Search

Purpose The average employee spends a total of 18.6 h every two months on password-related activities, including password retries and resets. The problem is caused by the user forgetting or mistyping the password (usually because of character switching). The source of this issue is that while a password containing combinations of lowercase characters, uppercase characters, digits and special characters (LUDS) offers a reasonable level of security, it is complex to type and/or memorise, which prolongs the user authentication process. This results in much time being spent for no benefit (as perceived by users), as the user authentication process is merely a prerequisite for whatever a user intends to accomplish. This study aims to address this issue, passphrases that exclude the LUDS guidelines are proposed. Design/methodology/approach To discover constructs that create security and to investigate usability concerns relating to the memory and typing issues concerning passphrases, this study was guided by three theories as follows: Shannon’s entropy theory was used to assess security, chunking theory to analyse memory issues and the keystroke level model to assess typing issues. These three constructs were then evaluated against passwords and passphrases to determine whether passphrases better address the security and usability issues related to text-based user authentication. A content analysis was performed to identify common password compositions currently used. A login assessment experiment was used to collect data on user authentication and user – system interaction with passwords and passphrases in line with the constructs that have an impact on user authentication issues related to security, memory and typing. User–system interaction data was collected from a purposeful sample size of 112 participants, logging in at least once a day for 10 days. An expert review, which comprised usability and security experts with specific years of industry and/or academic experience, was also used to validate results and conclusions. All the experts were given questions and content to ensure sufficient context was provided and relevant feedback was obtained. A pilot study involving 10 participants (experts in security and/or usability) was performed on the login assessment website and the content was given to the experts beforehand. Both the website and the expert review content was refined after feedback was received from the pilot study. Findings It was concluded that, overall, passphrases better support the user during the user authentication process in terms of security, memory issues and typing issues. Originality/value This research aims at promoting the use of a specific type of passphrase instead of complex passwords. Three core aspects need to be assessed in conjunction with each other (security, memorisation and typing) to determine whether user-friendly passphrases can support user authentication better than passwords.

No nontrivial software system can be built without regard for security. Even noncritical software systems can be used as an entry point to the critical systems to which they are connected, for example, exploiting system vulnerabilities to steal passwords for login and network access. This article describes one such attack.

With the rapid growth of wearable computing and increasing demand for mobile authentication scenarios, voiceprint-based authentication has become one of the prevalent technologies and has already presented tremendous potentials to the public. However, it is vulnerable to voice spoofing attacks (e.g., replay attacks and synthetic voice attacks). To address this threat, we propose a new biometric authentication approach, named EarPrint, which aims to extend voiceprint and build a hidden and secure user authentication scheme on earphones. EarPrint builds on the speaking-induced body sound transmission from the throat to the ear canal, i.e., different users will have different body sound conduction patterns on both sides of ears. As the first exploratory study, extensive experiments on 23 subjects show the EarPrint is robust against ambient noises and body motions. EarPrint achieves an Equal Error Rate (EER) of 3.64% with 75 seconds enrollment data. We also evaluate the resilience of EarPrint against replay attacks. A major contribution of EarPrint is that it leverages two-level uniqueness, including the body sound conduction from the throat to the ear canal and the body asymmetry between the left and the right ears, taking advantage of earphones' paring form-factor. Compared with other mobile and wearable biometric modalities, EarPrint is a low-cost, accurate, and secure authentication solution for earphone users.

Passwords/passphrases can be either system generated or user-selected. A combination of both approaches is also possible—encryption created by the system and assigned to the user by the information system meeting the policy requirements. Policy rules can be designed to increase security and usability factors, such as information storage and retrieval. This paper proposes an algorithm dedicated to the security of passphrases in an online authentication, so the passphrase entered will be stored in a remote database. Through an SHA-3 hash function, the system must hash the pass phase. Before storage, the system must apply random rotations on the already generated HASH while eliminating any traceability performed on the different transactions performed. To prevent the hacker from using them recurrently if he wants to attack our database. Then the system must recover the real HASH and then the passphrase based on the data provided by the user in the form of codes.

The authors analyse the security threats caused by personal wireless local area network (WLAN) sharing, propose schemes under two different conditions, and evaluate the performance of their schemes. WLAN is a widely used low-cost wireless networking technology. Most personal WLANs use the Wi-Fi-protected access II (WPA2)-personal to ensure robust security. Exposing the passphrase of WLAN is the only way to share it. Passphrase exposure can cause three threats, i.e. eavesdropping, evil twin attack, and resource abuse. This study addresses these threats by proposing two schemes under different device upgrade difficulties. For devices that are difficult to upgrade, their scheme only upgrades wireless routers. All WPA2-personal certified user devices can address these threats without any changes. For easy-upgrade and new devices, their scheme uses the attribute-based key exchange to address threats and provide ease of use, anonymity, and fine-grained access control. To solve the problem practically, they propose a mutual authentication method based on trust-on-first-use and a convenient attribute assignment method based on the existence of social information. The attribute authority already has numerous social information to provide services and cannot obtain more private information from participants in their scheme. The analysis shows that these proposed schemes are secure and practical.

