Lightweight one‐time password authentication scheme based on radio‐frequency fingerprinting

As radio frequency identification (RFID) technology matures, the application of RFID system also increased significantly and has been widely used in commodity storage, access management. We believe that it will become one of the major electronic money for the daily business consumption in the future. However, the stability and security of the data transaction will be more important for the demand of business applications. In the existed solution, we have not yet found an effective way that the Tag can be completely prevented forgery and attack. In this paper, we analyses the security problem of RFID authentication and propose security authentication for RFID tags based on a one-time password (OTP) authentication method. By the way of OTP authentication, we can improve the security of the RFID tag authentication. It can identify the authorized RFID Tag by additional OTP authentication. If an attacker uses eavesdropping to clone a RFID tag, the clone one can be identified by OTP authentication. We use RFC-6238 Time-Based One-Time password (TOTP) algorithm which is based on HMAC-SHA1 algorithm to enhance the authentication mechanism of RFID security. And we also use the computing power of NFC-enabled smart phone to generate TOTP by OTP generator which designed in this paper. The TOTP can be repeated and the security written to the tag. Thought using RADIUS authentication technology, manufacturers can easily apply this technology in the existing RFID system. It is easily provided to users to use roaming function between the different service providers, as long as they using the same frequency and standard of RFID technology.

Over the years, Password-based Authentication (PA) techniques have been the widely used security mechanism that serves as a first level defence against unauthorised access. However, it is paramount that existing PA techniques should be improved upon in order to adequately protect computer systems and networks from password attacks. This work presents a One-Time Server-Specific Password Authentication Scheme (OTSSPAS) for preventing password related attacks. In this work, two protocols known as Password Joggling Protocol (PJP) and Account Management Protocol (AMP) were developed and integrated with OTSSPAS. PJP involves the use of a Password Security Key (PSK) in order to dissuade adversaries from tapping the password. AMP provides an enhanced account management system by considering previous key activities of users in making account locking decision. OTSSPAS adoptsMD5 standard hashing technique for protection of passwords before transmit and storage. Microsoft Visual C# and ASP.Net programming languages were used to implement the design. The evaluation result truly shows that the scheme can prevent common password related attacks.

A new kind of one-time password authentication scheme, directed one-time password authentication scheme, is presented in this paper. The distinguished feature of the directed authentication scheme is that only the specified verifier can validate the verifiee's genuine identity, without the help of this specified verifier, anyone else cannot verify it. One strong directed one-time password authentication scheme based on discrete logarithm is proposed in this paper and the security and performance of which are also analyzed.

The rapid development of the Internet facilitates our lives in many aspects. More and more business will be done through Internet. Under such circumstances, enough attention must be given to the information security, of which the identity authentication is one important problem. In the traditional authentication scheme, the user provides the username and static password to service provider, but there are some inherent shortcomings of this method—static passwords maybe guessed, forgotten, and eavesdropped. One-Time Password (OTP) is considered as the strongest authentication scheme among all password-based solutions. In this paper, a novel two-factor authentication scheme based OTP is proposed. The scheme not only satisfies the mutual authentication between the user and service provider, but also presents higher security and lower computational cost than traditional schemes based OTP.

As the mobile networks are springing up, mobile devices become a must gadget in our daily life. People can easily access Internet application services anytime and anywhere via the hand-carried mobile devices. Most of modern mobile devices are equipped with a GPS module, which can help get the real-time location of the mobile device. In this paper, we propose a novel authentication scheme which exploits volatile passwords - One-Time Passwords (OTPs) based on the time and location information of the mobile device to transparently and securely authenticate users while accessing Internet services, such as online banking services and e-commerce transactions. Compared to a permanent password base scheme, an OTP based one can prevent users from being eavesdropped. In addition to a memoryless feature, the scheme restricts the validness of the OTP password not only in a certain time period but also in a tolerant geometric region to increase the security protection. However, if a legitimate user is not in the anticipated tolerant region, the user may fail to be authenticated. Hence, a Short Message Service (SMS) based mutual authentication mechanism is also proposed in the article to supplement the unexpected misjudgement. The proposed method with a volatile time/location-based password features more secure and more convenient for user authentication.

Password authentication has been widely used in computer networks to provide secure remote access control. In this study, the authors show that the improved password authentication and update scheme based on elliptic curve cryptography proposed by Islam and Biswas is vulnerable to offline password guessing, stolen-verifier and insider attacks. We propose an advanced smart card-based password authentication and update scheme and extend the scheme to provide the privacy of the client. By comparing the criteria with other related schemes, our scheme not only solves several hard security threats but also satisfies more functionality features.

