User authentication Research Papers - Academia.edu (original) (raw)

Gait recognition is a technique that identifies or verifies people based upon their walking patterns. Smartwatches, which contain an accelerometer and gyroscope have recently been used to implement gait-based biometrics. However, this prior work relied upon data from single sessions for both training and testing, which is not realistic and can lead to overly optimistic performance results. This paper aims to remedy some of these problems by training and evaluating a smartwatch-based biometric system on data obtained from different days. Also, it proposes an advanced feature selection approach to identify optimal features for each user. Two experiments are presented under three different scenarios: Same-Day, Mixed-Day, and Cross-Day. Competitive results were achieved (best EERs of 0.13% and 3.12% by using the Same day data for accelerometer and gyroscope respectively and 0.69% and 7.97% for the same sensors under the Cross-Day evaluation. The results show that the technology is sufficiently capable and the signals captured sufficiently discriminative to be useful in performing gait recognition.

- by
- •
- Biometrics, Neural Networks, Forest biometrics, Biometrics And Identity

Summary Nowadays, user authentication is one of the important topics in information security. Text-based strong password scheme can provide security to a certain degree. However, the fact that strong passwords being difficult to memorize often leads their owners to write them down on papers or even save them in a computer file. Graphical authentication has been proposed as a possible alternative solution to text-based authentication, motivated particularly by the fact that humans can remember images better than text. Recently, many networks, computer system and Internet-based environments try using graphical authentication techniques as their user’s authentication. Graphical passwords have two essential aspects, usability and security. Unfortunately till now none of the proposed algorithms were able to cover both of them simultaneously. This paper presents a review on the security and usability features of graphical password authentication schemes. In this study we surveyed 23 paper...

- by Samaneh Farmand
- •
- Computer Science, Graphical Password, User authentication, Usable Security

For intelligent service robots, it is essential to recognize users in order to provide appropriate services to a correctly authenticated user. However, in robot environments in which users freely move around the robot, it is difficult to force users to cooperate for authentication as in traditional biometric security systems. This paper introduces a user authentication system that is designed to recognize users who are unconscious of a robot or of cameras. In the proposed system, biometrics and semi-biometrics are incorporated to cope with the limited applicability of traditional authentication techniques. Semi-biometrics indicates a set of features useful for discriminating persons, but only in the interested group of persons and in the interested frame of time. As a representative semi-biometric feature, body height and color characteristics of clothes are investigated. In particular, a novel method to measure body height with single camera is proposed. In addition, by incorporating tracking functionality, the system can maintain the user status information continuously, which is useful not only for recognition but also for finding a designated person. 1

- by hosub yoon
- •
- Engineering, Computer Science, Face Recognition, Biometrics

Because of the variety of types of collaboration services used in enterprises today, there is difficulty in integrating related work threads from different collaboration environments. Each collaboration tool differs in storage model, APIs, content organization, content addressing, content formats, user authentication, and user interface. Nevertheless users prefer to be able to choose which collaboration tool they use for a given interaction, and over the course of long-term collaboration, will typically use a variety of tools, including email, instant messages, wikis, blogs, web conferences, and shared documents. The solution presented here is to provide a federated integration of these different collaboration tools to make content access and transfer straight forward between different systems. Additionally, we enable the user to achieve this federation by working directly in the client application of their choice; we illustrate this with plug-ins for MS Outlook, Internet Explorer and Skype. Our architecture integrates both desktop and servercentric tools.

- by Venkatesh Krishnaswamy
- •
- Electronic publishing, User Interface, Instant Messaging, Information Flow

- by Eui-young Cha
- •
- Interest Groups, Human Robot Interaction, User authentication, Body Height

In this paper we present a new Document Management System called DrStorage. This DMS is multi-platform, JCR-170 compliant, supports WebDav, versioning, user authentication and authorization and the most widespread file formats (Adobe PDF, Microsoft Office, HTML,...). It is also easy to customize in order to enhance its search capabilities and to support automatic metadata assignment. DrStorage has been integrated with an automatic language guesser and with an automatic keyword extractor: these metadata can be assigned automatically to documents, because the DrStorage's server part has benn modified to allow that metadata assignment takes place as documents are put in the repository. Metadata can greatly improve the search capabilites and the results quality of a search engine. DrStorage's client has been customized with two search results view: the first, called timeline view, shows temporal trends of queries as an histogram, the second, keyword cloud, shows which words are ...

