Modular Design for Round-Oriented Password Authentication Protocols

ABSTRACTIn password‐based or two‐factor (password and smart card) authentications, password changing is one of common techniques used to improve the security of the systems protected by the password. However, the password‐changing operations in existing password authentications either depend on the login phase or violate the common practice that an old password should not be valid for subsequent login after being updated. On the other hand, password mistyping is very common in reality, which may be random or be skewed by the adversary via technical means or social engineering manipulation [i.e., a kind of denial‐of‐service (DoS) attack]. In human‐centric authentication mechanisms, password changing and DoS resilience are not marginal issues. The paper addresses the requirements of robust password changing in authentication and presents , a password authentication scheme with robust password changing, DoS resilience, and card‐compromise security. Thus, the proposal can be viewed as a suitable candidate instantiation for authentication services of human‐centric security, by embedding in the computer and software systems. also achieves other appealing features, such as self‐healing ability and strong privacy protection, which may be useful for human‐centric applications. Copyright © 2013 John Wiley & Sons, Ltd.

An interesting challenge for the cryptography community is to design authentication protocols that are so simple that a human can execute them without relying on a fully trusted computer. We propose several candidate authentication protocols for a setting in which the human user can only receive assistance from a semi-trusted computer - a computer that stores information and performs computations correctly but does not provide confidentiality. Our schemes use a semi-trusted computer to store and display public challenges C_i\in[n]^k. The human user memorizes a random secret mapping \sigma:[n]\rightarrow \mathbb{Z}_d and authenticates by computing responses f(\sigma(C_i)) to a sequence of public challenges where f:\mathbb{Z}_d^k\rightarrow \mathbb{Z}_d is a function that is easy for the human to evaluate. We prove that any statistical adversary needs to sample m=\tilde{\Omega}\paren{n^{s(f)}} challenge-response pairs to recover \sigma, for a security parameter s(f) that depends on two key properties of f. Our lower bound generalizes recent results of Feldman et al. [Feldman'15] who proved analogous results for the special case d=2. To obtain our results, we apply the general hypercontractivity theorem [O'Donnell'14] to lower bound the statistical dimension of the distribution over challenge-response pairs induced by f and \sigma. Our statistical dimension lower bounds apply to arbitrary functions f:\mathbb{Z}_d^k\rightarrow \mathbb{Z}_d (not just to functions that are easy for a human to evaluate). As an application, we propose a family of human computable password functions f_{k_1,k_2} in which the user needs to perform 2k_1+2k_2+1 primitive operations (e.g., adding two digits or remembering a secret value \sigma(i)), and we show that s(f) = \min{k_1+1, (k_2+1)/2}. For these schemes, we prove that forging passwords is equivalent to recovering the secret mapping. Thus, our human computable password schemes can maintain strong security guarantees even after an adversary has observed the user login to many different accounts.