Radio frequency (RF) fingerprinting technology has been developed as a unique method for maintaining security based on physical layer characteristics. In this paper, we propose the RF fingerprinting by extracting the parameter characteristics such as information dimension, constellation feature, and phase noise spectrum in the transmitted information when applied to the universal software radio peripheral (USRP) software-defined radio (SDR) platform. To achieve a great performance improvement of classification, not only the traditional support vector machine (SVM) classifier, but also the machine-based integrated classifier bagged tree and the adaptive weighting algorithm weighted k-nearest neighbor (KNN) are both discussed. It is demonstrated that the proposed method achieves good classification performance under different signal-to-noise ratios (SNR).

Password is the most commonly used technique for user authentication due to its simplicity and convenience. The main advantage of passwords is that users can memorize them easily without needing any hardware to store them. Efficient password authentication schemes are required to authenticate the legitimacy of remote users over an insecure communication channel. In this paper, we presented the survey of all currently available password based authentication schemes and classified them in terms of several crucial criteria. This study will help in developing different password based authentication techniques, which are not vulnerable to different attack scenarios. Two and three party key exchange protocols require secure authentication mechanism for achieving the required goals and satisfying the security requirements of an ideal password based authentication scheme. Smart cards, which are used in financial transactions require highly secure authentication protocols.

ABSTRACTIn password‐based or two‐factor (password and smart card) authentications, password changing is one of common techniques used to improve the security of the systems protected by the password. However, the password‐changing operations in existing password authentications either depend on the login phase or violate the common practice that an old password should not be valid for subsequent login after being updated. On the other hand, password mistyping is very common in reality, which may be random or be skewed by the adversary via technical means or social engineering manipulation [i.e., a kind of denial‐of‐service (DoS) attack]. In human‐centric authentication mechanisms, password changing and DoS resilience are not marginal issues. The paper addresses the requirements of robust password changing in authentication and presents , a password authentication scheme with robust password changing, DoS resilience, and card‐compromise security. Thus, the proposal can be viewed as a suitable candidate instantiation for authentication services of human‐centric security, by embedding in the computer and software systems. also achieves other appealing features, such as self‐healing ability and strong privacy protection, which may be useful for human‐centric applications. Copyright © 2013 John Wiley & Sons, Ltd.

많은 웹 서비스에서 편리성을 이유로 패스워드 기반 인증 시스템을 주로 사용한다. 패스워드 기반 인증 시스템은 패스워드 추측공격, 사전식 대입공격, 키 로깅 공격 등 다양한 공격에 취약한 것으로 알려져 왔다. 뿐만 아니라 대부분 웹 기반 인증 시스템은 서버가 사용자를 인증하는 단방향 인증만을 제공하므로 사용자는 현재 접속하여 비밀 정보를 남기고자하는 서버가 적합한지 검증 할 수 없다. 따라서 DNS 스푸핑 공격이나 피싱, 파밍과 같은 공격에 대응하기가 어렵다. 이러한 웹 서비스의 보안 취약점을 개선하기 위해 OTP를 사용하거나 패스워드 길이를 증가시키고, 특수기호를 포함하는 패스워드를 생성하게 하는 방안들이 적용되고 있다. 그러나 OTP 장치의 구입비용 발생, 복잡한 패스워드로 인한 사용자의 편리성 저하 등 실용성의 문제가 있다. 무엇보다 단방향 인증 기반에서는 여전히 취약점이 존재한다. 이를 해결하기 위해 본 논문에서는 QR-Code를 활용한 다중채널, 다중요소 인증시스템을 제안한다. 제안하는 시스템은 상호 인증을 제공하여 피싱이나 파밍과 같은 공격에 대응할 수 있다. 또한 휴대용 스마트 기기를 OTP 생성기로 활용하여 사용자의 편리성을 보장하면서 기존 패스워드 공격들에 대응할 수 있다. Password based authentication systems are most widely used for user convenience in web services. However such authentication systems are known to be vulnerable to various attacks such as password guessing attack, dictionary attack and key logging attack. Besides, many of the web systems just provide user authentication in a one-way fashion such that web clients cannot verify the authenticity of the web server to which they set access and give passwords. Therefore, it is too difficult to protect against DNS spoofing, phishing and pharming attacks. To cope with the security threats, web system adopts several enhanced schemes utilizing one time password (OTP) or long and strong passwords including special characters. However there are still practical issues. Users are required to buy OTP devices and strong passwords are less convenient to use. Above all, one-way authentication schemes generate several vulnerabilities. To solve the problems, we propose a multi-channel, multi-factor authentication scheme by utilizing QR-Code. The proposed scheme supports both user and server authentications mutually, thereby protecting against attacks such as phishing and pharming attacks. Also, the proposed scheme makes use of a portable smart device as a OTP generator so that the system is convenient and secure against traditional password attacks.

