Jie, Lucas Chong Wei, Chong, Siew-Chin.
2021.
Histogram of Oriented Gradient Random Template Protection for Face Verification. 2021 9th International Conference on Information and Communication Technology (ICoICT). :192—196.
Privacy preserving scheme for face verification is a biometric system embedded with template protection to protect the data in ensuring data integrity. This paper proposes a new method called Histogram of Oriented Gradient Random Template Protection (HOGRTP). The proposed method utilizes Histogram of Oriented Gradient approach as a feature extraction technique and is combined with Random Template Protection method. The proposed method acts as a multi-factor authentication technique and adds a layer of data protection to avoid the compromising biometric issue because biometric is irreplaceable. The performance accuracy of HOGRTP is tested on the unconstrained face images using the benchmarked dataset, Labeled Face in the Wild (LFW). A promising result is obtained to prove that HOGRTP achieves a higher verification rate in percentage than the pure biometric scheme.
Jin, Weizhao, Ji, Xiaoyu, He, Ruiwen, Zhuang, Zhou, Xu, Wenyuan, Tian, Yuan.
2021.
SMS Goes Nuclear: Fortifying SMS-Based MFA in Online Account Ecosystem. 2021 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W). :7—14.
With the rapid growth of online services, the number of online accounts proliferates. The security of a single user account no longer depends merely on its own service provider but also the accounts on other service platforms (We refer to this online account environment as Online Account Ecosystem). In this paper, we first uncover the vulnerability of Online Account Ecosystem, which stems from the defective multi-factor authentication (MFA), specifically the ones with SMS-based verification, and dependencies among accounts on different platforms. We propose Chain Reaction Attack that exploits the weakest point in Online Account Ecosystem and can ultimately compromise the most secure platform. Furthermore, we design and implement ActFort, a systematic approach to detect the vulnerability of Online Account Ecosystem by analyzing the authentication credential factors and sensitive personal information as well as evaluating the dependency relationships among online accounts. We evaluate our system on hundreds of representative online services listed in Alexa in diversified fields. Based on the analysis from ActFort, we provide several pragmatic insights into the current Online Account Ecosystem and propose several feasible countermeasures including the online account exposed information protection mechanism and the built-in authentication to fortify the security of Online Account Ecosystem.
Shibayama, Rina, Kikuchi, Hiroaki.
2021.
Vulnerability Exploiting SMS Push Notifications. 2021 16th Asia Joint Conference on Information Security (AsiaJCIS). :23—30.
SMS (Short Message Service)-based authentication is widely used as a simple and secure multi-factor authentication, where OTP (One Time Password) is sent to user’s mobile phone via SMS. However, SMS authentication is vulnerable to Password Reset Man in the Middle Attack (PRMitM). In this attack, the attacker makes a victim perform password reset OTP for sign-up verification OTP. If the victim enters OTP to a malicious man-in-the-middle site, the attacker can overtake the victim’s account.We find new smartphone useful functions may increase PR-MitM attack risks. SMS push notification informs us an arrival of message by showing only beginning of the message. Hence, those who received SMS OTP do not notice the cautionary notes and the name of the sender that are supposed to show below the code, which may lead to be compromised. Auto-fill function, which allow us to input authentication code with one touch, is also vulnerable for the same reason.In this study, we conduct a user study to investigate the effect of new smartphone functions incurring PRMitM attack.
Hassan, Md Arif, Shukur, Zarina.
2021.
A Secure Multi Factor User Authentication Framework for Electronic Payment System. 2021 3rd International Cyber Resilience Conference (CRC). :1—6.
In the growth of financial industries, the electronic payments system is a newest topic, which is to be replaced in the near future by electronic or online transaction. With the advancement of the technology, there is a strong need to build and enforce safe authentication schemes to protect user sensitive information against security threats. Protection is becoming increasingly important for companies today, and so the need for authentication is more essential than before. In single-factor authentication, there are many security problems such as password schemes. Additionally, invaders will try various ways of stealing passwords including, dictionary attacks, brute force attack, password divination, shoulder surfing, etc. This paper provides a multi-authentication system for electronic payments to address the problem. The proposed technique here combines password, biometric and OTP verification for a more reliable user authentication using a multi-factor authentication. The proposed system has three phases, namely: registration phase, an authentication phase, and transaction phase. Our proposed approach has been found to boost security efficacy for various forms of assault and authentication layers dependent on password based attacks.
Pichetjamroen, Sasakorn, Rattanalerdnusorn, Ekkachan, Vorakulpipat, Chalee, Pichetjamroen, Achara.
2021.
Multi-Factor based Face Validation Attendance System with Contactless Design in Training Event. 2021 18th International Conference on Electrical Engineering/Electronics, Computer, Telecommunications and Information Technology (ECTI-CON). :637—640.
Various methods for face validation-based authentication systems have been applied in a number of access control applications. However, using only one biometric factor such as facial data may limit accuracy and use, and is not practical in a real environment. This paper presents the implementation of a face time attendance system with an additional factor, a QR code to improve accuracy. This two- factor authentication system was developed in the form of a kiosk with a contactless process, which emerged due to the COVID-19 pandemic. The experiment was conducted at a well- known training event in Thailand. The proposed two-factor system was evaluated in terms of accuracy and satisfaction. Additionally, it was compared to a traditional single-factor system using only face recognition. The results confirm that the proposed two-factor scheme is more effective and did not incorrectly identify any users.
Pathak, Adwait, Patil, Tejas, Pawar, Shubham, Raut, Piyush, Khairnar, Smita.
2021.
Secure Authentication using Zero Knowledge Proof. 2021 Asian Conference on Innovation in Technology (ASIANCON). :1—8.
Zero- Knowledge Proof is a cryptographic protocol exercised to render privacy and data security by securing the identity of users and using services anonymously. It finds numerous applications; authentication is one of them. A Zero-Knowledge Proof-based authentication system is discussed in this paper. Advanced Encryption Standard (AES) and Secure Remote Password (SRP) protocol have been used to design and build the ZKP based authentication system. SRP is a broadly used Password Authenticated Key Exchange (PAKE) protocol. The proposed method overcomes several drawbacks of traditional and commonly used authentication systems such as a simple username and plaintext password-based system, multi-factor authentication system and others.
ALSaleem, Bandar Omar, Alshoshan, Abdullah I..
2021.
Multi-Factor Authentication to Systems Login. 2021 National Computing Colleges Conference (NCCC). :1–4,.
Multi-Factor Authentication is an electronic authentication method in which a computer user is granted access to an application or a website only after successfully presenting two or more factors, or pieces of evidence. It is the first step to protect systems against intruders since the traditional log-in methods (username and password) are not completely protected from hackers, since they can guess them easily using tools. Current Systems use additional methods to increase security, such as using two-factor authentication based on a one-time password via mobile or email, or authentication based on biometrics (fingerprint, eye iris or retina, and face recognition) or via token devices. However, these methods require additional hardware equipment with high cost at the level of small and medium companies. This paper proposes a multi-factor authentication system that combines ease of use and low-cost factors. The system does not need any special settings or infrastructure. It relies on graphical passwords, so the user, in registration phase, chooses three images and memorizes them. In the login phase, the user needs only to choose the correct images that he considered during the registration process in a specific order. The proposed system overcomes many different security threats, such as key-loggers, screen capture attack or shoulder surfing. The proposed method was applied to 170 participants, 75% of them are males and 25% are females, classified according to their age, education level, web experience. One-third of them did not have sufficient knowledge about various security threats.