Authentication is a ubiquitous task in users' daily lives. The dominant form of user authentication are text passwords. They protect private accounts like online banking, gaming, and email, but also assets in organisations. Yet, many issues are associated with text passwords, leading to challenges faced by both, users and organisations. This thesis contributes to the body of research enabling secure and usable user authentication, benefiting both, users and organisations. To that end, it addresses three distinct challenges. The first challenge addressed in this thesis is the creation of correct, complete, understandable, and effective password security awareness materials. To this end, a systematic process for the creation of awareness materials was developed and applied to create a password security awareness material. This process comprises four steps. First, relevant content for an initial version is aggregated (i.e. descriptions of attacks on passwords and user accounts, descriptions of defences to these attacks, and common misconceptions about password and user account security). Then, feedback from information security experts is gathered to ensure the correctness and completeness of the awareness material. Thereafter, feedback from lay-users is gathered to ensure the understandability of the awareness material. Finally, a formal evaluation of the awareness material is conducted to ensure its effectiveness (i.e. whether the material improves participant's ability to assess the security of passwords as well as password-related behaviour and decreases the prevalence of common misconceptions about password and user account security). The results of the evaluation show the effectiveness of the awareness material: it significantly improved the participants' ability to assess the security of password-related behaviour as well as passwords and significantly decreased the prevalence of misconceptions about password and user account security. The second challenge addressed in this thesis is shoulder-surfing resistant text password entry with gamepads (as an example of very constrained input devices) in shared spaces. To this end, the very first investigation of text password entry with gamepads is conducted. First, the requirements of authentication in the gamepad context are described. Then, these requirements are applied to assess schemes already deployed in the gamepad context and shoulder-surfing resistant authentication schemes from the literature proposed for non-gamepad contexts. The results of this assessment show that none of the currently deployed and only four of the proposals in the literature fulfil all requirements. Furthermore, the results of the assessment also indicate a need for an empirical evaluation in order to exactly gauge the shoulder-surfing threat in the gamepad context and compare alternatives to the incumbent on-screen keyboard. Based on these results, two user studies (one online study and one lab study) are conducted to investigate the shoulder-surfing resistance and usability of three authentication schemes in the gamepad context: the on-screen keyboard (as de-facto standard in this context), the grid-based scheme (an existing proposal from the literature identified as the most viable candidate adaptable to the gamepad context during the assessment), and Colorwheels (a novel shoulder-surfing resistant authentication scheme specifically designed for the gamepad context). The results of these two user studies show that on-screen keyboards are highly susceptible to opportunistic shoulder-surfing, but also show the most favourable usability properties among the three schemes. Colorwheels offers the most robust shoulder-surfing resistance and scores highest with respect to participants' intention to use it in the future, while showing more favourable usability results than the grid-based scheme. The third challenge addressed in this thesis is secure and efficient storage of passwords in portfolio authentication schemes. Portfolio authentication is used to counter capture attacks such as shoulder-surfing or eavesdropping on network traffic. While usability studies of portfolio authentication schemes showed promising results, a verification scheme which allows secure and efficient storage of the portfolio authentication secret had been missing until now. To remedy this problem, the (t,n)-threshold verification scheme is proposed. It is based on secret sharing and key derivation functions. The security as well as the efficiency properties of two variants of the scheme (one based on Blakley secret sharing and one based on Shamir secret sharing) are evaluated against each other and against a naive approach. These evaluations show that the two (t,n)-threshold verification scheme variants always exhibit more favourable properties than the naive approach and that when deciding between the two variants, the exact application scenario must be considered. Three use cases illustrate as exemplary application scenarios the versatility of the proposed (t,n)-threshold verification scheme. By addressing the aforementioned three distinct challenges, this thesis demonstrates the breadth of the field of usable and secure user authentication ranging from awareness materials, to the assessment and evaluation of authentication schemes, to applying cryptography to craft secure password storage solutions. The research processes, results, and insights described in this thesis represent important and meaningful contributions to the state of the art in the research on usable and secure user authentication, offering benefits for users, organisations, and researchers alike.

The research paper ventures through the control of projector wirelessly with smart phone. Present remotes work on IR based communication. The device to be controlled is considered as a receiver and the remote behaves as a transmitter. In case the remote is lost, the controlling becomes impossible, thus making it difficult for the user to operate the device . In this paper, authors have tried to remove this hardware dependency by controlling the infrared device using the Bluetooth technology. A prototype of wireless remote has been developed using Arduino microcontroller, Bluetooth module and IR LED. An Android based app is also developed to control IR LEDs wirelessly through smart phones. This device takes care of security issues encountered with Bluetooth based communication also. The app is designed to satisfy this need. It asks for an authenticated user id and password to be operated and name of the Bluetooth devices are also encrypted, so that intruders will not get access to the developed device. There are several IR based remotes but the developed product stands apart because of its user friendly user interface, authentication, speed of operation and cost. Keywords : Bluetooth, infrared, IR LED, IR remote, microcontroller Cite this Article Kulwant Singh, Ashwin Dixon, Chandra Mukherjee. Smart Infer Hopper: An Infrared Bluetooth Controlled App Based Remote Control for Projector. Journal of Instrumentation Technology & Innovations . 2018; 8(1): 13–20p.

Password authentication has been widely used in computer networks to provide secure remote access control. In this study, the authors show that the improved password authentication and update scheme based on elliptic curve cryptography proposed by Islam and Biswas is vulnerable to offline password guessing, stolen-verifier and insider attacks. We propose an advanced smart card-based password authentication and update scheme and extend the scheme to provide the privacy of the client. By comparing the criteria with other related schemes, our scheme not only solves several hard security threats but also satisfies more functionality features.

