper introduces an industrial remote maintenance use-case that uses a smartphone based OTP authentication scheme using Quick-Response (QR) codes. In addition to a main communication and password authentication channel, the proposed scheme requires an out-of-band communication channel to transmit OTPs via smartphone. While baseline security for the channels can be achieved with Transport Layer Security (TLS), Out-of-Band Authentication (OOBA) remains vulnerable to Man-in-the-Middle (MitM) attacks in environments where the authenticity of a communicating party cannot be guaranteed. In order to mitigate this problem, it is crucial to establish a secure channel association. The enhancement proposed in this paper thus cryptographically binds successful out-of-band OTP authentications to the previously established data-channel with the help of TLS channel binding. Recommendations include common TLS libraries that support this feature as well as further considerations for a secure implementation.

The major problem of user registration, mostly text base password, is well known. In the login user be inclined to select simple passwords which is frequently in mind that are straightforward for attackers to guess, difficult machine created password mostly complicated to user take in mind. User authenticate password using cued click points and Persuasive Cued Click Points graphical password scheme which includes usability and security evaluations. This paper includes the persuasion to secure user authentication & graphical password using cued click-points so that users select more random or more difficult to guess the passwords. In click-based graphical passwords, image or video frame that provide database to load the image, and then store all information into database. Mainly passwords are composed of strings which have letters as well as digits. Example is alpha-numeric type letters and digits.

Passwords are used for user authentication by almost every Internet service today, despite a number of wellknown weaknesses. Numerous attempts to replace passwords have failed, in part because changing users’ behavior has proven to be difficult. One approach to strengthening password-based authentication without changing user experience is to classify login attempts into normal and suspicious activity based on a number of parameters such as source IP, geo-location, browser configuration, and time of day. For the suspicious attempts, the service can then require additional verification, e.g., by an additional phone-based authentication step. Systems working along these principles have been deployed by a number of Internet services but have never been studied publicly. In this work, we perform the first public evaluation of a classification system for user authentication. In particular: (i) We develop a statistical framework for identifying suspicious login attempts. (ii) We develop a fully functional prototype implementation that can be evaluated efficiently on large datasets. (iii) We validate our system on a sample of real-life login data from LinkedIn as well as simulated attacks, and demonstrate that a majority of attacks can be prevented by imposing additional verification steps on only a small fraction of users. (iv) We provide a systematic study of possible attackers against such a system, including attackers targeting the classifier itself.