IJERD (www.ijerd.com) International Journal of Engineering Research and Development IJERD : hard copy of journal, Call for Papers 2012, publishing of journal, journal of science and technology, research paper publishing, where to publish research paper,
1 like769 views
This document summarizes a research paper about developing an authentication system for banking using implicit passwords. The proposed system uses randomly generated security questions to authenticate users, with answers provided as clickable points on an image instead of text. If the user correctly identifies the points associated with the security question, they are authenticated. The system aims to improve security over traditional username/password schemes while maintaining usability on mobile devices. Key modules described include user profile creation, generation of random authentication questions, comparing login profiles to verify identity, and allowing transactions and balance checks via SMS.
![Authentication System for Banking Using Implicit Password
Proposed System
In this paper, we specially focus only on “what you know” types of authentication. We propose our Implicit Password
Authentication System for banking. IPAS is similar to the Pass Point scheme with some finer differences. In every “what
you know type” authentication scheme we are aware of, the server requests the user to reproduce the fact given to the server
at the time of registration. This is also true in graphical passwords such as Pass Point. In IPAS for banking, we consider the
piece of information i.e. password as a known to the server at the time of registration and at the time of authentication, the
user give this information in an implicit form that can be understood only by the server.
Advantages
The strength of IPAS depends greatly on how effectively the authentication information is embedded implicitly in an image
and it should be easy to decrypt for a legitimate user and highly fuzzy for a non-legitimate user. The authentication
information is conveyed implicitly, that’s why No password information is exchanged between the client and the server in
IPAS.
V. CONCLUSION
In this paper, we have proposed a new Implicit Password Authentication System for Banking, where the
information of authentication is presented to the user implicitly. If the user “clicks” the same grid-of-interest compared with
the server, the user is implicitly authenticated. No password information is exchanged between the client and the server in
IPAS. Since the authentication information is conveyed implicitly, IPAS can tolerate shoulder-surfing and screen dump
attack, which none of the existing schemes can tolerate. The strength of IPAS lies in creating a good authentication space
with a sufficiently large collection of images to avoid short repeating cycles. Compared to other methods reviewed in our
paper, IPAS may require careful selection of images and “click” regions and human-interaction. IPAS may also need user
training. Once this is done, IPAS can be more robust. In our subsequent papers, we present various steps involved in creating
a robust authentication space for every question.
REFERENCES
Good Teachers are worth more than thousand books, we have them in Our Department
References Made From:
[1]. Sabzevar, A.P. & Stavrou, A., 2008,” Universal Multi-Factor Authentication Using Graphical Passwords”, IEEE
International Conference on Signal Image Technology and Internet Based Systems (SITIS).
[2]. Haichang, G., L. Xiyang, et al. (2009). “Design and Analysis of a Graphical Password Scheme”, Innovative
Computing, Information and Control (ICICIC), 2009 Fourth International Conference on Graphical Passwords.
[3]. Pierce JD, Jason G. Wells, Matthew J. Warren, & David R. Mackay.(2003). “A Conceptual Model for Graphical
Authentication”, 1st Australian Information security Management Conference, 24 Sept.Perth, Western Australia,
paper 16.
[4]. Xiaoyuan, S., Z. Ying, et al. (2005). “Graphical passwords: a survey”, Computer Security Applications
Conference, 21st Annual.
[5]. Wells, Jason; Hutchinson, Damien; and Pierce, Justin, "Enhanced Security for Preventing Man-in-the-Middle
Attacks in Authentication.
[6]. Takada, T. and H. Koike (2003). “Awase-E: Image-Based Authentication for Mobile Phones Using User’s
Favorite Images”, Human-Computer Interaction with Mobile Devices and Services, Springer Berlin / Heidelberg.
2795: 347-351.
[7]. Dirik, A. E., N. Memon, et al. (2007). “Modeling user choice in the Pass Points graphical password scheme”,
Proceedings of the 3rd symposium on Usable privacy and security. Pittsburgh, Pennsylvania, ACM.
[8]. Wei-Chi, K. and T. Maw-Jinn (2005). “A Remote User Authentication Scheme Using Strong Graphical
Passwords”, Local Computer Networks, 2005. 30th Anniversary.
[9]. Lashkari, A. H., F. Towhidi, et al. (2009). “A Complete Comparison on Pure and Cued Recall-Based Graphical
User Authentication Algorithms”, Computer and Electrical Engineering, 2009. ICCEE '09. Second International
Conference.