The security of public-key cryptography relies on well-studied hard problems, problems for which we do not have efficient algorithms. Factorization and discrete logarithm are the two most known and used hard problems. Unfortunately, they can be easily solved on a quantum computer by Shor's algorithm. Also, the research area of cryptography demands for crypto-diversity which says that we should offer a range of hard problems for public-key cryptography. If one hard problem proves to be easy, we should be able to provide alternative solutions. Some of the candidates for post-quantum hard problems, i.e. problems which are believed to be hard even on a quantum computer, are the Learning Parity with Noise (LPN), the Learning with Errors (LWE) and the Shortest Vector Problem (SVP). A thorough study of these problems is needed in order to assess their hardness. In this thesis we focus on the algorithmic study of LPN. LPN is a hard problem that is attractive, as it is believed to be post-quantum resistant and suitable for lightweight devices. In practice, it has been employed in several encryption schemes and authentication protocols. At the beginning of this thesis, we take a look at the existing LPN solving algorithms. We provide the theoretical analysis that assesses their complexity. We compare the theoretical results with practice by implementing these algorithms. We study the efficiency of all LPN solving algorithms which allow us to provide secure parameters that can be used in practice. We push further the state of the art by improving the existing algorithms with the help of two new frameworks. In the first framework, we split an LPN solving algorithm into atomic steps. We study their complexity, how they impact the other steps and we construct an algorithm that optimises their use. Given an LPN instance that is characterized by the noise level and the secret size, our algorithm provides the steps to follow in order to solve the instance with optimal complexity. In this way, we can assess if an LPN instance provides the security we require and we show what are the secure instances for the applications that rely on LPN. The second framework handles problems that can be decomposed into steps of equal complexity. Here, we assume that we have an adversary that has access to a finite or infinite number of instances of the same problem. The goal of the adversary is to succeed in just one instance as soon as possible. Our framework provides the strategy that achieves this. We characterize an LPN solving algorithm in this framework and show that we can improve its complexity in the scenario where the adversary is restricted. We show that other problems, like password guessing, can be modeled in the same framework.

ABSTRACT:-In the past few years, biometrics-based remote user authentication has become a topic of interest for cryptographers. Given the fact that applying biometrics in a remote user authentication scheme increases the security, several biometrics-based authentication schemes have been proposed. In 2011, Li et al. proposed an improvement for Li-Hwang’s biometrics-based remote user authentication scheme using a smart card. In their paper they have claimed that their scheme removes the weaknesses of Li-Hwang’s efficient scheme. This paper reviews and analyzes Li et al.’s scheme and demonstrates the flaws in its login, authentication and password change phases. It shows that this scheme has infrastructural deficiencies in its phases when the user enters a wrong password. It is also shown that these flaws could be removed with the verification of the entered password. Improvements in login phase, authentication phase and password change phase are proposed in this paper in order to remove these weaknesses

As the applications within Mobile devices becoming more extensive, the mobile communication security issues of these applications and researches are appearing to be the most important concern. In this paper, we propose new integration OTP framework technique which uses the fingerprint and voice features of biometrics in order to generate Mobile One Time Passwords (OTPs) Token. The fingerprint and voice are considered to be one of the powerful personal authentication factors of biometrics and it can be used for generating variable passwords based on mobile environments for one time use. However, we performed a simulation of homomorphic variability of fingerprint and voice feature points using dendrogram and distribution of fingerprint and voice feature points for proposed password generation method, and verified validation of availability.

Currently available industrial robots are mainly of monolithic structure. Hence, the geometrical dimensions and the configuration of robotic arms are immutable. A modular design of serial manipulators allows to vary the structure of serial kinematic chains, for example, to adapt the system to a specific handling task. In this work we present the concept of a modular robot which has general kinematic structure by means of curved link elements. We show how to describe intuitively the assemblage of modular manipulators with curved links (referred to as Cuma-arms) by a parameter set. A Cuma-type arm and a dedicated path which can be followed by the end effector with 16 different postures is presented. For computation of the inverse kinematics of general serial 6R manipulators the algorithm of Husty and Pfurner is used and implemented on a real system.

Due to their many advantages, modular structures commonly exist in artificial and natural systems, and the concept of modular product design has recently received extensive attention from the engineering research community. Although some work has been done on modularity, most of it is qualitative and exploratory in nature, and little is quantitative. One reason for this gap is the lack of a clear definition of modularity. This thesis begins with a detailed discussion on the concepts of “modularity” and “module.” Based on the background presented here, a mutual information-based method is proposed to quantify modularity. The method is based on the view that coupling is information flow instead of real physical interactions. Information flow can be quantified by mutual information, which is based on randomness (or uncertainty). Since most engineering products can be modeled as stochastic systems and therefore have randomness, the mutual information-based method can be applied in very general cases, and it is shown that the commonly existing linkage counting modularity measure is a special case of the mutual information-based modularity measure. The mutual information-based method is applicable to final design products. But at the early stage of the engineering design process, there are generally only function diagrams. To exploit the benefits of modularity as early as possible, a minimal description length principle-based modularity measure is proposed to determine the modularity of graph structures, which can represent function diagrams. The method is used as criteria to hierarchically decompose abstract graph structures and the real function structure of an HP printer by evolutionary computation. Due to the specialty of genome representations in evolutionary computation, new genetic operators are developed to determine optimal hierarchical decompositions. This quantitative modularity measure has been developed to synthesize modular engineering products, especially by evolutionary design. There are many factors affecting evolving modular structures, such as genome representation, fitness function, learning, and task structure. The thesis preliminarily studies the effects of the modularity of tasks on the modularity of products in evolutionary computation. Using feed-forward neural networks as examples, the results show that the effects are task-dependent and rely on the amount of resources available for the tasks.