A new multi-modal biometric authentication approach using gait signals and fingerprint images as biometric traits is proposed. The individual comparison scores derived from the gait and fingers are normalized using four methods (min-max, z-score, median absolute deviation, tangent hyperbolic) and then four fusion approaches (simple sum, user-weighting, maximum score and minimum core) are applied. Gait samples are obtained by using a dedicated accelerometer sensor attached to the hip. The proposed method is evaluated using 7200 fingerprint images and gait samples. Fingerprints are collected by a capacitive line sensor, an optical sensor with total internal reflection and a touch-less optical sensor. The fusion results of these two biometrics show an improved performance and a large step closer for user authentication on mobile devices.

- by Mohammad Derawi and +1
- •
- Optical Sensor, Mobile Device, Total Internal Reflection, User authentication

Cloud computing is an emerging technology that is still unclear to many security problems and user authentication, access control, and ensuring the security of stored data in cloud servers are the most challenging issues in cloud-based environment. Accordingly, this paper offers an efficient and scalable user authentication scheme for cloud computing environment. It the suggested model, various tools and techniques have been introduced and used by using the concept of agent. Therefore, a client-based user authentication agent has been introduced to confirm identity of the user in client-side. Furthermore, a cloud-based software-as-a-service application has been used to confirm the process of authentication for unregistered devices. Moreover, there are two separate servers for storing authentication and cryptography resources from main servers to decrease the dependency of user authentication and encryption processes from main server. Cryptography agent was also introduced to encrypt resources before storing on cloud servers. In overall, the theoretical analysis of the suggested scheme shows that, designing this user authentication and access control model will enhance the reliability and rate of trust in cloud computing environments as an emerging and powerful technology in various industries.

- by Sohrab Rouzbeh
- •
- Information Technology, Information Security, Computer Security, Cryptography

An intrusion-tolerant distributed system is a system which is designed so that any intrusion into apart of the system will not endanger confidentiality, integrity and availability. This approach is suitable for distributed systems, because distribution enables isolation of elements so that an intrusion gives physical access to only a part of the system. By intrusion, we mean not only computer breakins by non-registered people, but also attempts by registered users to exceed or to abuse their privileges. In particular, possible malice of security administrators is taken into account. This paper describes how some functions of distributed systems can be designed to tolerate intrusions, in particular security functions such as user authentication and authorization, and application functions such as file management.

- by Rajni Yadav
- •
- Distributed Computing, Computer Networks, Security, Computer Security

Abstract: Nowadays, user authentication is one of the important topics in information security. Text based strong password schemes could provide with certain degree of security. However, the fact that strong passwords being difficult to memorize often leads their owners to write them down on papers or even save them in a computer file. Graphical user authentication (GUA) has been proposed as a possible alternative solution to text based authentication, motivated particularly by the fact that humans can remember images better ...

- by Samaneh Farmand
- •
- Computer Science, Information Security, Network computing, User authentication

The development of communication technology have motivated the Citizen and the Government to communicate through electronic medium. For successful communication, a multifaceted electronic instrument must act as an interface between the participants, which will uniquely identify the Citizen. A brief literature review of several relevant research works further validate this concept of electronic transactions. In India though we have several instruments, which claim to uniquely identify the Citizen, non of them have proved to be efficient enough for all type of transactions. As a part of collective functioning towards problem solving approach, the authors have proposed a multivariate electronic smart card based E-Governance model. The proposed instrument named as Multipurpose Electronic Card (MEC) will attempt to uniquely identify the Citizen during various types of electronic transactions. As the complete solution of this problem is beyond the reach of an individual, to strengthen the user authentication scheme of our proposed model, we have shown the initial design for Digital Certificate based security protocols during Citizen-to-Government (C2G) type of transaction. For validation of the Citizen's identity,
initially we have used name and date of birth of the Citi zen. To further strengthen the validation process, we intend to include other vital parameters of the Citizen in near future, which will also explore future scope of research works in this field. To summarize, we can say that, the main objective of this research paper is to show the user authentication protocol using Digital Certificates, based on the vital parameters of the Citizen during Citizen -to-Government (C2G) type of proposed E-Governance transaction.

- by ABHISHEK ROY
- •
- DIGITAL CERTIFICATES, Object, User authentication

Smartwatches, which contain an accelerometer and gyroscope, have recently been used to implement gait/activity-based biometrics. However, many research questions have not been addressed in the prior work such as the training and test data was collected in the same day from a limited dataset, using unrealistic activities (e.g., punch) and/or the authors did not carry out any particular study to identify the most discriminative features. This paper aims to highlight the impact of these factors on the biometric performance. The acceleration and gyroscope data of the gait and game activity was captured from 60 users over multiple days, which resulted in a totally of 24 h of the user's movement. Segment-based approach was used to divide the time-series acceleration and gyroscope data. When the cross-day evaluation was applied, the best obtained EER was 0.69%, and 4.54% for the walking and game activities respectively. The EERs were significantly reduced into 0.05% and 2.35% for the above activities by introducing the majority voting schema. These results were obtained by utilizing a novel feature selection process in which the system minimizing the number of features and maximizing the discriminative information. The results have shown that smartwatch-based activity recognition has significant potential to recognize individuals in a continuous and user friendly approach.

