Hidden credential retrieval from a reusable password

We revisit the venerable question of access credentials management, which concerns the techniques that we, humans with limited memory, must employ to safeguard our various access keys and tokens in a connected world. Although many existing solutions can be employed to protect a long secret using a short password, those solutions typically require certain assumptions on the distribution of the secret and/or the password, and are helpful against only a subset of the possible attackers. After briefly reviewing a variety of approaches, we propose a user-centric comprehensive model to capture the possible threats posed by online and offline attackers, from the outside and the inside, against the security of both the plaintext and the password. We then propose a few very simple protocols, adapted from the Ford-Kaliski server-assisted password generator and the Boldyreva unique blind signature in particular, that provide the best protection against all kinds of threats, for all distributions of secrets. We also quantify the concrete security of our approach in terms of online and offline password guesses made by outsiders and insiders, in the random-oracle model. The main contribution of this paper lies not in the technical novelty of the proposed solution, but in the identification of the problem and its model. Our results have an immediate and practical application for the real world: they show how to implement single-sign-on stateless roaming authentication for the internet, in a ad-hoc user-driven fashion that requires no change to protocols or infrastructure.

Studio ed implementazione di un servizio di "Sim Authentication" mediante messaggistica online.

In questa tesi si andrà a presentare la realizzazione di un sistema che permette di autenticare la sim di un cellulare, quindi di verificare che un determinato numero di telefono sia realmente nelle mani dell'utente, attraverso servizi di messaggistica online come WhatsApp o Telegram. Il bisogno di questo progetto nasce dal fatto che molte delle attuali applicazioni presenti sul mercato utilizzano sms per autenticare la reale appartenenza di un numero telefonico ad un determinato utente, ma questo comporta un notevole dispendio di soldi, dato che per inviare un gran numero di sms, bisogna sottoscrivere un abbonamento a servizi Gateway Sms che permettono di inviare sms ad un determinato numero dopo aver ricevuto i relativi dati dal mittente.

Identity management : strengthening one-time password authentication through usability

Usability in HCI (Human-Computer Interaction) is normally understood as the simplicity and clarity with which the interaction with a computer program or a web site is designed. Identity management systems need to provide adequate usability and should have a simple and intuitive interface. The system should not only be designed to satisfy service provider requirements but it has to consider user requirements, otherwise it will lead to inconvenience and poor usability for users when managing their identities. With poor usability and a poor user interface with regard to security, it is highly likely that the system will have poor security. The rapid growth in the number of online services leads to an increasing number of different digital identities each user needs to manage. As a result, many people feel overloaded with credentials, which in turn negatively impacts their ability to manage them securely. Passwords are perhaps the most common type of credential used today. To avoid the tedious task of remembering difficult passwords, users often behave less securely by using low entropy and weak passwords. Weak passwords and bad password habits represent security threats to online services. Some solutions have been developed to eliminate the need for users to create and manage passwords. A typical solution is based on generating one-time passwords, i.e. passwords for single session or transaction usage. Unfortunately, most of these solutions do not satisfy scalability and/or usability requirements, or they are simply insecure. In this thesis, the security and usability aspects of contemporary methods for authentication based on one-time passwords (OTP) are examined and analyzed. In addition, more scalable solutions that provide a good user experience while at the same time preserving strong security are proposed.

A lightweight biometric signature scheme for user authentication over networks

We introduce a lightweight biometric solution for user authentication over networks using online handwritten signatures. The algorithm proposed is based on a modified Hausdorff distance and has favorable characteristics such as low computational cost and minimal training requirements. Furthermore, we investigate an information theoretic model for capacity and performance analysis for biometric authentication which brings additional theoretical insights to the problem. A fully functional proof-of-concept prototype that relies on commonly available off-the-shelf hardware is developed as a client-server system that supports Web services. Initial experimental results show that the algorithm performs well despite its low computational requirements and is resilient against over-the-shoulder attacks.

A Secure and Efficient Authentication Protocol (SEAP) for MANETs with Membership Revocation

In this paper, we propose a novel authentication protocol for MANETs requiring stronger security. The protocol works on a two-tier network architecture with client nodes and authentication server nodes, and supports dynamic membership. We use an external membership granting server (MGS) to provide stronger security with dynamic membership. However, the external MGS in our protocol is semi-online instead of being online, i.e., the MGS cannot initiate a connection with a network node but any network node can communicate with the MGS whenever required. To ensure efficiency, the protocol uses symmetric key cryptography to implement the authentication service. However, to achieve storage scalability, the protocol uses a pseudo random function (PRF) to bind the secret key of a client to its identity using the secret key of its server. In addition, the protocol possesses an efficient server revocation mechanism along with an efficient server re-assignment mechanism, which makes the protocol robust against server node compromise.