Recent years have witnessed the surge of biometric-based user authentication for mobile devices due to its promising security and convenience. As a natural and widely-existed behavior, human speaking has been exploited for user authentication. Existing voice-based user authentication explores the unique characteristics from either the voiceprint or mouth movements, which is vulnerable to replay attacks and mimic attacks. During speaking, the vocal tract, including the static shape and dynamic movements, also exhibits the individual uniqueness, and they are hardly eavesdropped and imitated by adversaries. Hence, our work aims to employ the individual uniqueness of vocal tract to realize user authentication on mobile devices. Moreover, most voice-based user authentications are passphrase-dependent, which significantly degrade the user experience. Thus, such user authentications are pressed to be implemented in a passphrase-independent manner while being able to resist various attacks. In this paper, we propose a user authentication system, VocalLock, which senses the whole vocal tract during speaking to identify different individuals in a passphrase-independent manner on smartphones leveraging acoustic signals. VocalLock first utilizes FMCW on acoustic signals to characterize both the static shape and dynamic movements of the vocal tract during speaking, and then constructs a passphrase-independent user authentication model based on the unique characteristics of vocal tract through GMM-UBM. The proposed VocalLock can resist various spoofing attacks, while achieving a satisfactory user experience. Extensive experiments in real environments demonstrate VocalLock can accurately authenticate user identity in a passphrase-independent manner and successfully resist various attacks.

Security of the data is the utmost important in today's world scenario. To achieve completeprivacy of the data stored on various electronic devices like laptops, computers, external hard disk, USB drives etc. data storage encryption is needed to make the data more secure for any organization or any small offices. Encrypting the data provides a way out for the organization to keep a firm hold on their sensitive data or information. Intelligent devices like laptops and PC's are prone to security attacks resulting in the compromising the data. This problem can be solved by employing data encryption. Thought many encryption techniques are being used to make the data secure but a hybrid encryption algorithm should be used to make the data encryption more secure.

Presenting uncouth proposal for the design of investigating ways to use extraction feature from biometric user,rather than memorable password or passphrase as an attempt to produce a new and randomly cipher keys. Human users find itdifficult to remember long cipher keys. Therefore, the proposed work takes the eye and ear as a multi-biometrics feature extraction forgenerating the cryptography keys. Meerkat Clan Key Generation Algorithm (MCKGA) is used in this work for key generation, firstlywe generate keys with 128-bits, then we enhance our method by generating 256-bits, and finally we mix the keys produced from (eyeand ear) and get robust key with 512-bits length, these keys are tested by NIST statically test to generate random keys used in encryptionprocess. Our approach generates unique keys used in cryptographic system by using Advanced Encryption Standard (AES) algorithm.

The paper presents experiments with the home-made, low-cost prototype of a sensor-equipped pen for handwriting-based biometric authentication. The pen allows to capture the dynamics of user writing on normal paper, while producing a kind of password (passphrase) chosen in advance. The use of a word of any length instead of the user's signature makes the approach more robust to spoofing, since there is no repetitive pattern to steal. Moreover, if the template gets violated, this is much less harmful than signature catch. The entailed sensors are a pair of accelerometer and gyroscope and a pressure sensor. The aim is a natural yet precise interaction, that allows recognizing the user by the signals recorded while producing a specific word chosen during enrollment and possibly changed later. The pen can be exploited in a number of applications requiring user recognition, yet relieving from the need to learn complex procedures, and to undergo critical capture operations. The approach fuses the use of a kind of password, though not necessarily complex as those requested by traditional approaches, and biometric recognition. The novelty with respect to most proposals in literature is the combination of three elements at once: the matching of any handwritten text instead of user signature, the on-line capture of seven sensor signals to recognize handwriting dynamics (three from accelerometer, three from gyroscope and one from pressure sensor), and the use of normal paper instead of a digitizing tablet. Presented experiments test two different recognition techniques, implemented by two modules that can be alternatively plugged into the system. An SVM-based verification module entails to extract the most relevant features from writing dynamics, and to acquire a sufficient amount of enrolling data (30 samples per user) to train an SVM for each user. A pure Dynamic Time Warping (DTW) verification module does not require such training, and is tested using either a gallery with the same number of templates per user as those used for SVM training, or with a gallery containing a much lower number of templates per user (namely 5). Obtained results encourage further investigation of lightweight strategies for written password dynamics recognition.