- by Neamah Hasan
- •
- Biometrics, Activity Recognition, Human Activity Recognition, User authentication

This paper presents a security framework that continuously authenticates smart homes users in order to make sure that only authorized ones are allowed to control their Internet of Things (IoT) devices while, at the same time, preventing them in case of performing abnormal and dangerous control actions. To do so, control commands under normal operation of both users and devices, are first implicitly traced to build a One Class Support Vector Machine (OCSVM) model as a baseline from which deviations (i.e., anomalous commands) should be detected and rejected, while normal observations (i.e., normal commands) should be considered as legitimate and allowed to be executed. Experiments conducted on our artificial datasets show the efficiency of such user behavior-based approach achieving at least 95.29% and 4.12% of True Positive (TP) and False Positive (FP) rates, respectively.

- by Noureddine Amraoui
- •
- Smart Home, Internet of Things (IoT), User authentication

Unlike other access control systems based on biometric features, keystroke analysis has not led to techniques providing an acceptable level of accuracy. The reason is probably the intrinsic variability of typing dynamics, versus other-very stable-biometric characteristics, such as face or fingerprint patterns. In this paper we present an original measure for keystroke dynamics that limits the instability of this biometric feature. We have tested our approach on 154 individuals, achieving a False Alarm Rate of about 4% and an Impostor Pass Rate of less than 0.01%. This performance is reached using the same sampling text for all the individuals, allowing typing errors, without any specific tailoring of the authentication system with respect to the available set of typing samples and users, and collecting the samples over a 28.8-Kbaud remote modem connection.

- by Claudia Picardi
- •
- Information Systems, Access Control, Computer Software, User authentication

With the recent advancements in technology, more and more people rely on their personal devices to store their sensitive information. Concurrently, the environment in which these devices are connected have grown to become more dynamic and complex. This opens the discussion of if the current authentication methods being used in these devices are reliable enough to keep these user's information safe. This paper examines the different user authentication schemes proposed to increase the security of different devices. This article is split into two different avenues discussing authentication schemes that use either behavioral biometrics or physical-layer authentication. This survey will discuss both the advantages and challenges that arise with the accuracy, usability, and overall security of machine learning methods in these authentication systems. This article aims to improve further research in this field by exhibiting the various current authentication models, their schematics, and their results.

- by Rushit Dave
- •
- Machine Learning, Behavioral Biometrics, User authentication

Purpose To identify and discuss the issues and success factors surrounding biometrics, especially in the context of user authentication and controls in the banking sector, using a case study. Design/methodology/approach The literature survey and analysis of the security models of the present information systems and biometric technologies in the banking sector provide the theoretical and practical background for this work. The impact of adopting biometric solutions in banks was analysed by considering the various issues and challenges from technological, managerial, social and ethical angles. These explorations led to identifying the success factors that serve as possible guidelines for a viable implementation of a biometric enabled authentication system in banking organisations, in particular for a major bank in New Zealand. Findings As the level of security breaches and transaction frauds increase day by day, the need for highly secure identification and personal verification information systems is becoming extremely important especially in the banking and finance sector. Biometric technology appeals to many banking organisations as a near perfect solution to such security threats. Though biometric technology has gained traction in areas like healthcare and criminology, its application in banking security is still in its infancy. Due to the close association of biometrics to human, physical and behavioural aspects, such technologies pose a multitude of social, ethical and managerial challenges. The key success factors proposed through the case study served as a guideline for a biometric enabled security project called Bio Sec, which is envisaged in a large banking organisation in New Zealand. This pilot study reveals that more than coping with the technology issues of gelling biometrics into the existing information systems, formulating a viable security plan that addresses user privacy fears, human tolerance levels, organisational change and legal issues is of prime importance. Originality/value Though biometric systems are successfully adopted in areas such as immigration control and criminology, there is a paucity of their implementation and research pertaining to banking environments. Not all banks venture into biometric solutions to enhance their security systems due to their socio technological issues. This paper fulfils the need for a guideline to identify the various issues and success factors for a viable biometric implementation in a bank's access control system. This work is only a starting point for academics to conduct more research in the application of biometrics in the various facets of banking businesses.

