SECURED AUTHENTICATION PROTOCOL

(IJCSIS) International Journal of Computer Science and Information Security, Vol. 8, No. 8, 2010

SECURED AUTHENTICATION PROTOCOL SYSTEM USING IMAGES G. Arumugam

R. Sujatha

Prof. & Head, Department of Computer Science Madurai Kamaraj University Madurai, India. [email protected]

Research Associate, SSE Project, Department of Computer Science Madurai Kamaraj University Madurai, India. [email protected] goal is to prevent unauthorized personnel from declassifying information. The traditional view of secured authentication is one of ensuring that information at a high security classification cannot flow down to a lower security classification.[1, 3, 12]. In this paper, Secured Authentication Protocol System using Images is proposed. It overcomes the identified drawbacks of existing systems. The attacks on existing model embedded in encrypted sessions are detected as monitoring the processes taking part in the systems is integrated. The new system uses encryption mechanisms. Hence the inside information is protected and also the outside attacks are prevented. To establish this, a server with authentication mechanism is used. Types of attacks were proscribed in the proposed system are Brute force attack, Dictionary attack, Keyloggers, Shoulder Surfing, Man-In-The-Middle attack and Database Server Compromise attack.

Abstract—In order to protect secret information from sensitive and various applications, secured authentication system should be incorporated; it should contain security and confidentiality. Even if it is assumed that the cryptographic primitives are perfect, the security goals may not be achieved: the system itself may have weaknesses that can be exploited by an attacker in network attacks. In this paper a Secured Authentication Protocol System using Images (SAPSI) is presented. It ensures confidentiality, and authentication using server and Image based authentication mechanism. Keywords- Confidentiality, Security, Server, Image-Based Authentication System, Authentication.

I.

INTRODUCTION

A significant challenge in providing an effective network system defence mechanism is to detect the intrusions and implement counter-measures. Organizations who use Secured Authentication system tolerate no leakage at all. Cryptographic primitives are useful tools but security of the primitives does not guarantee security of the system. Usage of different level of security provides a security policy that allows the classification of data and users based on a system of hierarchical security levels combined with a system of nonhierarchical security categories.[1, 5, 6].

Brute force attack. The hacker can try two kinds of Brute force attacks on this system. One is re-using of images and another is without re-use of images. For a user, there will be a unique password of length 8 or above selected in SAPSI for the given session. Possible image patterns were dynamically changed on every session along with random numbers. By performing this attack in SAPSI hacker unable to break the password because it needs two processes.

Cryptographic mechanisms are communication systems that rely upon cryptography to provide security services across distributed systems. Applications increasingly rely on encryption services provided by cryptographic systems to ensure confidentiality and authentication during secure transactions over the network. However the security provided by these encryption services might be undermined if the underlying security system has any flaws in the design or implementation. Weaknesses in security systems such as misuse of encryption, compromising the private encryption key etc., are yet to be addressed. [8].

Keyloggers. Keylogger is a program, which captures the user’s keystrokes and sends this information to the hacker. The natural protection for an authentication system from the keylogger is to have a one-time password (or Dynamic password).

Secured Authentication System is an application of a computer system to process information with different sensitivities (i.e. classification of information at different levels) to permit simultaneous access by users with different security clearance and to prevent users from obtaining access to information for which they lack authorization. Secured Authentication has two goals: first goal is to prevent unauthorized personnel from accessing information. Second

Shoulder Surfing. Shoulder surfing is looking over someone’s shoulder when they enter a password or a PIN code. It is an effective way to get information in crowded places because it is relatively easy to stand next to someone and watch as they fill out a form, enter a PIN number at an ATM machine, or use a calling card at a public pay phone. Shoulder surfing can also be done at a distance with the aid of

Dictionary attack. Dictionary attack is one of the most commonly used techniques to break a Password-based system. If same kind of sequences appeared in the network for a long time it can be guessed by the hacker.

110

http://sites.google.com/site/ijcsis/ ISSN 1947-5500


In Improving text password through persuasion (ITPTP), users entered their passwords with visibility.[2]. Users tend to choose their passwords in a simple manner by entering visibility method, which makes the hacker to know with shoulder-surfing process.

binoculars or other vision-enhancing devices to know the password. Man-In-The-Middle Attack. A man in the middle attack is one in which the attacker intercepts messages in a public key exchange and then retransmits them, substituting his own public key for the requested one, so that the two original parties still appear to be communicating with each other.

