Cited By
View all- Kuppusamy KBalayogi G(2023)Accessible password strength assessment method for visually challenged usersInternational Journal of Information Security10.1007/s10207-023-00714-x22:6(1731-1741)Online publication date: 14-Jun-2023
Design and implementation of Negative Authentication System
Authors: 
Dipankar Dasgupta, 
Abhijit Kumar Nag, Denise Ferebee, Sanjib Kumar Saha, Kul Prasad Subedi, Arunava Roy, Alvaro Madero, Abel Sanchez, John R. WilliamsAuthors Info & Claims
Pages 23 - 48
Abstract
Modern society is mostly dependent on online activities like official or social communications, fund transfers and so on. Unauthorized system access is one of the utmost concerns than ever before in cyber systems. For any cyber system, robust authentication is an absolute necessity for ensuring security and reliable access to all type of transactions. However, more than 80% of the current authentication systems are password based, and surprisingly, they are prone to direct and indirect cracking via guessing or side channel attacks. The inspiration of Negative Authentication System (NAS) is based on the negative selection algorithm. In NAS, the password-based authentication data for valid users are termed as password profile or self-region (positive profile); any element other than the self-region is defined as non-self-region in the same representative space. The anti-password detectors are generated which covers most of the non-self-region. There are also some uncovered regions left in the non-self-region for inducing uncertainty to the attackers. In this work, we describe the design and implementation of three approaches of NAS and its efficacy over the other authentication methods. These three approaches represent three different ways to achieve obfuscation of password points with non-password space. The experiments are conducted with both real and simulated password profiles to justify the efficiency of different implementations of NAS.
References
[1]
Bojinov, H., Bursztein, E., Boyen, X., Boneh, D.: Kamouflage: Loss-resistant password management. In: Computer Security--ESORICS 2010, pp. 286---302. Springer, Berlin (2010). http://crypto.stanford.edu/~dabo/papers/passwordmgr.pdf. Accessed 24 Jan 2017
[2]
Bond, M.: Comments on gridsure authentication. https://www.cl.cam.ac.uk/~mkb23/research/GridsureComments.pdf. (2008). Accessed 24 Jan 2017
[3]
Bonneau, J.: Guessing human-chosen secrets. Ph.D. Thesis, University of Cambridge (2012). https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-819.pdf. Accessed 24 Jan 2017
[4]
Brants, T., Franz, A.: The google web 1t 5-gram corpus version 1.1. LDC2006T13 (2006). https://catalog.ldc.upenn.edu/ldc2006t13. Accessed 24 Jan 2017
[5]
Butler, R.: List of the 1000 most common surnames in the U.S. (2009). http://names.mongabay.com/most_common_surnames.htm. Accessed 24 Jan 2017
[6]
Camenisch, J., Lehmann, A., Neven, G.: Optimal distributed password verification. In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp. 182---194. ACM, New York (2015). http://dl.acm.org/citation.cfm?id=2813722. Accessed 24 Jan 2017
[7]
Cubrilovic, N.: Rockyou hack: from bad to worse (2009). https://techcrunch.com/2009/12/14/rockyou-hack-security-myspace-facebook-passwords/. Accessed 15 Nov 2017
[8]
Dasgupta, D., Azeem, R.: An investigation of negative authentication systems. In: Proceedings of the 3rd International Conference on Information Warfare and Security, pp. 117---126 (2008). http://citeseerx.ist.psu.edu/viewdoc/citations;jsessionid=14EA96BC1BB9B1B9B8EFB47ECE961758?doi=10.1.1.372.1491. Accessed 24 Jan 2017
[9]
Dasgupta, D., Ferebee, D., Saha, S., Nag, A.K., Madero, A., Sanchez, A., William, J., Subedi, K.P.: G-nas: A grid-based approach for negative authentication. In: Symposium on Computational Intelligence in Cyber Security (CICS) at IEEE Symposium Series on Computational Intelligence (SSCI), IEEE, Orlando, Florida (2014). http://ieeexplore.ieee.org/document/7013362/. Accessed 24 Jan 2017