Nowadays, user authentication is one of the important topics in information security. Strong text-based password schemes could provide with certain degree of security. However, the fact that strong passwords are difficult to memorize often leads their owners to write them down on papers or even save them in a computer file. Graphical authentication has been proposed as a possible alternative solution to text-based authentication, motivated particularly by the fact that humans can remember images better than text. In recent years, many networks, computer systems and Internetbased environments try used graphical authentication technique for their user's authentication. All of graphical passwords have two different aspects which are usability and security. Unfortunately none of these algorithms were being able to cover both of these aspects at the same time. During our research, we could find eleven Recall-Based authentication algorithms which we tried to explain their lacks and attacks. Then in the last section, in order to cover usability and security features at the same time, we try to make three different comparison tables.

GRSB - guaranteed, reliable, secure broadcast - is a protocol that provides reliable and secure broadcast/multicast communications. It can be implemented in many types of networks - local area networks, wide area networks, as well as satellite communications. The methodology used in this protocol is surprisingly simple. Three logical nodes are enforced in the network - a central retransmiter, a designated acknowledger, and a playback recorder(s). Through the coordinated service of the three nodes, every user node can be guaranteed to receive all broadcast messages in the correct temporal order. A fourth logical node, the security controller, can be added to the protocol to provide security-related services such as user authentication, message encryption, etc. In this paper, we have proposed a multilevel broadcast model of GRSB (guaranteed, reliable and secure broadcast) protocol , where 1st level broadcast mostly maintains the traditional GRSB model. 2nd level broadcast has two types of nodes where nodes of Is' kind i.e. nodes that are directly connected with the attachment nodes, can be temporarily in 'not alive' condition and hence follow the traditional GRSB model as well. On the other hand, nodes of 2nd kind i.e. nodes that are not directly connected with the attachment nodes, must be 'alive' all the time and have to follow two phases to finish the broadcast.

One of the most commonly used two-factor user authentication mechanisms nowadays is based on smart-card and password. A scheme of this type is called a smart-card-based password authentication scheme. The core feature of such a scheme is to enforce twofactor authentication in the sense that the client must have the smart-card and know the password in order to gain access to the server. In this paper, we scrutinize the security requirements of this kind of schemes, and propose a new scheme and a generic construction framework for smart-card-based password authentication. We show that a secure password based key exchange protocol can be efficiently transformed to a smartcard-based password authentication scheme provided that there exist pseudorandom functions and target collision resistant hash functions. Our construction appears to be the first one with provable security. In addition, we show that two recently proposed schemes of this kind are insecure.

- by Xiaotie Deng
- •
- Distributed Computing, Security Requirements, Provable Security, Smart Card

There are many secure authentication schemes that are secure but difficult to use. Most existing network applications authenticate users with a username and password pair. Such systems using the reusable passwords are susceptible to attacks based on the theft of password. Each scheme has its merits and drawbacks (Misbahuddin, Aijaz Ahmed, & Shastri, 2006). To overcome the susceptibility in the existing applications, there is an authentication mechanism known as Two-Factor Authentication. Two-Factor Authentication is a process used to authenticate or verify the identity of a person or other entity requesting access under security constraints. It is a system wherein two different factors are used in conjunction to authenticate. Using two factors as opposed to one factor generally delivers a higher level of authentication assurance. The proposed scheme allows users to freely choose their PassFile (file password) instead of remembering the password, eliminating the problem of entering the reusable password and remembering the password. In this scheme, we proposed an efficient scheme for remote user authentication. It does not maintain verifier table and allows the user to freely choose and change their passwords. The proposed scheme provides best usability for the user in terms of PassFile without changing the existing protocol. This approach uses a smart card and is secure against identity theft, guessing attack, insider attack, stolen verifier attack, replay attack, impersonation attack, and reflection attack. The proposed achieves the mutual authentication essential for many applications.

- by mohammed misbahuddin
- •
- Network Security, Privacy enhancing technologies, Identity Theft, Smart Card

The purpose of this paper is to present a set of well-investigated Internet of Things (IoT) security guidelines and best practices that others can use as a basis for future standards, certifications, laws, policies and/or product ratings. Most, if not all, of these guidelines would apply to any Internet- connected device; however, this paper focuses on security and privacy measures either peculiar to the IoT or especially relevant to the IoT. This paper assumes the end-to-end processing model of the Internet, in which application features such as security are handled by end nodes of the network, client and server hardware. It focuses on security mechanisms, including patching and updating, that should be considered at the manufacturing design phase rather than after devices have already been built or deployed.

