Privacy for Key Exchange and Authentication Process using Grid

IJSRD - International Journal for Scientific Research & Development| Vol. 3, Issue 09, 2015 | ISSN (online): 2321-0613

Privacy for Key Exchange and Authentication Process using Grid Babar Khalid1 Shoaib Farooqui2 Rajesh Nair3 Priyanka Kedar4 1,2,3,4 Department of Computer Engineering 1,2,3,4 DPCOE College of Engineering, Pune Maharashtra Abstract— The twenty first century is occupied with many new devices and modernizations. At first glance, our society may seem to be somewhat progressive. However, looks can be deceiving .In reality we are only at the forefront at what is in store for the near future. With the passing of every day, we may not know it, but our lives are becoming more and more digitized. A completely paperless society is on the horizon. As the digital world guides itself in it will become important for one is protect person‟s identity and from them those prowling in the distance. In this paper, we proposed a safe zone for users which provide security to user‟s confidential data. In this proposed system we provide secure authentication and security to data transmission over internet.

Key words: Authentication, Key Exchange I. INTRODUCTION We are living in 21st century, a digital world. The mail problem in digital world is how to protect confidential information. The 1st thing you want for security is authentication. But what if your data is stolen while data is transmitting over internet. So then you have to secure the data while data is transmitting over internet.

The most common method used for authentication is textual password. The weaknesses of this method like eves dropping, social engineering and shoulder surfing are well known. Illogical and lengthy passwords can make the system secure. But the main problem is it`s difficult to remember. Studies have shown that users have an affinity to pick short passwords that are easy to remind. Unfortunately, these passwords can be guessed easily. [1] The another procedures are graphical passwords and biometrics. But these two systems have their own drawbacks. Biometrics, such as finger prints, iris scan or facial recognition have been introduced but not yet widely agreed. [2]The major drawback of this methodology is that such systems can be expensive and the identification process can be slow. There are many graphical password schemes that are planned in the last period. But most of them suffer from shoulder surfing which is becoming quite a big problem. [3]There are graphical passwords systems that have been proposed which are unaffected to shoulder surfing but they have their own drawbacks like usability problems or taking more time for user to login or having tolerance levels.

But according to our study the main problem is the attackers try to acquire access to the password which the user types. But what if the user does not know the password which will allow him to access? And what if user do not enter the actual password? And every time the password entered is different. Sounds a bit strange but this is what our system does.

In this paper we proposed two techniques to protect user‟s confidential information. One is GRID based authentication scheme with OTP (one time password) which provide secure authentication to users.

And second is for security of data over internet key exchange is the core cryptographic mechanism for ensuring network security. For key exchange over the internet, both security and privacy are desired [1]. It enhances the security of the web based system and makes it difficult for the attackers to decipher the keyword of the user. This technique we can call it as cryptography. In this technique we use encryption and decryption to enhance security. And here we use DHKE as transmission security [1].

II. EXISTING SYSTEMS A. Random Images used by Dhamija and Perrig Dhamija and Perrig proposed a graphical authentication system where the user has to identify the predefined images to prove user‟s authenticity. In this system, the user selects the number of images for purpose of selecting password. In the login phase the user has to identify the preselected images for authentication from a set of images as shown in figure 1 [10].but this system is vulnerable to shoulder surfing.

Fig. 1: graphical authentication system B. DAS Technique by Jermyn

Fig. 2: DAS Technique by Jermyn

All rights reserved by www.ijsrd.com

511

Privacy for Key Exchange and Authentication Process using Grid (IJSRD/Vol. 3/Issue 09/2015/124)

Jermyn Proposed a new technique called “Draw- a-Secret” (DAS) as shown in figure 2.2 where the user is required to redraw the pre-defined picture on a 2D grid. If the drawing touches the same grids in the same sequence, then the user is authenticated [12]. This authentication scheme is vulnerable to shoulder surfing.