An authentication method combining text and graphical passwords (AMCTGP), and users selecting their passwords using random numbers assigned to images, is given in [11]. Users selecting their passwords by clicking random numbers listed in the selection panel can be identified by a hacker using movie-clip camera phones.

This strategy is implemented to protect information from unauthorized disclosure or modification and to provide mechanisms to authenticate users participating in the exchange of information.[7].

In Multiple password interference in text and click-based graphical passwords (MPITCGP), users select their passwords from the given image as pass points.[10]. Users’ selecting their passwords from the given image is a hectic process. If any mismatch of pass points occurred the original user itself would be unable to get authentication even by knowing pass point selections.

In section 2 related works are discussed with their drawbacks. Section 3 discusses the overview of Proposed Secured Authentication System with server and Authentication mechanism using images methodology. In section 4 implementation details related to the system are presented. Conclusion is given in section 5. II.

In Pass Pattern System (PPS): A Pattern-Based User Authentication Scheme, data hacked from database through database compromise server attack is represented. [7].

RELATED WORK

Enhanced authentication mechanism using multilevel security model (EAMMSM) is the system that belongs to and applies multilevel security. Any sensitive application it includes confidential and secret information which must be used effectively in complicated and authenticated procedures. Using five levels of authentication methods with a set of privileges assigned, each user has to surpass 50% of every level to get the privileges rights.[1]. During authentication the information was hacked from the network plane using network analyser tool. Leakage of information occurred in three levels while transmitting answers with username and multiple questions methods.

There are several attempts reported in literature about authentication schemes in lieu of the traditional Passwordbased system. Each attempt is successful in increasing the strength of the system against some of the known attacks. They are either computationally intensive or they require additional hardware/software in the infrastructure. In this section we review the current attempts, identify the gaps and emphasize the motivation for developing Secured Authentication Protocol System using Images.

AUTHENTICATION PROCESS

Level 1 Client

Authentication using Images

Level 2 Security Questions Authentication Security Questions

Verification Process in Server

Authentication Granted

User Name Resultant Factor

D e n i e d

Password

Figure 1: Secured Authentication Protocol System using Images Flow Diagram SSE Project funded through NTRO, New Delhi.

111



The client has to enter the index numbers according to the selected images in an order given during registration. As per the selection made during registration, the client has to enter index numbers now as 29, 34 and 61.

Motivation for Secured Authentication Protocol System using Images: We proposed secured authentication system is robust against attacks such as the brute force, shoulder surfing, social engineering, database server compromise attack and Man-In-The-Middle attacks. It incorporates the essence of Image-based authentication system. III.

Each image will be mapped with a corresponding number which is stored in the Image-Map table. Instead of comparing the images, the mapped numbers are compared. It serves as user friendly for the end-user and machine friendly for the system by reducing the comparison time by using numbers rather than images. A mapping mechanism which validates the index numbers with hidden letters is represented in Table I.

SECURED AUTHENTICATION PROTOCOL SYSTEM USING IMAGES

This system involves the use of authentication mechanism and a server that minimizes the hacking by the attackers. It monitors the clock cycle process effectively. Two processes are involved in this system. They are a) Authentication using Images and b) Security Questions Authentication using server represented as flow diagram in Figure 1. A. Authentication using Images This is a Image-based authentication system based on the premise that ‘humans are good at identifying, remembering and recollecting graphical image patterns than text patterns’.[9]. In SAPSI the client gets authenticated in two levels. In the first level the client gets authenticated using username and password method with graphical image patterns. It is illustrated in Figure 2. For providing the password the client has to enter the index number provided at the images. While entering index numbers in the password area it will be hidden and bullet marks will be displayed. For example, if the client chooses images rose, white lion and lord shiva then the index numbers 27, 44 and 17 should be entered in a selected order. While confirming password images index numbers were shuffled, so user has to re-enter the password by giving different index numbers according to the images chosen. Here both image patterns and index numbers are represented as dynamic arrangements in every login attempt. Due to this setup no one would be able to read or guess the mechanism involved. For every authentication the images were shuffled and index numbers were varied and shuffled. It is represented in Figure 3.