[10]
Dasgupta, D., Forrest, S.: An anomaly detection algorithm inspired by the immune system. In: Dasgupta, D. (ed.) Artificial Immune Systems and Their Applications, pp. 262---277. Springer, Berlin (1999)
[11]
Dasgupta, D., Ji, Z., Gonzalez, F.: Artificial immune system (AIS) research in the last five years. In: The 2003 Congress on Evolutionary Computation, 2003. CEC '03, vol. 1, pp. 123---130 (2003). http://ieeexplore.ieee.org/document/1299565/. Accessed 24 Jan 2017
[12]
Dasgupta, D., Saha, S.: Password security through negative filtering. In: 2010 International Conference on Emerging Security Technologies (EST), pp. 83---89. IEEE, Washington (2010). http://dl.acm.org/citation.cfm?id=1902111. Accessed 24 Jan 2017
[13]
De Castro, L.N., Timmis, J.: Artificial Immune Systems: A New Computational Intelligence Approach. Springer, Berlin (2002). http://www.springer.com/us/book/9781852335946. Accessed 24 Jan 2017
[14]
Esponda, F., Ackley, E.S., Helman, P., Jia, H., Forrest, S.: Protecting data privacy through hard-to-reverse negative databases. In: Information Security, pp. 72---84. Springer, Berlin (2006). https://crypto.stanford.edu/portia/papers/HardNDB.pdf. Accessed 24 Jan 2017
[15]
Everspaugh, A., Chaterjee, R., Scott, S., Juels, A., Ristenpart, T.: The pythia PRF service. In: 24th USENIX Security Symposium (USENIX Security 15), pp. 547---562 (2015). https://www.usenix.org/node/190917. Accessed 24 Jan 2017
[16]
Feldmeier, D.C., Karn, P.R.: Unix password security-ten years later. In: Advances in Cryptology, CRYPTO89 Proceedings, pp. 44---63. Springer (1990). http://www.cs.technion.ac.il/~cs236350/Material/unix-password-security-ten.pdf. Accessed 24 Jan 2017
[17]
Fülöp, Á., Kovács, L., Kurics, T., Windhager-Pokol, E.: Balabit mouse dynamics challenge data set (2016). https://github.com/balabit/Mouse-Dynamics-Challenge
[18]
Forrest, S., Perelson, A.S., Allen, L., Cherukuri, R.: Self-nonself discrimination in a computer. In: IEEE Computer Society Symposium on Research in Security and Privacy, p. 202. Institute of Electrical and Electronics Engineers (1994). http://dl.acm.org/citation.cfm?id=884218. Accessed 24 Jan 2017
[19]
Fossi, M., Johnson, E., Turner, D., Mack, T., Blackbird, J., McKinney, D., Low, M.K., Adams, T., Laucht, M.P., Gough, J.: Symantec report on the underground economy. Symantec Corporation (2008). http://eval.symantec.com/mktginfo/enterprise/white_papers/b-whitepaper_underground_economy_report_11-2008-14525717.en-us.pdf. Accessed 24 Jan 2017
[20]
Gamboa, H., Fred, A.: A behavioral biometric system based on human-computer interaction. Proc. SPIE 5404, 381---392 (2004)
[21]
Gong, L.: Collisionful keyed hash functions with selectable collisions. Inf. Process. Lett. 55(3), 167---170 (1995). http://www.sciencedirect.com/science/article/pii/002001909500085Q. Accessed 24 Jan 2017
[22]
Hofmeyr, S.A., Forrest, S.: Architecture for an artificial immune system. Evol. Comput. 8(4), 443---473 (2000). http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.486.3902&rep=rep1&type=pdf. Accessed 24 Jan 2017
[23]
Ji, Z.: Negative selection algorithms: from the thymus to v-detector. Ph.D. Thesis (2006). http://dl.acm.org/citation.cfm?id=1237333. AAI3230960
[24]
Ji, Z., Dasgupta, D.: V-detector: an efficient negative selection algorithm with probably adequate detector coverage. Inf. Sci. 179(10), 1390---1406 (2009). http://www.sciencedirect.com/science/article/pii/S0020025508005434. Accessed 24 Jan 2017
[25]
Juels, A., Rivest, R.L.: Honeywords: Making password-cracking detectable. In: Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pp. 145---160. ACM, New York (2013). https://people.csail.mit.edu/rivest/pubs/JR13.pdf. Accessed 24 Jan 2017
[26]
Kanerva, P.: Sparse Distributed Memory. MIT Press, Cambridge (1988). https://mitpress.mit.edu/books/sparse-distributed-memory. Accessed 24 Jan 2017
[27]