- by Jared Bielby and +2
- •
- Algorithms, Information Technology, Technology, Information Security

User authentication refers to user identification based on something a user knows, something a user has, something a user is or something the user does; it can also take place based on a combination of two or more of such factors. With the increasingly diverse risks in online environments, user authentication methods are also becoming more diversified. This research analyzes user authentication methods being used in various online environments, such as web portals, electronic transactions, financial services and e-government, to identify the characteristics and issues of such authentication methods in order to present a user authentication level system model suitable for different online services. The results of our method are confirmed through a risk assessment and we verify its safety using the testing method presented in OWASP and NIST SP800-63.

- by AIDA AMAN
- •
- Information Technology, Information Security, Computer Security, PKI

Modern industrial communication networks are increasingly based on open protocols and platforms that are also used in the office IT and Internet environment. This reuse facilitates development and deployment of highly connected systems, but also makes the communication system vulnerable to electronic attacks. This paper gives an overview of IT security issues in industrial automation systems which are based on open communication systems. First, security objectives, electronic attack methods, and the available countermeasures for general IT systems are described. General security objectives and best practices are listed. Particularly for the TCP/IP protocol suite, a wide range of cryptography-based secure communication protocols is available. The paper describes their principles and scope of application. Next, we focus on industrial communication systems, which have a number of security-relevant characteristics distinct from the office IT systems. Confidentiality of transmitted data may not be required; however, data and user authentication, as well as access control are crucial for the mission critical and safety critical operation of the automation system. As a result, modern industrial automation systems, if they include security measures at all, emphasize various forms of access control. The paper describes the status of relevant specifications and implementations for a number of standardized automation protocols. Finally, we illustrate the application of security concepts and tools by brief case studies describing security issues in the configuration and operation of substations, plants, or for remote access.

- by Dacfey Dzung
- •
- Biomedical Engineering, Access Control, Industrial Automation, Communication System

User authentication is an important topic in the field of information security. To enforce security of information, passwords were introduced. Text based password is a popular authentication method used from ancient times. However text based passwords are prone to various attacks. Strong text-based password schemes could provide with certain degree of security. However, the fact that strong passwords are difficult to memorize often leads their users to write them down on papers or even save them in a computer file. Human actions such as choosing bad passwords and inputting passwords in an insecure way are regarded as the weakest link in the authentication chain. Graphical password is one of the alternative solution to alphanumeric password as it is very simple process to remember alphanumeric password. One of the major reasons behind this method implementation is that, according to psychological studies human mind can easily remember images than alphabets or digits. Graphical authentication has been proposed as a possible alternative solution to text-based authentication. A new technique of captcha and OTP is being used for the verification purpose. Three times a person is given chance to try for login if the person fails then he is blocked till the session expires. I. INTRODUCTION Initially all the web authentication was done on the basis of text password. Text password was the only system used for authentication system. But as time goes on this system finds many disadvantages to use it. As like this was not trusted as it had always threat of getting hacked. Text password always tested the memory of the user, so it wasn't good system. The basic concept of this system is simply the interaction of user with sequence of images. The basic goal of this system is to achieve higher security with simple technique to use by a user and harder to guess by a hacker. Image password authentication system is best alternative for text password. This system provides user-friendly environment for the users with a kind of image interaction. Here the password need not be a string of characters it can use few images this may be easy for the users to remember. Then the graphical password authentication system creates the great impact on authentication system, initially pass point and persuasive click point were the systems used as the alternative of the text password. A new technique of image password and OTP is being used for the verification purpose. 3 times a person is given chance to try for login if the person fails then he is blocked till the session expires. Image Password is a computer program or system intended to distinguish human from machine input, typically as a way of thwarting spam and automated extraction of data from websites. OTPs avoid a number of shortcomings that are associated with traditional (static) password-based authentication; a number of implementations also incorporate two factor authentication by ensuring that the one-time password requires access to something a person has (such as a specific cellphone).Then the Image Password input is been inserted and login is decided whether it is authenticated or not.

- by Ijariit Journal
- •
- Information Technology, Information Security, Security, Computer Security

In mobile banking schemes; financial services are availed and banking services are provided using mobile devices. GSM services are greatly utilized for data transmission by the technologies used in conducting mobile transactions. In their operations; these technologies send data in plaintext. Financial service providers tend to rely on the security services provided by the GSM which has been proved to be susceptible to cryptanalytic attacks. The used algorithms for crypto mechanisms are flawed leaving data carried through the network vulnerable upon interception. Operators need to take precaution by enforcing some protective measures on the information to be transmitted. This paper describes an SMS based model designed with security features to enhance data protection across mobile networks. Features for data encryption, integrity, secure entry of security details on the phone, and improved security policies in the application server are incorporated. We address issues of data confidentiality, user authentication and message integrity in order to provide end-to-end security of data carried on GSM networks.

