Replay Attack Prevention in Kerberos Authentication Protocol using Triple Password

Abstract

Replay attack and password attacks are serious issues in the Kerberos authentication protocol. Many ideas have been proposed to prevent these attacks but they increase complexity of the total Kerberos environment. In this paper we present an improved method which prevents replay attacks and password attacks by using Triple password scheme. Three passwords are stored on Authentication Server and Authentication Server sends two passwords to Ticket Granting Server (one for Application Server) by encrypting with the secret key shared between Authentication server and Ticket Granting server. Similarly, Ticket Granting Server sends one password to Application Server by encrypting with the secret key shared between TGS and application server. Meanwhile, Service-Granting-Ticket is transferred to users by encrypting it with the password that TGS just received from AS. It helps to prevent Replay attack.

Formal Analysis of MCAP Protocol Against Replay Attack

“…Authenti-cation protocols are always vulnerable to a variety of attacks such as message replay, data interception and manipulation, repudiation, and impersonation. Therefore, it is necessary for systems' designers to have some degree of assurance before enforcing any authentication protocol [14].…”

“…Attacking authentication protocols using replay attacks approach can be done using the authentication request message (challenge message of initiator), authentication response message (response message of responder) or may be based on both messages [14]. If messages in any authentication protocol are exchanged without appropriate freshness identifiers, then an adversary can easily get themselves authenticated by replaying messages copied from a legitimate authentication session.…”

“…The absence of formal methods for verification of security protocols could lead to security errors remaining undetected [13]. Moreover, formal verification techniques can provide a systematic way of discovering protocol flaws [14] [20]. This allows us to check if there are any inconsistencies might exist in the MCAP.…”

“…Nashwan and Alshammari; BJMCS, 22(1),[1][2][3][4][5][6][7][8][9][10][11][12][13][14] 2017; Article no.BJMCS.32744 Indirect Mutual Authentication (ATM Terminal -CIFI)…”

Importance of Information Security Education and Awareness in Ghana

“…The main objective of these intruders is to gain power and control over the computer system or network. [19,20]. There are different techniques and methods employed by these intruders to automatically gain access or privileges into these systems, this include password guessing, intercepting, social engineering, virus etc.…”