[10]. Renaud, K. (2009)."On user involvement in production of images used in visual authentication." J. Vis. Lang.
Comput. 20(1): 1-15.
Sites Referred:
[1]. http://www.sourcefordgde.com
[2]. http://www.networkcomputing.com/
[3]. http://www.ieee.org
[4]. http://www.almaden.ibm.com/software/quest/Resources/
[5]. http://www.computer.org/publications/dlib
[6]. http://www.ceur-ws.org/Vol-90/
[7]. http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
OPS Object Oriented Programming Concepts
TCP/IP Transmission Control Protocol/Internet Protocol
CLR Common Language Runtime
CLS Common Language Specification
61](https://image.slidesharecdn.com/i03015861-120830061536-phpapp02/85/IJERD-www-ijerd-com-International-Journal-of-Engineering-Research-and-Development-IJERD-hard-copy-of-journal-Call-for-Papers-2012-publishing-of-journal-journal-of-science-and-technology-research-paper-publishing-where-to-publish-research-paper-4-320.jpg)
IJERD (www.ijerd.com) International Journal of Engineering Research and Development IJERD : hard copy of journal, Call for Papers 2012, publishing of journal, journal of science and technology, research paper publishing, where to publish research paper,
- 1. International Journal of Engineering Research and Development e-ISSN: 2278-067X, p-ISSN: 2278-800X, www.ijerd.com Volume 3, Issue 1 (August 2012), PP. 58-61 Authentication System for Banking Using Implicit Password Ms. Prajakta.D.Kulkarni1, Mr. C.S.Satsangi2, Mr. Santhosh Easo3 1 Information technology,Medicaps institute of Technology and Management,Indore 2 HOD(CSE),Medicaps institute of Technology and Management,Indore 3 A.P(CSE),Medicaps institute of Technology and Management,Indore Abstract––In this paper, we introduce a Authentication Scheme for banking by using implicit password. As we know graphical password scheme suffered from shoulder-surfing and screen dump attacks. As we know for banking security is is the first line of defence against compromising confidentiality and integrity. Simply the username and password schemes are easy to implement. But that traditional scheme have been subjected to several attacks. Token and biometric based authentication systems were introduced for alternative to traditional scheme. However, they have not improved substantially to justify the investment. Keywords––security, usability, implicit authentication, behavior modeling, Mobile Banking. I. INTRODUCTION A key area in security research is authentication, the determination of whether a user should be allowed access to a given system or resource The important aspect of authentication is confidentiality and integrity. Also, for protecting any resource adequate authentication is the first line of defense. I Also, for protection of resource we use authentication as a service. It is important that the same authentication technique should not be used in every situation. A complication is that users may have many passwords for Bank, network and web sites. The large number of passwords increases interference and it is lead to forgetting or confusing passwords. The acceptability of any authentication scheme greatly depends on its robustness against attacks as well as its resource requirement both at the client and at the server end. It means authentication scheme require processing at client and sever end. Due to the proliferation of mobile and hand-held devices the resource requirement has become a major factor. The implicit passwords main application is the protection of critical resources and systems. Nowadays users can access any information including banking and corporate database with the use of mobile phones. In this paper, we target the mobile banking domain and propose a new and intelligent authentication scheme that is implicit password. However, our proposal can also be used in other scenario where confidentiality and integrity are the major security requirements. We propose our Authentication System for banking using Implicit Password. in which the scheme allows any image to be used and it does not need artificial predefined click regions with well-marked boundaries – a password can be any arbitrarily chosen sequence of points in the image with some finer differences. In IPAS, the server has the a piece of information i.e. password at the time of authentication and at the time of registration, the user give this information to the server in an implicit form. implicit password is particularly suited for mobile phones and portable computers, although it may be implemented for any computer. II. IMPLEMENTATION Implementation is the stage of the project when the theoretical concept is turned out into a working system. Thus implementation is considered as the most critical stage in achieving a successful new system and in giving the user, confidence that the new system will work and be effective. The implementation stage involves careful planning, analysis of the existing system and it’s constraints on implementation, designing of methods to achieve changeover and evaluation of changeover methods. Main Modules:- MODULES: Create the profile for user: A user profile is a collection of personal data associated to a specific user .A profile can be used to store the description of the characteristics of person. This information can be exploited by systems taking into account the persons' characteristics and preferences. At the time of registration every user selects answer for security questions and provides their individual answer. For each question, the system then either creates an authentication space .After the authentication space is created, the system is ready for authenticating a user. Generation of Random Question: For each question, the server may show a random scenario from the authentication space that represents the correct answer. The chosen scenario have one or more “clickable” points that represent the answer to the question provided by the particular user. Compare login Profile / User Profile 58