- by Baraka William
- •
- Computer Science, Information Technology, Information Security, Security

This paper presents a hybrid fingerprint matching al- gorithm for user authentication based on the fusion of heterogeneous schemes, and designed to run on pro- grammable smart cards. The approach is based on the well known texture vector and minutiae based tech- niques, where image processing and feature extraction occur on the host, while the card device performs the final

- by Tommaso Cucinotta
- •
- Java Card, Feature Extraction, Smart Card, Hybrid Approach

Wireless LAN technologies implemented on controller-based wireless LAN design not to mention their critical evaluation is an issue which causes a great deal of debate. Entering into a new era that the needs of technology optimization grow rapidly, Enterprise wireless networking is meaningful to be achieved not to mention that it is considered a basic topic to be analyzed. This research is particularly outstanding for the reader because it will analyze the most important standards and protocols of wireless technology, distinctly 802.11 network tailored o business needs. It must be stressed that the wireless LAN controller-based WLAN design, and autonomous AP based wireless LAN design will be compared and contrasted. Furthermore, there will be critically evaluated related technologies including WLAN controller, CAPWAP and DTLS, user authentication - EAP and EAP methods not to mention 802.11n and 802.11ac. All the above, will be adopted and implemented on a medium company with 265 employees. There will also be provided floor plans for the two buildings and two floors that the company owes not to mention a logical diagram where all will be connected wirelessly based on national and international communication standards. Considering the factors related to this topic, the question of what specific consequences arise when addressing this theme must be elaborated.

- by Vasiliki Panagiotopoulou
- •
- Networking, Mobility, Jitter, VoIP Performance

User authentication in computer systems has been a cornerstone of computer security for decades. The concept of a user id and password is a cost effective and efficient method of maintaining a shared secret between a user and a computer system. One of the key elements in the password solution for security is a reliance on human cognitive ability to remember the shared secret. In early computing days with only a few computer systems and a small select group of users, this model proved effective.

- by Art Conklin
- •
- Computer Security, Financial Services, Conceptual Model, Cost effectiveness

We propose active cookies as a tool for stronger user/client authentication on the Web. An ordinary cookie is automatically released to any server associated with a particular domain name. It is therefore vulnerable to capture by pharming, that is, spoofing of domain names. An active cookie, by contrast, resists such pharming attacks. Active cookies rely on a new protocol we propose that channels client communications to a specific, valid IP address. This protocol exploits a combination of cookie-based (or cached-object-based) authentication with a new type of IP-tracing protocol. This IP-tracing protocol helps defend against the presence of an attacker in the loop during an authentication session, but is unaffected by IP-address changes in clients between sessions. Active cookies are fully transparent to users. They require no explicit installation or behavioral changes from users, and thus avoid the security risks and deployment complications of plug-ins, new login procedures, and standalone applications. While active cookies have functional and security limitations, we believe that they are an attractive countermeasure to a range of phishing and pharming attacks and a useful complement to existing techniques for user authentication. We demonstrate the practicality of active cookies through experimental implementation.

- by Markus Jakobsson
- •
- Behavior change, User authentication

The Internet of Things (IoT) is an extensive system of networks and connected devices with minimal human interaction and swift growth. The constraints of the System and limitations of Devices pose several challenges, including security; hence billions of devices must protect from attacks and compromises. The resource-constrained nature of IoT devices amplifies security challenges. Thus standard data communication and security measures are inefficient in the IoT environment. The ubiquity of IoT devices and their deployment in sensitive applications increase the vulnerability of any security breaches to risk lives. Hence, IoT-related security challenges are of great concern. Authentication is the solution to the vulnerability of a malicious device in the IoT environment. The proposed Multi-level Elliptic Curve Cryptography based Key Distribution and Authentication in IoT enhances the security by Multi-level Authentication when the devices enter or exit the Cluster in an IoT system. The decreased Computation Time and Energy Consumption by generating and distributing Keys using Elliptic Curve Cryptography extends the availability of the IoT devices. The Performance analysis shows the improvement over the Fast Authentication and Data Transfer method.

This paper presents Nemesis, a novel methodology for mitigating authentication bypass and access control vulnerabilities in existing web applications. Authentication attacks occur when a web application authenticates users unsafely, granting access to web clients that lack the appropriate credentials. Access control attacks occur when an access control check in the web application is incorrect or missing, allowing users unauthorized access to privileged resources such as databases and files. Such attacks are becoming increasingly common, and have occurred in many high-profile applications, such as IIS and WordPress [31], as well as 14% of surveyed web sites . Nevertheless, none of the currently available tools can fully mitigate these attacks.