23

Figure 3: A sample shuffling mechanism of Secured Authentication Protocol System using Image Patters. The client can select the images on some sequences familiar to him/her. Due to shuffling mechanism, this method reduces the guess ability of the persons who are related to the clients. During entry of password, only bullets appear in the password area which avoids the shoulder surfing attacks. When sending random numbers in the network plane, it will be converted into a computed ascii value, so that Man-In-TheMiddle attack is prohibited. TABLE I A SAMPLE IMAGE-MAP MECHANISM FOR SAPSI

70

31

41

12

17

27

44

55

Figure 2: A sample Secured Authentication Protocol System using Image Patterns

112

Image Numbers

Const Hid Characters

I1 I2 I3 I4 I5 I6 I7 I8 I9

AO IP LJ X1 YU MK HR EW SA

Random Numbers 2 Itera3 Itera1 Iteration tion tion 23 15 20 70 21 24 31 10 18 41 16 13 12 19 35 17 29 26 27 34 90 44 61 67 55 65 58



Image Pattern setup there will be 64n (if selection of images includes reuse of images) or 64Pn (without reuse of images) different images of length n.

Using this mapping mechanism the shuffling process of images and index numbers are generated. The images are validated only by using the hidden characters and index numbers which reduce the time complexity of comparing the images.

(N2) n (N2)!

Number of possible Image Patterns = The image positions are generated using permutation sequences. Let A = {I1, I2, I3}, this set can be arranged in 3! ways as,

(N2 – n)!

[I1] [I2] [I3] [I1] [I3] [I2] [I2] [I1] [I3] [I2] [I3] [I1] [I3] [I1] [I2] [I3] [I2] [I1]

Number of possible Image Patterns for the size of N x N matrix with re-use of images as passwords (N2) n is illustrated in Table II and without re-use of images as passwords (N2)!/ (N2 – n)! is represented in Table III. TABLE II

For n images n! Sequences were generated and it will be used randomly for every attempt of registration or login.

POSSIBLE RE-USE OF IMAGE PATTERNS Length of the Image Password – n

Security Potency of Secured Authentication Protocol System using Images: In general, several attacks are possible on an authentication system. For any authentication system, the hacker can attack at least at three places: they are server, client and the communication link. The attack on server includes Brute force attack, Dictionary attack and compromising the server as a whole. At the client, the possible attacks are key logging and shoulder surfing. Finally on the communication link, the possible attack is Man-In-The-Middle attack, which can be done using packet sniffers.[7].

Size of Matrix N

4

4 6

6

8

10

12

65536

16777216

4294967296

1.0995E+12

2.81475E+14

65536

2.177E+09

2.8211E+12

3.6562E+15

4.73838E+18

8

16777216

6.872E+10

2.8147E+14

1.1529E+18

4.72237E+21

9

43046721

2.824E+11

1.853E+15

1.2158E+19

7.97664E+22

10

100000000

1E+12

1E+16

1E+20

1E+24

11

214358881

3.138E+12

4.595E+16

6.7275E+20

9.84973E+24

12

429981696

8.916E+12

1.8488E+17

3.8338E+21

7.94968E+25

13

815730721

2.33E+13

6.6542E+17

1.9005E+22

5.42801E+26

TABLE III

In terms of the data being passed from the user to the server the data stored in the secured server is comparable with the classical Password-based authentication system. In both cases, user sends the username and a password. This will be compared with the registry in the database. But because of the dynamic nature of password selection system, SAPSI is more secure than ordinary password-based scheme to attacks such as Brute force, Dictionary attack, Keylogger, Shoulder surfing and Server database compromise attack. The best known solution for such attacks is to use cryptography protocols at the server or on the communication link. In this we analyse the impact of the four attacks mentioned here on SAPSI. On analysing Brute force attack - I in SAPSI, if the hacker wants to guess the password, the probability of success will be 1/(644) = 5.96046E-08 (Since there are unlimited images, 64 images are taken as sample). If the guess is wrong, probability of success will remain the same for the next guess. It is because the password will change with every attempt. Hence, The probability of success for every attempt = 1/64n

POSSIBLE IMAGE PATTERNS WITHOUT RE-USE OF IMAGES Length of the Image Password - n Size of Matrix -N