- 2. Authentication System for Banking Using Implicit Password The applications need to gather, and exploit, some information about individuals in order to provide password. This area is broadly called user profiling As long as the user enter User name and answer as location points for the random security question will decide that the user is authenticated or not. The information for authentication is presented to the user in the implicit form that can be understood and decoded only by the legitimate end user. Short Message Service: SMS or Short Message Service allows Mobile or Cellular phones to send and receive Text Messages. This can be graphical and more recently alphanumeric. A sent SMS message is stored at an SMS Center (SMSC) until the receiver’s phone receives it. With the help of sender’s number which is included in the message itself, the receiver can identify the sender. The User will Check the Mobile Inbox if any alert messages received or not. Transactions on Mobile: Transaction on mobile is used to transform money between two peoples. These two peoples must be registered with implicit password authentication system in a Bank. This transaction starts with SMS. If USER1 wants to transfer money to USER2, both of them must have mobile phone. User must login with IPAS. User1 simply types SMS to particularly bank with Amount, his 4 digits PIN and Account No. Bank server processes the request and Amount is transferred to designation account. Confirmation SMS is sends to particular USER. 59
- 3. Authentication System for Banking Using Implicit Password Balance Enquiry / Account Management: User can also deposit the amount to another user; Admin can manage the account details of the user’s, If any update in the balance amount as both users can see in mobile. User sends money to another user, that messages can able to view the particular user and know the balance details. It refreshes the inbox details automatically. Input Design The input design is the link between the user and the information system. It comprises procedures for data preparation and the developing specification and those steps are necessary to put transaction data in to a usable form for processing can be achieved by inspecting the computer to read data from a written or printed document or it can occur by having people keying the data directly into the system. The design of input system focuses on controlling the errors ,controlling the amount of input required, avoiding delay, avoiding extra steps and keeping the process simple. The input is designed in such a way so that it provides ease of use with retaining the privacy and security. Input Design considered the following things: What data and how much data should be given as input? How the data should be coded or arranged? The dialog to guide the operating personnel in providing input. Methods for preparing input validations and steps to follow when error occur. III. OBJECTIVES 1. Input Design is the process of transferring a user-oriented description of the input into a computer-based system. This design is important to avoid errors in the data input process and show the correct direction to the management for getting correct information from the computerized system. 2. It is achieved by creating user-friendly screens for the data entry to handle large volume of data. The aim of designing input is to make data entry easier and to be free from errors. The data entry screen is designed in such a way that all the data manipulates can be performed. It also provides record viewing facilities. IV. SYSTEM ANALYSIS Existing System The example of “what you know type” is The traditional username/password or PIN based authentication scheme. The biometric system was introduce, as an alternative to the traditional password based scheme,. This relies upon unique features unchanged during the life time of a human, such as finger prints, iris etc. Token based systems rely on the use of a physical device such as smartcards or electronic-key for authentication purpose. Graphical-based password techniques , supported partially by the fact that humans can remember images better than text, which have been proposed as a potential alternative to text-based techniques. In general, the graphical password techniques can be classified into two categories: recall based and recognition-based graphical techniques. In recall-based systems, the user is asked to reproduce something that he/she created or selected earlier during the registration phase. Recall based schemes can be broadly classified into two groups, pure recall-based technique and cued recall-based technique. In recognition-based systems, a group of images are displayed to the user and an accepted authentication requires a correct image being clicked or touched in a particular order. Disadvantages Alphanumeric passwords have problems such as being hard to remember, dictionary attack, key-logger, vulnerable to guessing, shoulder-surfing and social engineering. The major problem of biometric as an authentication scheme is the high cost of additional devices needed for identification process. Although a recognition-based graphical password seems to be easy to remember, which increases the usability, it is not completely secure. It needs several rounds of image recognition for authentication to provide a reasonably large password space, which is tedious. 60