Secure and scalable device provisioning is a notorious challenge in Wi-Fi. WPA2/WPA3 solutions take user interaction and a strong passphrase for granted. However, the often weak passphrases are subject to guessing attacks. Notably, there has been a significant rise of cyberattacks on Wi-Fi home or small office networks during the COVID-19 pandemic. This paper addresses the device provisioning problem in Wi-Fi (personal mode) and proposes ComPass protocol to supplement WPA2/WPA3. ComPass replaces the pre-installed or user-selected passphrases with automatically generated ones. For this, ComPass employs Physical Layer Security and extracts credentials from common random physical layer parameters between devices. Two major features make ComPass unique and superior compared to previous proposals: First, it employs phase information (rather than amplitude or signal strength) to generate the passphrase so that it is robust, scaleable, and impossible to guess. Our analysis showed that ComPass generated passphrases have 3 times more entropy than human generated passphrases (113-bits vs. 34-bits). Second, ComPass selects parameters such that two devices bind only within a certain proximity (\(\le \)3m), hence providing practically useful in-build PLS-based authentication. ComPass is available as a kernel module or as full firmware.

In March 2020, the COVID-19 pandemic led to a dramatic shift in educational practice, whereby home-schooling and remote working became the norm. Many typical schools outreach projects to encourage uptake of learning cyber security skills therefore were put on hold, due to the inability to physical attend and inspire. In this short paper, we describe a new approach to teaching cyber security with a view of inspiring a new generation of learners to the subject. Traditional Capture-The-Flag exercises are widely used in cyber security education, whereby a series of challenges are completed to gain access and obtain a passphrase from a computer system. We couple this approach with interactive sessions made possible via video conferencing platforms such as Microsoft Teams and Zoom, along with the very nature of being in the home environment, where home IoT devices are now commonplace. We develop an integrated CTF for the home IoT environment, where students can observe the impact of submitting flags via online video, to physical adjust the home environment - ranging from switching off lights, playing music, or controlling an IoT-enabled robot. The result is a highly interactive and engaging experience that benefits from the very nature of remote working, inspiring the notion of "hacking an IoT home".

In this paper we explore the problem of secure handling of private keys in blockchain applications. We present a novel approach, named "Partial Knowledge Recovery Scheme" (PKRS), which allows for the recovery of an encrypted private key through the use of personal security questions. In PKRS, an individual is asked a set of questions, and the answers to those questions are used to encrypt the input and produce a secured private key. Through the use of Shamir’s secret sharing algorithm, the original private key can be recovered if the individual can answer correctly only a subset of the original questions. PKRS does not require any external services for the recovery process, since all the required information is stored within the secured private key itself. This approach tries to achieve a middle ground between security and usability. Security, where the private key needs to be encrypted and safely stored offline. Usability, where an individual wants to be able to recover their private key without the need of an easily forgotten passphrase and be able to store it in their personal cloud environments. We also discuss the correct design of personal security questions in social environments where an individual’s personal data can be mined through public records and social networks. Finally, we present a blockchain Self-sovereign Identity use case, which was used for the integration and evaluation of PKRS within a real-world application.

Bitcoin is a peer-to-peer electronic cash system largely used for online financial transactions. It gained popularity due to its anonymity, privacy, and comparatively low transaction cost. Its wallet heavily relies on Elliptic Curve Digital Signature Algorithm (ECDSA). Weaknesses in such algorithms can significantly affect the safety and the security of bitcoin wallets. In this paper, a secure key management wallet was designed based on several changes in the wallet parts. In the cold wallet, we employed an image-based passphrase to achieve a strong entropy source of master seed. The hot wallet, the proposed key_ Gen algorithm is modifying to the key generation step of the ECDSA that it is to generate a fresh key pair at each transaction. The final part ensures recovering all keys on both hot and cold wallets without daily backups in case of losing the wallet. The findings prove that the proposed cold wallet is resisting against a dictionary attack and overcoming the memorizing problem. The proposed hot wallet model acquires good anonymity and privacy for bitcoin users by eliminating transaction likability without additional cost. The execution time for signing a transaction of the proposed model is~70 millisecond, which is then important in the bitcoin domain.

In this paper, an automated system is proposed to crack the WPA2 passphrase much efficiently. Two different schemes are introduced which can improve the dictionary attack and overcome the existing issues. Firstly, a method to validate the captured handshake is introduced. This helps to enhance the dictionary attack to retrieve the passphrase easily. Secondly, a design flaw in the WPS implementation is explained and used to exploit the same to crack the WPS pin. This attack is much efficient compared to existing methods. Moreover, the automated script which probes and intimates whether access point supports WPS. Access point which supports WPS will perform WPS pin attack and which does not support WPS undergoes improved dictionary attack and will obtain the passphrase.

