A secured authentication protocol which resist password reuse attack

Abstract

Passwords are the powerful tools that tend to keep all data and information digitally safe. It is frequently noticed that text password remains predominantly popular over the other formats of passwords, due to the fact that it is simple and expedient. However, text passwords are not always sturdy enough and are very easily stolen and misused under different vulnerabilities. Other persons can obtain a text password when a person creates a weak password or a password that is completely reused in many sites. In this condition if one password is hacked, it can be used for all the websites. This is called the Domino Effect. Another unsafe situation is when a person enters his/her password in a computer that is not trust-worthy; the password is prone to stealing attacks such as phishing, malware and key loggers etc. Among the most significant current threats to online banking are keylogging and phishing. These attacks extract user identity and account information to be used later for unauthorized access to user's financial accounts. This paper proposes a user authentication protocol which leverages a user's Android Smartphone and short message service to resist password stealing and password reuse attacks. This protocol only requires each participating website possesses a unique phone number and users only need to remember a long-term password for login on all websites. To provide more security to Android Smartphone, an additional method called color pattern screen locking is also proposed in this paper.Index Terms-Authentication, Password, Encryption and decryption, Network security, password reuse attack, password stealing attack.

Denglu1-extension: solve password vulnerabilities and optimize user experience

“…Yildirim et al [11] provide users with persuasive information through password creation, which undoubtedly increases the user's use cost. Prajitha et al [1] proposed a user authentication protocol, which uses Android mobile phones and SMS services to resist password theft and password reuse attacks. Each time a user verifies their Web identity, they only need to fill in the username in the browser.…”

A Clustered Hybrid Honeypot Architecture

“…Any system providing connectivity to a computer network may be at risk. Currently, security by authentication [1] [2] [3] and authorisation of production systems is considered to be insufficient since a potential attacker may steal identity data of another user or bypass authentication, violating system security [4] [5] [6]. With the development of information technology, our knowledge of computer systems advances, tooattackers can analyse weaknesses of the respective systems and use them during the attack itself.…”

A Bastion Mobile ID-Based Authentication Technique (BMBAT)

“…The authors in [12] proposed a user authentication scheme that leverages a user's Android smartphone and SMS to resist password stealing and password reuse attacks, such that the user identity is verified using the mobile application by sending an encrypted one-time secret to the server using SMS such that the server can verify the user's identity.…”