4

6

8

10

12

4

43680

5765760

518918400

2.9059E+10

8.718E+11

6

1413720

1402410240

1.2201E+12

9.2239E+14

5.996E+17

8

15249024

53981544960

1.7846E+14

5.4967E+17

1.573E+21

9

39929760

2.33669E+11

1.2969E+15

6.8163E+18

3.388E+22

10

94109400

8.58278E+11

7.5031E+15

6.2816E+19

5.032E+23

11

203889840

2.76719E+12

3.6278E+16

4.5913E+20

5.606E+24

12

412293024

8.02322E+12

1.5169E+17

2.785E+21

4.963E+25

13

787083024

2.12985E+13

5.6241E+17

1.4488E+22

3.64E+26

To break the system, the hacker on an average has to break (nx64n)/2 images (with reuse) or (nx64Pn)/2 (without reuse).

Number of images that are to be broken =

n (N2) n 2 n N2! 2(N2 – n)!

The other way of doing Brute force attack - II is to try all combinations of positions. For example, if we consider a 8x8

113



Shoulder surfing can be done easily on the password system, just by seeing the keys that the user is typing. But to decode the password in SAPSI, the hacker has to see both the key sequence and Image patterns and do a mapping before user submits the page. So shoulder surfing is of little or no use in SAPSI as compared to a password-based system.

Number of images that are to be broken by evaluating the length of the password in Brute force attack – I method is depicted in Graph 1 and Brute force attack – II is represented in Graph 2.

In the case of SAPSI, using Man-in-the-middle attack the attacker is not able to get original messages because the images and random numbers changed dynamically on every presentation or session. Comparing these attacks and it is represented in Graph 3. The images used for password selection can be of any kind. Depending on the application it can be varied. For sample discussion nature images were used. For implementation characters, numbers and special characters were used as images. Two digit and three digit random numbers were used in implementation. In compact display applications two digit random numbers preferred and in large display applications three digit random numbers preferred to mystify hackers.

Graph 1: Number of Images that are to be broken with reuse of Images.

Graph 2: Number of Images that are to be broken without reuse of Images. N represents the size of the Image Patterns and n represents the length of the password. Analysing Dictionary attack in SAPSI, commonly used images with client guess sequences can be possible (if images and random numbers are static). However, here the image pattern changes randomly on every presentation or session; it approaches the behaviour of one-time pad.

Graph 3: Comparison of Attacks in Authentication Systems using Existing and Proposed System. B. Security Questions Authentication

SAPSI, being a dynamic password system, is not vulnerable to keyloggers. Even if the hacker gets the password of the client of a SAPSI system, this password cannot be reused by the hacker to login to the system, because of the dynamic nature of the Image Pattern system.

In second level the client gets authenticated using security questions. A 10-digit number is issued to the client at the time of registration. The client has to answer three security questions and the results are encrypted with a 10-digit number.

114



A resultant factor is passed over the network plane for validation to the server.

Evaluation of time difference for Existing and Proposed Methods 3

• • • • •

T im e in M in u te s

Encryption Process Three security questions queried (s1, s2, and s3). Ascii value evaluated for two security questions.(a1 and a2) Bitwise operation is performed, – sum1=(a1 & a2) | s3 resultant factor (sum2) = sum1 ⊕ id Ascii value of resultant factor (sum2) send to verifier.

• •

2 Existing

1.5

Proposed

1 0.5 0 0

200

400

600

800

1000

1200

No. of Persons

Figure 5: Evaluation of time difference for existing and proposed methods.

Verification Process •

2.5

During Client registration a shared 10-digit key (id) and resultant factor (sum2) issued to server. Authentication process: achieved result (sum3) of client ⊕ resultant factor (sum2). Authentication granted – a shared 10-digit key (id) generated. If not then authentication denied.

The server decrypts the resultant factor and gets the registration number of the client. After passing the Authentication using Images level and Security questions authentication level, the client gets authenticated. IV.