The goal of this paper is to implement a simple encryption–decryption web application that utilizes the facility provided by AngularJS. The advanced encryption standard (AES) algorithm is implemented using the methods from the CryptoJS library. This algorithm was chosen, as it is a U.S. Federal Information Processing Standard, which was selected after a thorough process, trumping 15 competing solutions. The advantages associated with using AngularJS include the fact that it is quick to learn a language. Furthermore, two-way data-binding capability means that developer intervention is not required for data binding. Developing powerful Web applications is made easier since AngularJS architecture separates data from design. Additionally, the developers must be familiar with the model-view-controller architecture to work efficiently with AngularJS. Plaintext or instances of CryptoJS.lib.word array library may be accepted as inputs. When a string is passed for a certain key, it is considered as the passphrase, which is subsequently used to derive the key. When it comes to the CipherText, strings, or CryptoJS.lib.CipherParams, instances are accepted. All strings passed are eventually converted to a CipherParams object. Coming to the cipher output, the plain text derived after the decryption process is a word array object. The CipherText returned is a CipherParams object, which gives access to the parameters used during encryption. Ample flexibility is provided, allowing various formats to be used. Essentially, a format is nothing but two-method objects—stringify and parse. This help converts CipherParams objects and CipherText strings. The practical implementation of the method involves downloading and installing NodeJS, AngularCLI, and Visual Studio code, the detailed explanation of which is elaborated under the proposed method section. AES algorithm performs well irrespective of the size of data to be encrypted as it has a big-O time complexity which is constant—O(1).

We investigate the effectiveness of thermal attacks against input of text with different characteristics; we study text entry on a smartphone touchscreen and a laptop keyboard. First, we ran a study (N = 25) to collect a dataset of thermal images of short words, websites, complex strings (special characters, numbers, letters), passphrases and words with duplicate characters. Afterwards, 20 different participants visually inspected the thermal images to attempt to identify the text input. We found that long and complex strings are less vulnerable to thermal attacks, that visual inspection of thermal images reveals different parts of the entered text (36% on average and up to 82%) even if the attack is not fully successful, and that entering text on laptops is more vulnerable to thermal attacks than on smartphones. We conclude with three learned lessons and recommendations to resist thermal attacks.

Computer passphrase authentication designed with usability consideration encourages memorability. This passphrase study suggests successful recollection using an assembly of meaningful word groups evidenced by individual physiological performance measurements. Participant data collected at the Hawaiʻi Interdisciplinary Neurobehavioral and Technology Lab (HINT) demonstrate physiological responses to passphrase decision making. The results from university students indicate psychophysiological influences predict passphrase characteristics. The repeated measures investigation of user-created and system-imposed passphrases contribute understanding toward user authentication selection that supports encoding and recalling a secret, unlike the current traditional password composed of alphanumeric and special characters. Passphrases constructed with usability considerations support security compliance requirements. This explanatory study employs pilot-tested passphrases designed to reveal predictive psychophysiological behavior. Overall results indicate user-created passphrases produce less cognitive load stressors on working memory than system-imposed passphrases. However, physiological measurements from heart rate, skin conductance, and the facial corrugator supercilii muscle signify a mixture of passphrase types that imply memorability. Study results suggest a platform for future passphrase design research of longer passwords that inform security access, improve memorability, and enhance usability evaluated by human-centered performance.

This article is based on the study of ways to create a secure password by integrating symbols from non-linguistic sign systems, in order to combine cryptographic strength and ease of memorization. This is relevant, as the old ways of complicating the password become obsolete, in view of their triviality and, as a result, susceptibility to hacking. Our research is based on the use of a system of symbols from various fields of interest (chemistry, programming, music, etc.) in the password. We take into account the individual preferences of users, so that it would be easier for them to build an associative chain when remembering a password, and also considered the susceptibility of passwords obtained using the password techniques we proposed to the most common cyber-attacks. The respondents created one password on their own, and the second with the help of the proposed methods. The complexity and security of the password was estimated in terms of entropy, as well as using specialized programs. Using the proposed methods reduced the number of insecure keys., Technology and Language, 2(1), 98-121

The voice user interface (VUI) has been progressively used to authenticate users to numerous devices and applications. Such massive adoption of VUIs in IoT environments like individual homes and businesses arises extensive privacy and security concerns. Latest VUIs adopting traditional voice authentication methods are vulnerable to spoofing attacks, where a malicious party spoofs the VUIs with pre-recorded or synthesized voice commands of the genuine user. In this paper, we design VibLive, a continuous liveness detection system for secure VUIs in IoT environments. The underlying principle of VibLive is to catch the dissimilarities between bone-conducted vibrations and air-conducted voices when human speaks for liveness detection. VibLive is a text-independent system that verifies live users and detects spoofing attacks without requiring users to enroll specific passphrases. Moreover, VibLive is practical and transparent as it requires neither additional operations nor extra hardwares, other than a loudspeaker and a microphone that are commonly equipped on VUIs. Our evaluation with 25 participants under different IoT intended experiment settings shows that VibLive is highly effective with over 97% detection accuracy. Results also show that VibLive is robust to various use scenarios.

