Abstract:Credential theft and remote attacks are the most serious threats to user authentication mechanisms. The crux of these problems is that we cannot control such behaviors. However, if a password does not contain user secrets, stealing it is useless. If unauthorized inputs are invalidated, remote attacks can be disabled. Thus, credential secrets and account input fields can be controlled. Rather than encrypting passwords, we design a dual-password login-authentication mechanism, where a user-selected secret-free login password is converted into an untypable authentication password. Subsequently, the authenticatable functionality of the login password and the typable functionality of the authentication password can be disabled or invalidated to prevent credential theft and remote attacks. Thus, the usability-security tradeoff and password reuse issues are resolved; local authentication password storage is no longer necessary. More importantly, the password converter acts as an open hashing algorithm, meaning that its intermediate elements can be used to define a truly unique identity for the login process to implement a novel dual-identity authentication scheme. In particular, the system-managed elements are concealed, inaccessible, and independent of any personal information and therefore can be used to define a perfect unforgeable process identifier to identify unauthorized inputs.

The use of USB key secure logon on a new system logon mechanism

Solution to VPN and Authentication System

Design and Implementation of Multi-Role Logon Authentication Based on Tokencard System

KinWrite: Handwriting-Based Authentication Using Kinect.

Systematic Solutions to Login and Authentication Security Problems: A Dual-Password Login-Authentication Mechanism

Inter-domain authentication scheme for Pervasive Computing Environments

The Study of Password Security of Access 2010

KeyAuth: Bringing Public-key Authentication to the Masses

Advances in Password Security

Study on the Model and Algorithm of Internet Trusted Identity Authentication System.

On the Usability of Two-Factor Authentication.

Combating Password Vulnerability with Keystroke Dynamics Featured by WiFi Sensing

AN EFFICIENT AND SECURE DYNAMIC PASSWORD AUTHENTICATION SCHEME

A DYNAMIC PASSWORD AUTHENTICATION FOR REMOTE USERS IN INSECURE CHANNEL

New efficient user identification and key distribution scheme providing enhanced security

Improving password security and memorability to protect personal and organizational information

ON PASSWORD MANAGEMENT TECHNIQUE BASED ON SMART PHONE WITH BLUETOOTH

A Novel Multifactor Authentication System Ensuring Usability and Security

On the Security of Some Password Authentication Protocols.

Enhanced Recognition of USB Token

Research on Side Channel Attack for USB Key