- by Mike Dalton
- •
- Access Control, Information Flow, Sql Injection, User authentication

User-to-tag authentication can prevent a variety of potential attacks on personal RFID tags. In this poster, a new RFID authentication scheme is presented that allows a user to control when a tag responds to queries by leveraging a mobile... more

- by Borhan Uddin
- •
- Computer Science, Usability, Mobile phone, User authentication
- by J. Ortega-garcia
- •
- Mechanical Engineering, Intellectual Property, Signal Processing, Biometrics

Traditional authentication (identity verification) systems, used to gain access to a private area in a building or to data stored in a computer, are based on something the user has (an authentication card, a magnetic key) or something the user knows (a password, an identification code). However, emerging technologies allow for more reliable and comfortable user authentication methods, most of them based on biometric parameters. Much work could be found in the literature about biometric-based authentication, using parameters like iris, voice, fingerprints, face characteristics, and others. In this work a novel authentication method is presented and preliminary results are shown. The biometric parameter employed for the authentication is the retinal vessel tree, acquired through retinal digital images, i.e., photographs of the fundus of the eye. It has already been asserted by expert clinicians that the configuration of the retinal vessels is unique for each individual and that it does not vary during his life, so it is a very well-suited identification characteristic. Before the verification process can be executed, a registration step is required to align both the reference image and the picture to be verified. A fast and reliable registration method is used to perform this step, so that the whole authentication process takes about 0.3 s.

- by María J. Carreira
- •
- Biometrics, User Interface, Computer Security, Authentication

We present a novel system for automatic identification of vehicles as part of an intelligent access control system for a garage entrance. Using a camera in the door, cars are detected and matched to the database of authenticated cars. Once a car is detected, License Plate Recognition (LPR) is applied using character detection and recognition. The found license plate number is matched with the database of authenticated plates. If the car is allowed access, the door will open automatically. The recognition of both cars and characters (LPR) is performed using state-ofthe-art shape descriptors and a linear classifier. Experiments have revealed that 90% of all cars are correctly authenticated from a single image only. Analysis of the computational complexity shows that an embedded implementation allows user authentication within approximately 300ms, which is well within the application constraints. Index Terms -Garage door opening, computer vision, license plate recognition, object detection, histogram of oriented gradients.

Lower/physical layer characteristics have been considered as potential alternatives/complements to provide security services in wireless networks. This article provides an overview about various non-cryptographic mechanisms for user authentication and device identification in wireless networks using lower/physical layer properties or information. We discuss merits and demerits of these authentication/identification schemes and the practical implementation issues. Future research on crosslayer security design concludes this paper.

- by Kannan Govindan
- •
- Distributed Computing, Antennas, Wireless Communications, Network Security

Man-in-the-middle attacks pose a serious threat to SSL/TLSbased electronic commerce applications, such as Internet banking. In this paper, we argue that most deployed user authentication mechanisms fail to provide protection against this type of attack, even when they run on top of SSL/TLS. As a possible countermeasure, we introduce the notion of SSL/TLS session-aware user authentication, and present different possibilities for implementing it. More specifically, we start with a basic implementation that employs impersonal authentication tokens. Afterwards, we address extensions and enhancements and discuss possibilities for implementing SSL/TLS session-aware user authentication in software.

- by Ralf Hauser
- •
- Distributed Computing, Internet Banking, Computer Communications, User authentication

AbstractThe AVANTE Architecture described in this paper, implements a WBI environment based on CORBA distributed software components for course management, user authentication, collaborative work, database access, presentation, and other... more

- by Adelaide Bianchini and +1
- •
- Free Software, Course Management Systems, Web based instruction, Database Management

Java TM security technology originally focused on creating a safe environment in which to run potentially untrusted code downloaded from the public network. With the latest release of the Java TM Platform (the Java TM 2 Software Development Kit, v 1.2), fine-grained access controls can be placed upon critical resources with regard to the identity of the running applets and applications, which are distinguished by where the code came from and who signed it. However, the Java platform still lacks the means to enforce access controls based on the identity of the user who runs the code. In this paper, we describe the design and implementation of the Java TM Authentication and Authorization Service (JAAS), a framework and programming interface that augments the Java TM platform with both user-based authentication and access control capabilities.