The problems of increasing the reliability of using various resources, access to which is carried out by means of infocommunication networks, are considered. It is known that the first barrier in ensuring high reliability of access is a high-quality user authentication system. Currently preference is given to access systems based on biometric characteristics of a user. Initially, the priority was given to static biometric characteristics of a user (face image, finger papillary picture and iris). These biometric features did not meet the expectations of developers and users due to the simplicity of their forgery. At present, the main attention of developers is focused on implementation of dynamic (behavioral) biometric features of users and, first of all, voice authentication systems. Voice authentication systems have a number of significant advantages: simplicity, compactness, low cost, and a number of others. It is also important that the user's passphrase can be quickly changed and extended in the process of voice authentication. The quality indicators of voice authentication systems, like all biometric access systems, do not meet the increasing requirements. In the process of voice authentication, the amplitude-frequency spectrum of the recording materials is analyzed. The main efforts of researchers are focused on using estimates of the pitch frequency and formant frequencies associated with it, cepstral coefficients, mel-frequency cepstral coefficients, and linear prediction coefficients as a user template. Some attention is paid to decision-making procedures based on Gaussian Mixture Model, Support Vector Machine, and Hidden Markov Models or artificial neural networks. In the presented work, it is proposed to supplement the analysis of the amplitude-frequency spectrum with studies of phase data, which is currently receiving less focus in the process of voice authentication. The results of research on estimates of pitch frequency and mel-frequency cepstral coefficients based on the amplitude and phase information of the voice signal are presented. The purpose of this work is to analyze the informativeness of phase data of a voice signal, as well as to study the stability of estimates of the user's template and, first of all, mel-frequency cepstral coefficients calculated from the phase data. The studies performed have shown high informativeness and stability of the investigated estimates, which emphasizes the importance of the phase information of the voice signal for improving quality characteristics of voice authentication systems.

Wi-Fi Protected Access II Pre-Shared Key (WPA2-PSK) is a hot way to wireless security in public Wi-Fi networks. It works on a pre-configured passphrase shared with all stations in the same Wi-Fi network. Session keys (e.g., Pairwise Transient Key, PTK) between stations and the access point (AP) are derived from the passphrase. The WPA2-PSK networks can authenticate external stations, however, they fail to guarantee confidential communication if internal attackers own the passphrase in the network since all stations derive their PTK using the same passphrase. To prevent internal stations from eavesdropping the PTK, a secure session key negotiation scheme in WPA2-PSK Networks (SSKNS) is proposed. We introduce a temporary session key (TSK), which is encrypted using elliptic curve cryptography (ECC) and exchanged securely between the station and the AP in the Wi-Fi association process. Through AES algorithm with TSK, the station encrypts its own nonce used to generate the unique PTK in the 4-way process. Our scheme neither modifies the legacy process related to PTK generation nor adds plethoric overhead on excessive protection of all messages. Security analysis and simulations performed in NS-3 demonstrate that by consuming a few computation overheads, SSKNS can effectively provide security level, compared with the existing schemes.

To secure mobile devices, such as laptops and smartphones, against unauthorized physical data access, employing Full Disk Encryption (FDE) is a popular defense. This technique is effective if the device is always shut down when unattended. However, devices are often suspended instead of switched off. This leaves confidential data such as the FDE key, passphrases and user data in RAM which may be read out using cold boot, JTAG or DMA attacks. These attacks can be mitigated by encrypting the main memory during suspend. While this approach seems promising, it is not implemented on Windows or Linux. We present FridgeLock to add memory encryption on suspend to Linux. Our implementation as a Linux Kernel Module (LKM) does not require an admin to recompile the kernel. Using Dynamic Kernel Module Support (DKMS) allows for easy and fast deployment on existing Linux systems, where the distribution provides a prepackaged kernel and kernel updates. We tested our module on a range of 4.19 to 5.3 kernels and experienced a low performance impact, sustaining the system's usability. We hope that our tool leads to a more detailed evaluation of memory encryption in real world usage scenarios.

Security policies require a secret code to access electronic information. Challenges exist between the usability and memorability of passwords. This study spotlights individualistic behavioral assimilation of passphrase styles for design insight and recall abilities. Data captured categorical authentication behavior toward enhanced usability outcomes. Validated locus of control personality and memory associative instruments demonstrated the internal and external personality types and cognitive response types that contribute to the systematic quest toward a more memorable passphrase scheme. Personalized criteria contributed to practical evaluation employing a repeated measures structure. This study tested 58 participants who successfully completed a passphrase survey consisting of four rulesets applied to imposed and user created passphrases designed for repeated measures. Although electrophysiological data was collected, it was not analyzed in time for this publication. Results indicate that memory associative factors of cognition represent a significant factor in the recall of 75% of imposed passphrase category types. The locus of control and memory associative variables are significant at the .05 level. Internally controlled participants preferred the created room objects and created no vowel passphrases. Additionally, the created room objects and animal association passphrases ranked the highest among the externally controlled subjects. The imposed passphrases constructed without vowels and associated with animals received the least recall. This descriptive study informs passphrase usability identifying cognitive demands that impact memory.