Khalil, G.: Password security thirty-five years late (2014). https://www.sans.org/reading-room/whitepapers/basics/password-security-thirty-five-years-35592. Accessed 24 Jan 2017
[28]
Metropolis, N., Ulam, S.: The Monte Carlo method. J. Am. Stat. Assoc. 44(247), 335---341 (1949). http://homepages.rpi.edu/~angel/MULTISCALE/metropolis_Ulam_1949.pdf. Accessed 24 Jan 2017
[29]
Pagh, R., Rodler, F.F.: Cuckoo hashing. J. Algorithms 51(2), 122---144 (2004). http://www.it-c.dk/people/pagh/papers/cuckoo-jour.pdf. Accessed 24 Jan 2017
[30]
Perlroth, N.: Hackers in China attacked the times for last 4 months. NY Times, Jan 30 (2013). http://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html. Accessed 24 Jan 2017
[31]
Schechter, S., Herley, C., Mitzenmacher, M.: Popularity is everything: a new approach to protecting passwords from statistical-guessing attacks. In: Proceedings of the 5th USENIX Conference on Hot Topics in Security, pp. 1---8. USENIX Association (2010). https://www.microsoft.com/en-us/research/publication/popularity-is-everything-a-new-approach-to-protecting-passwords-from-statistical-guessing-attacks/. Accessed 24 Jan 2017
[32]
SkulSecurity: Password-skullsecurity (2011). https://wiki.skullsecurity.org/Passwords. Accessed 24 Jan 2017
[33]
Smith, R.E.: Authentication: from passwords to public keys. Addison-Wesley Longman Publishing Co., Inc. (2001). http://dl.acm.org/citation.cfm?id=501593. Accessed 24 Jan 2017
[34]
Song, H., Dharmapurikar, S., Turner, J., Lockwood, J.: Fast hash table lookup using extended bloom filter: an aid to network processing. ACM SIGCOMM Comput. Commun. Rev. 35(4), 181---192 (2005). http://conferences.sigcomm.org/sigcomm/2005/paper-SonDha.pdf. Accessed 24 Jan 2017
[35]
Zheng, Y., Matsumoto, T., Imai, H.: Structural properties of one-way hash functions. In: Advances in Cryptology--CRYPT090, pp. 285---302. Springer, Berlin (1991). https://pdfs.semanticscholar.org/ed78/92387cd971e26241eb34f779a01807cb143c.pdf. Accessed 24 Jan 2017
- Design and implementation of Negative Authentication System
Recommendations
A new family of authentication protocols
We present a related family of authentication and digital signature protocols based on symmetric cryptographic primitives which perform substantially better than previous constructions. Previously, one-time digital signatures based on hash functions ...
A biologically inspired password authentication system
CSIIRW '09: Proceedings of the 5th Annual Workshop on Cyber Security and Information Intelligence Research: Cyber Security and Information Intelligence Challenges and StrategiesPassword authentication is very critical for secure access to computing systems/servers as it verifies the identity of users and processes. Most authentication systems use some form of Positive Authentication (PA) to identify legitimate users. ...
Dynamic key password authentication
Passwords still remain the most popular method of user authentication. Passwords appear to be the easiest way of registration and logging into remote services such as websites. However, passwords also appear to be the most insecure authentication method. ...
Comments
Please enable JavaScript to view thecomments powered by Disqus.Information & Contributors
Information
Published In
Copyright © Copyright © 2019 Springer-Verlag GmbH Germany, part of Springer Nature.
Publisher
Springer-Verlag
Berlin, Heidelberg
Publication History
Published: 01 February 2019
Author Tags
Qualifiers
- Article
Contributors
Other Metrics
Bibliometrics & Citations
Bibliometrics
Article Metrics
- View Citations1Total Citations
- 0Total Downloads
- Downloads (Last 12 months)0
- Downloads (Last 6 weeks)0
Reflects downloads up to 20 Dec 2024
Other Metrics
Citations
Cited By
View all- Kuppusamy KBalayogi G(2023)Accessible password strength assessment method for visually challenged usersInternational Journal of Information Security10.1007/s10207-023-00714-x22:6(1731-1741)Online publication date: 14-Jun-2023