Linear frequency modulation(LFM) signals are widely used in radar technology. Accurate identification of LFM signal sources is of great significance. Radio frequency fingerprinting(RFF) is a non-cryptographic authentication method based on hardware physical differences, which is unique and therefore widely used for signal source identification. However, in practical applications, the RFF of radar signal sources generates heat after prolonged operation. This causes a certain degree of drift in the RFF within and between pulses, thereby affecting recognition accuracy. To address this issue, this paper proposes an LFM radar signal source identification method with RFF Drift Robustness(RDR). RDR first uses a frame-based coherent accumulation method to separately calculate the RFF of the front and rear halves of the pulse, then introduces a Class Principal Component Analysis layer(PCALayer) to mitigate the impact of RFF drift within the pulse. Subsequently, an Long Short-Term Memory(LSTM) Network is used to capture the temporal dependency of RFF between pulses, thereby enhancing the model's robustness to RFF drift between pulses. Experimental results demonstrate that the proposed method exhibits excellent robustness to RFF drift in real-world scenarios.

In a post-quantum world, where attackers may have access to full-scale quantum computers, all classical password-based authentication schemes will be compromised. Quantum copy-protection prevents adversaries from making copies of existing quantum software; we suggest this as a possible approach for designing post-quantum-secure password authentication systems. In this paper, we show an implementation of quantum copy-protection for password verification on IBM quantum computers. We also share our quantum computation results and analyses, as well as lessons learned.

One Time Passwords (OTPs) are used to increase the security of the authentication process of networked applications. Smartphone based OTP schemes already brought usable and affordable multi-factor authentication to web applications. These schemes are also a promising approach for authentication in industrial applications. This paper introduces an industrial remote maintenance use-case that uses a smartphone based OTP authentication scheme using Quick-Response (QR) codes. In addition to a main communication and password authentication channel, the proposed scheme requires an out-of-band communication channel to transmit OTPs via smartphone. While baseline security for the channels can be achieved with Transport Layer Security (TLS), Out-of-Band Authentication (OOBA) remains vulnerable to Man-in-the-Middle (MitM) attacks in environments where the authenticity of a communicating party cannot be guaranteed. In order to mitigate this problem, it is crucial to establish a secure channel association. The enhancement proposed in this paper thus cryptographically binds successful out-of-band OTP authentications to the previously established data-channel with the help of TLS channel binding. Recommendations include common TLS libraries that support this feature as well as further considerations for a secure implementation.

Privacy breaches and online frauds are grave concerns in pervasive computing. Device identification is the first line of defense to detect and stop fraud. Conventional device authentication schemes using software addresses as identities or static pre-programmed secret keys are vulnerable to tampering and memory attacks. This article reviews two emerging lightweight hardware-oriented solutions to avoid these problems, namely radio frequency fingerprint (RFF) identification and physical unclonable function (PUF) authentication. Their operating principles and protocols are first introduced, followed by a scrutiny of their common and distinctive features, and a discussion of the stumbling blocks in the way of their market adoption. Finally, we envisage a combined mutual authentication and key establishment scheme to shed light on their synergy.

Remote user authentication is very important for identifying whether communicating parties are genuine and trustworthy. Using a password and a smart card between a login user and a remote server is necessary. Recently, C.T. Li et al.’s noted that smart card security breach was not considered in the password authentication scheme given by S.K. Kim et al.’s in 2009, then they proposed a remote user authentication scheme against smart card security breach, which was presented in Data and Applications Security and Privacy 2011. However, we note that Li et al.’s scheme needs a verification table in the remote server. It is well-known that a verification table should not be involved in a good password authentication scheme with smart cards. In this paper, we propose a password authentication scheme against smart card security breach and without maintaining verification tables.Keywordspassword authenticationhash functionsmart card