Objective: We developed a new authentication system based on passphrases instead of passwords. Our new system incorporates a user-generated mnemonic picture displayed during login, definition tooltips, error correction to reduce typographical errors, a decoy-based input masking technique, and random passphrase generation using either a specialized wordlist or a sentence template. Background: Passphrases exhibit a greater level of security than traditional passwords, but their wider adoption has been hindered by human factors issues. Our assertion is that the added features of our system work particularly well with passphrases and help address these shortcomings. Method: We conducted a study to evaluate our new system with a customized 1,450-word list and our new system with a 6-word sentence structure against the control conditions of a user-created passphrase of at least 24 characters and a system-generated passphrase using a 10,326-word list. Fifty participants completed two sessions so that we could measure the usability and security of the authentication schemes. Results: With the new system conditions, memorability was improved, and security was equivalent to or better than the control conditions. Usability and overall ratings also favored the new system conditions over the control conditions. Conclusion: Our research presents a new authentication system using innovative techniques that improve on the usability and security of existing password and passphrase authentication systems. Application: In computer security, drastic changes should never happen overnight, but we recommend that our contributions be incorporated into current authentication systems to help facilitate a transition from passwords to usable passphrases.

To keep password users from creating simple and common passwords, major websites and applications provide a password-strength measure, namely a password checker. While critical requirements for a password checker to be stringent have prevailed in the study of password security, we show that regardless of the stringency, such static checkers can leak information and actually help the adversary enhance the performance of their attacks. To address this weakness, we propose and devise the Dynamic Password Policy Generator , namely DPPG , to be an effective and usable alternative to the existing password strength checker. DPPG aims to enforce an evenly-distributed password space and generate dynamic policies for users to create passwords that are diverse and that contribute to the overall security of the password database. Since DPPG is modular and can function with different underlying metrics for policy generation, we further introduce a diversity-based password security metric that evaluates the security of a password database in terms of password space and distribution. The metric is useful as a countermeasure to well-crafted offline cracking algorithms and theoretically illustrates why DPPG works well.

A model of neurons for biometric authentication, capable of efficient processing of highly dependent features, based on the agreement criteria (Gini, Сramer-von-Mises, Kolmogorov-Smirnov, the maximum of intersection areas of probability densities) is proposed. An experiment was performed on comparing the efficiency of neurons based on the proposed model and neurons on the basis of difference and hyperbolic Bayesian functionals capable of processing highly dependent biometric data. Variants of construction of hybrid neural networks, that can be trained on a small number of examples of a biometric pattern (about 20), are suggested. An experiment was conducted to collect dynamic biometric patterns, in the experiment 90 people entered handwritten and voice patterns during a month. Intermediate results on recognition of subjects based on hybrid neural networks were obtained. Number of errors in verification of a signature (handwritten password) was less than 2%, verification of a speaker by a fixed passphrase was less than 6%. The testing was carried out on biometric samples, obtained after some time period after the formation of training sample.

A data structure to enhance PKI (Public Key Infrastructure) authentication is proposed.With the data structure, the PKI authentication server can distinguish the execution environment of PKI authentication.The proposal covers all of the use cases of private key, activated with passphrase or biometrics, generated with biometrics. In this paper, a data structure to enhance PKI (Public Key Infrastructure) authentication is proposed generalizing the concept of ISO/IEC 24761. Current technologies do not provide sufficient information on products which are used in the authentication process at the Claimant to the Verifier. As a result, the Verifier cannot sufficiently distinguish the authentication result executed with a trusted product from that without a trusted product. The difference is made clear if evidence data of the execution of authentication process at the Claimant are generated by the trusted product and used for verification by the Verifier. Data structure for such data is proposed in this paper as client Authentication Context (cAC) instance. Relation to other works and extension of the proposal where biometrics is used are also described for further improvement of PKI authentication. For this proposal to realize, standardization activities are to be considered as the next steps.

User authentication is necessary to provide services on an application system and the Internet. Various authentication methods are used such as ID/PW, biometric, and OTP authentications. One of the popular authentications is ID/PW authentication. As an inputted password is transferred by one-way hash function and then stored in DB, it is difficult for the DB administrator to figure out the password inputted by the user. However, when DB is leaked, and there is the time to decode, the password can be hacked. The time and cost to decode the original message from the hash value corresponding a short password decrease. Therefore, if the password is short, then attacking cost is low, and password crack possibility is high. In the case where an attacker utilizes pre-computing rainbow tables, and the hash value of short passwords is leaked, the password that the user inputted can be cracked. In this research, to block rainbow table attacks, when the user generates a short password, by adding additional messages of identification information of a system or the user and extending the length of the password, we try to resolve the vulnerability of short passwords. By proposing a model to minimize the length of the password and the authority accordingly in mobile devices on which inputting passwords is not easy, we take security into consideration. Our proposal model is strong against rainbow table attack and provides efficient password system to users. It contributes to resolving password vulnerability and upgrades mobile users’ convenience in typing passwords.