- 4. Authentication System for Banking Using Implicit Password Proposed System In this paper, we specially focus only on “what you know” types of authentication. We propose our Implicit Password Authentication System for banking. IPAS is similar to the Pass Point scheme with some finer differences. In every “what you know type” authentication scheme we are aware of, the server requests the user to reproduce the fact given to the server at the time of registration. This is also true in graphical passwords such as Pass Point. In IPAS for banking, we consider the piece of information i.e. password as a known to the server at the time of registration and at the time of authentication, the user give this information in an implicit form that can be understood only by the server. Advantages The strength of IPAS depends greatly on how effectively the authentication information is embedded implicitly in an image and it should be easy to decrypt for a legitimate user and highly fuzzy for a non-legitimate user. The authentication information is conveyed implicitly, that’s why No password information is exchanged between the client and the server in IPAS. V. CONCLUSION In this paper, we have proposed a new Implicit Password Authentication System for Banking, where the information of authentication is presented to the user implicitly. If the user “clicks” the same grid-of-interest compared with the server, the user is implicitly authenticated. No password information is exchanged between the client and the server in IPAS. Since the authentication information is conveyed implicitly, IPAS can tolerate shoulder-surfing and screen dump attack, which none of the existing schemes can tolerate. The strength of IPAS lies in creating a good authentication space with a sufficiently large collection of images to avoid short repeating cycles. Compared to other methods reviewed in our paper, IPAS may require careful selection of images and “click” regions and human-interaction. IPAS may also need user training. Once this is done, IPAS can be more robust. In our subsequent papers, we present various steps involved in creating a robust authentication space for every question. REFERENCES Good Teachers are worth more than thousand books, we have them in Our Department References Made From: [1]. Sabzevar, A.P. & Stavrou, A., 2008,” Universal Multi-Factor Authentication Using Graphical Passwords”, IEEE International Conference on Signal Image Technology and Internet Based Systems (SITIS). [2]. Haichang, G., L. Xiyang, et al. (2009). “Design and Analysis of a Graphical Password Scheme”, Innovative Computing, Information and Control (ICICIC), 2009 Fourth International Conference on Graphical Passwords. [3]. Pierce JD, Jason G. Wells, Matthew J. Warren, & David R. Mackay.(2003). “A Conceptual Model for Graphical Authentication”, 1st Australian Information security Management Conference, 24 Sept.Perth, Western Australia, paper 16. [4]. Xiaoyuan, S., Z. Ying, et al. (2005). “Graphical passwords: a survey”, Computer Security Applications Conference, 21st Annual. [5]. Wells, Jason; Hutchinson, Damien; and Pierce, Justin, "Enhanced Security for Preventing Man-in-the-Middle Attacks in Authentication. [6]. Takada, T. and H. Koike (2003). “Awase-E: Image-Based Authentication for Mobile Phones Using User’s Favorite Images”, Human-Computer Interaction with Mobile Devices and Services, Springer Berlin / Heidelberg. 2795: 347-351. [7]. Dirik, A. E., N. Memon, et al. (2007). “Modeling user choice in the Pass Points graphical password scheme”, Proceedings of the 3rd symposium on Usable privacy and security. Pittsburgh, Pennsylvania, ACM. [8]. Wei-Chi, K. and T. Maw-Jinn (2005). “A Remote User Authentication Scheme Using Strong Graphical Passwords”, Local Computer Networks, 2005. 30th Anniversary. [9]. Lashkari, A. H., F. Towhidi, et al. (2009). “A Complete Comparison on Pure and Cued Recall-Based Graphical User Authentication Algorithms”, Computer and Electrical Engineering, 2009. ICCEE '09. Second International Conference. [10]. Renaud, K. (2009)."On user involvement in production of images used in visual authentication." J. Vis. Lang. Comput. 20(1): 1-15. Sites Referred: [1]. http://www.sourcefordgde.com [2]. http://www.networkcomputing.com/ [3]. http://www.ieee.org [4]. http://www.almaden.ibm.com/software/quest/Resources/ [5]. http://www.computer.org/publications/dlib [6]. http://www.ceur-ws.org/Vol-90/ [7]. http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome OPS Object Oriented Programming Concepts TCP/IP Transmission Control Protocol/Internet Protocol CLR Common Language Runtime CLS Common Language Specification 61