- by Larry Gong
- •
- Access Control, Authentication, Authorisation, Authorization
- by Niraj Satnalika
- •
- Computer Science, Biometrics, Computer Security, Authentication

Establishing identity is becoming critical in our vastly interconnected society. Questions such as "Is she really who she claims to be?," "Is this person authorized to use this facility?," or "Is he in the watchlist posted by the government?" are routinely being posed in a variety of scenarios ranging from issuing a driver's license to gaining entry into a country. The need for reliable user authentication techniques has increased in the wake of heightened concerns about security and rapid advancements in networking, communication, and mobility. Biometrics, described as the science of recognizing an individual based on his or her physical or behavioral traits, is beginning to gain acceptance as a legitimate method for determining an individual's identity. Biometric systems have now been deployed in various commercial, civilian, and forensic applications as a means of establishing identity. In this paper, we provide an overview of biometrics and discuss some of the salient research issues that need to be addressed for making biometric technology an effective tool for providing information security. The primary contribution of this overview includes: 1) examining applications where biometrics can solve issues pertaining to information security; 2) enumerating the fundamental challenges encountered by biometric systems in real-world applications; and 3) discussing solutions to address the problems of scalability and security in large-scale authentication systems.

- by S. Pankanti
- •
- Engineering, Information Security, User authentication, Large Scale

Goal: The present work aims to present how the use of a blockchain two-factor authentication solution 2FA on a page developed on WordPress can contribute to the information security regarding user authentication. Design/Methodology/Approach: The research method employed is characterized as an exploratory research, since all the analysis is based on the theoretical reference data available on the subject. A field research was carried out in relation to the implementation of the multi-factor authentication plugin Hydro Raindrop MFA, which uses blockchain technology offered by The Hydrogen Technology Corporation and the Project Hydro platform over the Ethereum network. Thus, this paper sought to present and conceptualize some of the technologies used, pointing out their contribution to information security. Results: The main results showed that the use of decentralized technology, such as blockchain and the Hydro Raindrop Plugin, can contribute considerably in the process of user authe...

- by Jeferson Tadeu de Lima and +1
- •
- Computer Science, Information Technology, Information Security, Cryptography

- by Anael Sam
- •
- Computer Science, Information Technology, Information Security, Security

A secure, user-convenient approach to authenticate users on their mobile devices is required as current approaches (e.g., PIN or Password) suffer from security and usability issues. Transparent Authentication Systems (TAS) have been introduced to improve the level of security as well as offer continuous and unobtrusive authentication (i.e., user friendly) by using various behavioural biometric techniques. This paper presents the usefulness of using smartwatch motion sensors (i.e., accelerometer and gyroscope) to perform Activity Recognition for the use within a TAS. Whilst previous research in TAS has focused upon its application in computers and mobile devices, little attention is given to the use of wearable devices-which tend to be sensor-rich highly personal technologies. This paper presents a thorough analysis of the current state of the art in transparent and continuous authentication using acceleration and gyroscope sensors and a technology evaluation to determine the basis for such an approach. The best results are average Euclidean distance scores of 5.5 and 11.9 for users' intra acceleration and gyroscope signals respectively and 24.27 and 101.18 for users' inter acceleration and gyroscope activities accordingly. The findings demonstrate that the technology is sufficiently capable and the nature of the signals captured sufficiently discriminative to be useful in performing Activity Recognition.

- by Neamah Hasan
- •
- Biometrics, Neural Networks, Biometrics And Identity, Activity Recognition

Automated security systems are a useful addition to today's home where safety is an important issue. Vision-based security systems have the advantage of being easy to set up, inexpensive and non-obtrusive. This paper proposes an integrated dual-level vision-based home security system, which consists of two subsystems -a face recognition module and a motion detection module. The primary face recognition module functions as a user authentication device. On an event of a failure in the primary system, the secondary motion detection module acts as a reliable backup to detect human-related motions within certain locations inside the home. Novel algorithms have been proposed for both subsystems. Several experiments and field tests conducted have shown good performance and feasible implementation in both subsystems 1 .

- by Lee Wei
- •
- Face Recognition, Computer Security, Control Systems, Authentication

The most common computer authentication method is to use alphanumerical usernames and passwords. This method has been shown to have significant drawbacks. They have problems such as being hard to remember, vulnerable to guessing, phishing, dictionary attack, key-logger, and social engineering. Researchers have come out with an alternate password scheme called graphical password where they tried to improve the security and avoid the weakness of conventional password. Psychological studies say that human can remember pictures better than text. But graphical password scheme also has several drawbacks like shoulder-surfing problem, more storage space required and hard to implement compared to text passwords. In this paper, we have suggested a hybrid authentication system combining graphical and text passwords. User authentication has been verified in two steps to increase the security. We believe that in our system, users will be able to select stronger passwords through better user interface design.

- by Babbar Imam
- •
- Information Security, Security, Computer Security, Graphical Passwords