Bitcoin cryptocurrency is reportedly one widely used digital currency in criminal activities (e.g. used for online purchases of illicit drugs and paying of ransom in ransomware cases). However, there has been limited forensic research of bitcoin clients in the literature. In this paper, the process memory of two popular bitcoin clients, bitcoin Core and electrum, is examined with the aims of identifying potential sources and types of potential relevant data (e.g. bitcoin keys, transaction data and passphrases). Artefacts obtained from the process memory are also studied with other artefacts obtained from the client device (application files on disk and memory-mapped files and registry keys). Findings from this study suggest that both bitcoin Core and electrum’s process memory is a valuable source of evidence, and many of the artefacts found in process memory are also available from the application and wallet files on the client device (disk).

Identity authentication techniques based on password-authenticated key exchange (PAKE) protocols rely on weak secrets shared between users and host systems. In PAKE, a symmetric key is derived from the shared secret, used to mutually authenticate communicating parties, and then used to establish a secure channel for subsequent communications. A common source of PAKE weak secrets are password and passphrase strings. Though easily recalled by a user, these inputs typically require keyboard entry, limiting their utility in achieving universal access. This paper describes authentication techniques based on weak secrets derived from knowledge extracted from biometric sensors and brain-actuated control systems. The derived secrets are converted into a format suitable for use by a PAKE protocol. When combined with other authentication factors, PAKE protocols can be extended to provide strong, two-factor identity authentication that is easy to use by persons living in assistive environments.

In this work, the classification of keystroke data, a behavioral biometrics modality, is investigated. The users degrading the overall classification performance are identified by classifying two different databases composed of different number of individuals and passphrases. The improvement in performance is demonstrated by eliminating those users in the training phase of the classifier.

User identification or recognition based on keystrokes is the ability of the system to recognise or identify the persons or users who type the username, passphrase or password with a specific keystroke behaviour patterns. Therefore, user identification problem based on the keystroke behaviour patterns is posed as a multi-class classification problem, where some standard multi-class machine learning techniques identify multiple users. In this paper, we employed Extreme Gradient Boosting (XGBoost) technique for user identification in the context of behavioral biometrics using the keystroke dynamics features. Multiple users from CMU's keystroke dynamics dataset are analysed using Machine Learning (ML) Techniques such as the XGBoost, Multinomial Logistic Regression, Random Forest, Probabilistic Neural Network, Decision Tree, Multinomial Naive Bayes and a Multilayer Perceptron. The performance measure utilised for the user identification problem is accuracy. We observed that XGBoost produced the highest accuracy for user identification. We also performed statistical paired t-Test at 1% level of significance on the techniques employed for the user identification task. Therefore, our results were corroborated statistically too.

In this study, we propose Heresy, a web application to generate a document that solely exists in the form of a Uniform Resource Locator (URL) fragment. That document is compressed using Lempel-Ziv-Markov algorithm (LZMA) and encrypted using one of four symmetric-key cryptography algorithms: AES, Rabbit, RC4, and Triple DES. This allows a user to create a secured document using markdown markup language, and then share or save the generated URL. In order to view the document, a valid passphrase is needed. All operations are performed in the client machine (serverless). We analyzed the capability and performance of Heresy in several devices to find out the best cryptography algorithm to secure a document.

The issues of improving the reliability of storing various resources, access to which is carried out using telecommunication networks, are considered. In this case, the first barrier in ensuring access reliability is the user authentication system. Lately, access systems based on biometric features of a user have been used. Initially, static biometric features of a user (facial image, finger papillary pattern and iris) were preferable, which did not meet the expectations of developers and users due to the simplicity of their falsification. Recently, the preference has been given to the dynamic (behavioral) biometric features of a user, namely voice authentication systems became more widely used. As it is known, voice authentication systems have several advantages, such as: simplicity, convenience, compactness, low cost, and a number of others. In addition, the passphrase can be quickly changed and expanded during the authentication process. However, the quality indicators of all biometric access systems do not meet the increasing requirements. The object of the study is the process of digital processing of voice signal during user authentication in access systems.In the process of voice authentication, the analysis of the amplitude-frequency spectrum of recording materials is performed. At the same time, the main research focuses on the use of estimates of formants, cepstral coefficients, mel-frequency cepstral coefficients, linear prediction coefficients, etc. as a user’s template. On the basis of user’s established patterns, admission decisions are made using Gaussian Mixture Models, Support Vector Machines, Hidden Markov Models or artificial neural networks.In the report, it is proposed to change the paradigm of digital processing of user voice signals and supplement the analysis of the amplitude-frequency spectrum with studies of phase data, which are traditionally ignored during the authentication. According to the authors, the latter is caused by the lack of effective procedures for the formation of phase data, the requirement of additional computational resources, which were not always available to researchers, and some features using the signal phase.