Password authentication is a common approach to system security. The conventional verification table approach has significant drawbacks. Recently, neural networks have been used for password authentication to overcome the shortcomings of traditional approaches. In neural network approaches to password authentication, no verification table is needed; rather, encrypted neural network weights are stored within the system. Existing layered neural network techniques have their limitations such as long training time and recall approximation. This study proposes the use of a Hopfield neural network technique for password authentication. In comparison to existing layered neural network techniques, the proposed method provides better accuracy and quicker response time to registration and password changes.

As the technology of mobile devices spreads fast, the price of mobile devices is getting cheaper. Most of the people have mobile devices, and these devices have the technology of near field communication (NFC). With the long time development and research, the mobile devices use NFC technology on the payment and authentication applications, and replace the smartcard, the access control card, and the credit card by using the card emulation mode. It helps the development of NFC applications. In recent years, more and more users begin using NFC technology on mobile payment and authentication. Many researches have proposed the related NFC authentication protocols, but their schemes are still lack of some security properties and functions, which are necessary for NFC authentication protocols. In this paper, we propose a secure and efficient NFC authentication scheme between two NFC devices by the help of the authentication server that provides mutual authentication.

The concept of the digital divide is becoming more and more complex as access to computers and the use of computers, changes over time. When the existence of a “digital divide” first emerged, it revolved around access to computers and related technologies. The high cost of computers and related technologies creates a large divide between people who could afford them, and who had access to all the advantages of Information technology in general, and those who could not. ICT (Information and Communication Technologies) have become an indispensable tool for businesses. Competitiveness and productivity depend on them. Cloud Computing has also generated new business opportunities for companies that have understood the key to this new social and commercial space. Cloud Computing on education can bridge the knowledge divide, the resource divide and the digital divide, teachers could be empowered under the cloud warning. It can be on devices, notebook, e-book and cell-phone. Cloud Computing in order to reduce digital divide has come as a friendly way to provide computer applications to users without the need for those users to purchase, install or support software on their local computers and/or servers. This research will cover the facts and issues discovered into the Digital Divide, after exploring details and points of views from experts. Also, this research will provide two models and one framework to describe, explain and finally reduce the gap or as most of the researchers has been looking for building a bridge in order to reduce the digital divide. Since computers and, later, the Internet became popular and came to our business, there has been a different degree of acceptance thereof by the people. The variety of profiles ranging from the 'early adopter', that is one that is to last forever in this new technology, to the 'allergic' to the computer, because they do not know how to use password to login and/or prefers to work as they always have done. Is not the first time we hear about people who cannot make simples actions in a computer because their capabilities are very low. I'm talking about everyday situations, rather than more complex ones such as maintenance of machinery. This research will treat the Cloud Computing concept as a tool to Reduce Digital Divide; the digital divide will be related to issues of educational access to the benefits of digitalization and the capabilities of a group of students in three different high school centers to use ICT appropriately and contribute to sustainable development.

In a post-quantum world, where attackers may have access to full-scale quantum computers, all classical password-based authentication schemes will be compromised. Quantum copy-protection prevents adversaries from making copies of existing quantum software; we suggest this as a possible approach for designing post-quantum-secure password authentication systems. In this paper, we show an implementation of quantum copy-protection for password verification on IBM quantum computers. We also share our quantum computation results and analyses, as well as lessons learned.

The energy-constrained devices such as the mobile terminals and nodes of the Internet of Things make lightweight security schemes an urgent need. The traditional identity authentication techniques can provide protection for the user's privacy and information to a certain extent, but they suffer from heavy cost. Non-cryptographic authentication mechanisms based on the physical layer characteristics are new techniques, which have a higher security level. The recognition technique of radio transmitter based on radio-frequency fingerprint ( RFF ) is one of the non-cryptographic authentication techniques. The authors propose a lightweight one-time password (OTP) authentication scheme based on RFF (RFF-OTP), which is a novel cross-layer secure authentication scheme and can provide mutual authentication between the mobile terminal and server, by combining RFF recognition algorithm with a hash encryption algorithm. By theoretical analysis and Syverson and van Oorschot logic verification, they prove that the RFF-OTP scheme is simple, efficient, flexible and independent of trusted-party while it also can resist the cloning attack and satisfy the anonymity compared with the OTP authentication scheme. Besides, it only requires the password to log into the system in the authors' scheme in comparison to the OTP scheme that needs both ID and password for the same purpose.