Autenticacão de Assinaturas Online: Estudo dos Parâmetros do Dynamic Time Warping e da Representação da Assinatura

O reconhecimento de padões é uma área da inteligência computacional que apoia a resolução de problemas utilizando ferramentas computacionais. Dentre esses problemas podem ser citados o reconhecimento de faces, a identificação de impressões digitais e a autenticação de assinaturas. A autenticação de assinaturas de forma automática tem sua relevância pois está ligada ao reconhecimento de indivíduos e suas credenciais em sistemas complexos e a questões financeiras. Neste trabalho é apresentado um estudo dos parâmetros do Dynamic Time Warping, um algoritmo utilizado para alinhar duas assinaturas e medir a similaridade existente entre elas. Variando-se os principais parâmetros desse algoritmo, sobre uma faixa ampla de valores, foram obtidas as médias dos resultados de erros na classificação, e assim, estas médias foram avaliadas. Com base nas primeiras avaliação, foi identificada a necessidade de se calcular um desses parâmetros de forma dinâmica, o gap cost, a fim de ajustá-lo no uso de uma aplicação prática. Uma proposta para a realização deste cálculo é apresentada e também avaliada. É também proposta e avaliada uma maneira alternativa de representação dos atributos da assinatura, de forma a considerar sua curvatura em cada ponto adquirido no processo de aquisição, utilizando os vetores normais como forma de representação. As avaliações realizadas durante as diversas etapas do estudo consideraram o Equal Error Rate (EER) como indicação de qualidade e as técnicas propostas foram comparadas com técnicas já estabelecidas, obtendo uma média percentual de EER de 3,47%.

Constructing wikis as a platform for online collaboration in an e-learning environment

Previous studies conclude that finding a collaborative tool to suit the e-Iearning environment adequately is quite a task. Consequently, research has been conducted for this very purpose, to trial the use of wikis as a platform to support collaboration in a way that students will embrace and adopt for regular use. The wiki is easily accessible, requires no software and allows its contributors to feel a sense of responsibility and ownership. However there are wiki related challenges that have yet to be researched in the online e-Iearning environment. Possible intrusions, no opinion control, user hostility, and unintentional deletions or editing all require further investigation. This paper will further research the wiki environment in the tertiary e-Iearning setting, as well as consider wiki moderation, member authentication, and interest sustainability to support this community focused collaborative tool. Relevant results from the current case study are explored whilst delivering meaningful data, thus providing an insight into how wikis are an appropriate platform to incorporate in the online collaborative environment.

An investigation into the usability of graphical authentication using AuthentiGraph

There is increasing coverage in the literature relating to the different facets surrounding the security service of authentication, but there is a need for further research into the usability of graphical authentication. Specifically, the usability and viability of graphical authentication techniques for providing increased security needs to be further explored. There is a significant amount of evidence relating to traditional authentication techniques which highlight the fact that as technological advances grip modern societies, the requirement for more advanced authentication and security approaches increases. The exponential growth in the number of people using the Internet carries with it the high potential for increased security threats, suggesting that there are needs for further techniques to increase security in online environments. This paper presents the findings of how various interface design approaches affect the usability of a previously developed alternative graphical authentication technique called AuthentiGraph. The security design provided by Authentigraph has been established and justified in previous research by the authors. The primary focus of this paper is the usability of this technique. Using an experimental laboratory based approach, combined with an online survey, 20 university students evaluated a combination of five varying graphical interfaces in three different screen sizes. The outcome provides the interface design criteria best suited for the implementation and use of the AuthentiGraph technique.

An online credential management service for InterGrid computing

Grid users and their jobs need credentials to access grid resources and services. It is important to minimize the exposure of credentials to adversaries. A practical solution is needed that works with existing software and is easy to deploy, administer, and maintain. Thus, credential management services are the wave of the future for virtual organizations such as Grid computing. This paper describes architecture of a scalable, secure and reliable on-line credential management service called SafeBox for InterGrid computing platform. SafeBox provides InterGrid users with secure mechanism for storing one or multiple credentials and access them based on need at anytime from anywhere.

User and Machine Authentication and Authorization Infrastructure for Distributed Wireless Sensor Network Testbeds

The intention of an authentication and authorization infrastructure (AAI) is to simplify and unify access to different web resources. With a single login, a user can access web applications at multiple organizations. The Shibboleth authentication and authorization infrastructure is a standards-based, open source software package for web single sign-on (SSO) across or within organizational boundaries. It allows service providers to make fine-grained authorization decisions for individual access of protected online resources. The Shibboleth system is a widely used AAI, but only supports protection of browser-based web resources. We have implemented a Shibboleth AAI extension to protect web services using Simple Object Access Protocol (SOAP). Besides user authentication for browser-based web resources, this extension also provides user and machine authentication for web service-based resources. Although implemented for a Shibboleth AAI, the architecture can be easily adapted to other AAIs.