We propose and study the use of geographic hints to aid memorability of passphrase-style authentication secrets. Geographic hints are map locations that are selected by the user at the time of passphrase creation, and shown to the user as a hint at the time of passphrase login. We implement the GeoHints system and analyze how geographic hints impact the usability and security of passphrase-style secrets in a multi-session user study (n=38). The study involved testing for multiple passphrase interference-each participant was asked to recall 4 distinct passphrases. Our study indicates that while geographic hints showed promise for reducing memory interference, GeoHints (as implemented) does not produce a viable authentication system, as the login success rate was 25% 7–11 days after passphrase selection. We analyze the root causes of login errors, finding that most were due to inexact recall of free-form text input. This finding points towards opportunities to improve the system design, and we suggest improvements that we believe will lead to viable systems that employ geographic hints.

Voice has been used as biometrics for human authentication because different people have different voice characteristics due to different vocal tract shapes and intonations. However, traditional voice based human authentication is subject to four types of attacks: impersonation, voice conversion, synthesis and voice replay. In this paper, we propose SpeakPrint, an ultrasound based human speech authentication scheme for smartphones which is resistant for these attacks. Compared with traditional speech authentication system which focuses on what a user speaks, SpeakPrint captures how a user speaks by recording mouth and vocal movement through ultrasound signal at the same time. Our key insight is that for the valid user, features extracted from voice signal should be consistent with his mouth and vocal movement recorded from ultrasound signal, while an imitator or an audio player can’t produce the same signals in ultrasound domain. SpeakPrint extracts MFCC feature in normal voice frequency and MMSI features from ultrasound signal. An SVM classifier is trained to detect these attacks by comparing above feature differences. We implemented SpeakPrint on Samsung S5 and conducted experiments on 40 users. Experimental results show that SpeakPrint can detect replay attacks with 100% accuracy and replay attack with lip synching for 99.12% for passphrases longer than five words. This technology can be used in multi-factor authentication systems, where multiple authentication mechanisms are used to achieve defense in depth.

Entering text passwords on mobile devices is a significant challenge. Current systems either display passwords in plain text: making them visible to bystanders, or replace characters with asterisks shortly after they are typed: making editing them harder. This work presents a novel approach to mask text passwords by distorting them using graphical filters. Distorted passwords are difficult to observe by attackers because they cannot mentally reverse the distortions. Yet passwords remain readable by their owners because humans can recognize visually distorted versions of content they saw before. We present results of an online questionnaire and a user study where we compared Color-halftone, Crystallize, Blurring, and Mosaic filters to Plain text and Asterisks when 1) entering, 2) editing, and 3) shoulder surfing one-word passwords, random character passwords, and passphrases. Rigorous analysis shows that Color-halftone and Crystallize filters significantly improve editing speed, editing accuracy and observation resistance compared to current approaches.

The demand of cloud robotics makes data encryp-tion essential for peer robot communications. Certain types of data such as odometry, action controller and perception data need to be secured to prevent attacks. However, the introduction of data encryption caused increment of overhead for data stream communication. This paper presents an evaluation of CryptoROS architecture on Robot Operating System (ROS) which focused on peer-to-peer conversations between nodes with confidentiality and integrity violation. OpenSSL is used to create a private key and generate a Certificate Signing Request (CSR) that contains public key and a signature. The CSR is submitted to a Certificate Authority (CA) to chain the root CA certificate and encryption of RSA private key with AES-256 and a passphrase. The protected private key are securely backed up, transported, and stored. Experiments were carried out multiple times with and without the proposed protocol intervention to assess the performance impact of the Manager. The results for different number of messages transmitted each time increased from 100, 250 to 500 with performance impact 1.7%, 0.5% and 0.2%, respectively. It is concluded that CryptoROS capable of protecting messages and service requests from unauthorized intentional alteration with authenticity verification in all components.

Current state-of-the-art automatic speaker verification (ASV) systems are prone to spoofing. The security and reliability of ASV systems can be threatened by different types of spoofing attacks using voice conversion, synthetic speech, or recorded passphrase. It is therefore essential to develop countermeasure techniques which can detect such spoofed speech. Inspired by the success of deep learning approaches in various classification tasks, this work presents an in-depth study of convolutional neural networks (CNNs) for spoofing detection in automatic speaker verification (ASV) systems. Specifically, we have compared the use of three different CNNs architectures: AlexNet, CNNs with max-feature-map activation, and an ensemble of standard CNNs for developing spoofing countermeasures, and discussed their potential to avoid overfitting due to small amounts of training data that is usually available in this task. We used popular deep learning toolkits for the system implementation and have released the implementation code of our methods publicly. We have evaluated the proposed countermeasure systems for detecting replay attacks on recently released spoofing corpora ASVspoof 2017, and also provided in-depth visual analyses of CNNs to aid for future research in this area.