A cloud authentication protocol using One-Time Pad

Abstract

Abstract-There is a significant increase in the amount of data breaches in corporate servers in the cloud environments. This includes username and password compromise in the cloud and account hijacking, thus leading to severe vulnerabilities of the cloud service provisioning. Traditional authentication schemes rely on the users to use their credentials to gain access to cloud service. However once the credential is compromised, the attacker will gain access to the cloud service easily. This paper proposes a novel scheme that does not require the user to present his credentials, and yet is able to prove ownership of access to the cloud service using a variant of zero-knowledge proof. A challenge-response protocol is devised to authenticate the user, requiring the user to compute a one-time pad (OTP) to authenticate himself to the server without revealing password to the server. A prototype has been implemented to facilitate the authentication of the user when accessing Dropbox, and the experiment results showed that the overhead incurred is insignificant.

Vulnerabilities in One Time Passwords and Protection Method Using Secret Key and Biometric Hash Code

“…Several authentication systems have incorporated a more recent form of verification using images, either concealed or identifiable, in lieu of traditional passwords [11]. Passwords and PINs are susceptible to various advanced threats, including brute force, dictionary attacks, and password guessing attempts.…”

“…One of the primary drawbacks of the conventional approach is the SMS transmission delay [11]. When the roaming service is off, the bank cannot deliver the SMS-OTP, which stops the user from continuing any additional activities.…”