ANALYSIS AND IMPLEMENTATION

In this new system all drawbacks of existing methods are overcome with new secured authentication protocol system using images. This system is implemented both in single client and multiple clients with server. : :

Only two levels are used for authentication with single server to authenticate clients. No repetitive methods are used in this proposed method which does not irritate the client. No leakage of information is possible in this new method which avoids the Man-In-The-Middle attack. In [1] leakage of information which occurred during sublevel transitions is avoided in this new system. When entering password no visibility is there which protects the shoulder surfing attacks from related persons. In [2, 11] given passwords are processed using shoulder surfing and if any person tries to hack the password using capture devices, which is protected in new system by giving passwords in a hidden manner. Even if any capturing devices are used to capture images, no one will get information due to hidden bullets in the password area. It is very difficult to remember the pass points in an image [10]. This difficulty is avoided in this new system by selecting the random numbers in the images. This avoids the confused remembrance of pixel positions instead of whole images. Both existing and proposed systems were implemented and the time difference is evaluated and it is represented in Figure 5. The total image position sequences were generated for 9 images are 362880 and the results were shown in Figure 6.

Figure 6: Generated Image Position Sequences for 9 images.

115



V. CONCLUSION In order to improve the confidence in security system, detecting intrusions in those systems plays a vital role, as the security system design is not always perfect. Our system overcomes the problem encountered in existing systems and ensures the confidentiality and authentication when sending a message.

[6] Ming-Qing Ling, Wei-Wei Liu, Proceedings of the Seventh International Conference on Machine learning and Cybernetics, Kunming, 12-15 July 2008. Research on IDS based on Levenberg-Marqurdt algorithm. [7] T. Rakesh Kumar and S.V. Raghavan, PassPattern System (PPS): A Pattern-Based User Authentication Scheme, NSL, Department of Computer Science and Engineering, IITM, Chennai, India. [8] Sachin P. Joglekar, Stephen R. Tate, Protomon: Embedded Monitors for Cryptographic protocol Intrusion Detection and Prevention. Dept. of Computer Science and Engineering, University of North Texas, Denton, TX 76203. {spj0004, srt}@cs.unt.edu.

ACKNOWLEDGMENT This paper is part of SSE Project funded through a National Technical Research Organization, New Delhi is gratefully acknowledged.

[9] R. N. Shepard, C.:Recognition memory for words, sentences and pictures, Journal of verbal Learning and verbal Behavior, vol. 6, pp. 153—163 (1967). [10] Sonia Chiasson, Alain Forget, Elizabeth Stobert, P.C. van Oorschot, Robert Biddle, “Multiple Password interference in text and click-based graphical passwords”, School of Computer Science, Human Oriented Technology Lab, Carleton University, Ottawa, Canada, {aforget, chiasson, paulv}@scs.carleton.ca, [email protected]., [email protected], The definitive version was published in ACM CCS’09 November 9-13, 2009, Chicago, Illinois, USA. Copyright 2009 ACM 978-1-60558-352-5/09/11…$10.00. http://people.scs.carleton.ca/~paulv/papers/ccs09.pdf.

REFERENCES [1] Abdulameer Hussain, “Enhanced Authentication Mechanism Using Multilevel Security Model”, Faculty of Science and Information Technology, Zarka Private University, Jordan, International Arab Journal of e-Technology, Vol. 1, No.2, June 2009. [2] Alain Forget, Sonia Chiasson, P.C. van Oorschot, Robert Biddle, “Improving text passwords through persuasion”, School of Computer Science, Human Oriented Technology Lab, Carleton University, Ottawa, Canada, {aforget, chiasson, paulv}@scs.carleton.ca, [email protected]. Symposium on Usable Privacy and Security (SOUPS) 2008, July 23-25, 2008, Pittsburgh,, PA, USA.

[11] P. C. Van OorSchot Tao Wan, “TwoStep: An authentication method combining text and graphical passwords”, School of Computer Science, Carleton University, Ottawa, Canada, {paulv, twan}@scs.carleton.ca, ETechlologies: Innovation in an open world 4th International Conference, MCETECH 2009, Ottawa, Canada, May 4-6, 2009, Proceedings.

[3] Atul Kahate, Cryptography and network security, The Tata Mc-Graw Hill publications.

[12] William Stallings, Cryptography and network Security principles and practices, 2006 by pearson education, Inc.

[4] Bruice Schneier, Applied Cryptography, Protocols, Alogrithms and Source Code in C, Second Edition, Published by JOHN WILEY and SONS, Reprint 2007. [5] Hubert common and vitally shmatikov, Is it possible to decide whether a cryptographic protocol is secure or not ?

116