C. Signature technique by Syukri Syukri developed a technique where authentication is done by drawing user signature using a mouse as shown in figure 2.3[11]. This method included two stages registration and verification. At the time of registration phase the user draws his signature using a mouse, after that the system extracts the signature area. In the verification phase it takes the user signature as input and does the normalization and then extracts the factors of the signature. The disadvantage of this technique is the falsification of signatures. Drawing using mouse is not familiar to many users, it is difficult to draw the signature in the same edges at the time of registration. In this technique the user must click on the approximate areas.

Fig. 3: Signature technique by Syukri D. Haichang’s Shoulder-Surfing Technique Haichang proposed a new shoulder-surfing resistant system as shown in figure 2.4 where the user is required to draw a curve across their password images arranged rather than clicking on them directly. This graphical scheme combines DAS and Story schemes to provide genuineness to the user [14]. But this system is also vulnerable to shoulder surfing.

Fig. 4: Haichang‟s Shoulder-Surfing Technique E. Pair-based authentication scheme by S. Jungari S. Jungari offered a pair based authentication system in which User has to enter the password depending upon the

secret pass. The session password contains of alphabets, digits and special signs. The first letter in the pair is used to select the row and the second letter is used to select the column. The intersection letter is part of the session password. This is repetitive for all pairs of secret pass [8].

But this system is vulnerable to shoulder surfing.

Fig. 5: Pair-based authentication scheme by S. Jungari III. OUR CONTRIBUTION Here we proposed pair based authentication system with OTP (one time password). Proposed authentication system is similar to pair based authentication system but in proposed system we eliminated disadvantages of pair based system.

Pair based system has disadvantages like password must contain even number of digits. We provide also odd number of digits as a password. And we included OTP which is resistant to shoulder surfing. OTP must be included with user defined password.

In proposed authentication system user have to enter predefined password as well as OTP at the time of login.

The key exchange is among the core cryptographic mechanism for ensuring network security. For key exchange over the internet we security and privacy [1]. The internet key exchange protocol to ensure internet security, which specify key exchange mechanism used to establish shared keys for use in internet protocol security standard [3].

A. Deniable Internet Key-Exchange [1]Andrew chi-chih Yao and Yunlei Zhao proposed family of privacy-preserving authenticated DHKE [1] protocols named deniable Internet key-exchange (DIKE), both in the traditional PKI setting and in the identity-based setting. The recently established DIKE protocols are of conceptual simplicity and real-world efficiency. They provide useful privacy protection to both protocol participants, and increase novelty and new value to the IKE standard [3] [4] and the SIGMA protocol [5].

B. Internet Key-Exchange (IKE) One of the basic secure communication mechanism is the key establishment protocol that is known as Internet Key Exchange (IKE). It is the typical of Internet protocol Security (IPSec) offered by the IETF in 1998 [3, 4]. But, people have many blames for this protocol, mainly for its complexity [6]. The IKE and IPSec used to deliver security amenities and privacy for communication protocols. The standard of IKE has gone through two generations. The first generation IKEv1 [3] uses public-key encryption as the authentication mechanism. The second generation IKEv2 [1] uses signatures as the certification mechanism, with the SIGMA protocol [5] as the basis.

All rights reserved by www.ijsrd.com

512

Privacy for Key Exchange and Authentication Process using Grid (IJSRD/Vol. 3/Issue 09/2015/124)

C. Internet Protocol Security (IPSec) IPSec is the Internet Engineering Task Force (IETF) suggested standard for “layer 3 real-time Communication securities[6].” In a real-time security system, an originator, called Alice, initiates communication with a responder system, called Bob. They validate to each other by proving knowledge of some secret, and then establish a secret key for the protection of the remainder of the session. We use the term “real-time” to differentiate it from a system such as secure e-mail, in which Alice can create an encrypted, signed message for Bob without interacting with Bob [4].

By operating below layer 4, IPSec keep away the problem of an active attacker fatally breaking apart a session by injecting a single unpredictable packet. Solutions like SSL, which function above TCP, are vulnerable to this threat. Although IPSec can be deployed without modifications to applications, the power of IPSec cannot be broken until the API is changed to inform applications of the endpoint identifier, and applications are modified to use the information in the modified API. IV. PROPOSED SYSTEM The main goal of proposed system is to enhance the security over transmission of data and authentication process in web applications. It enhances the security of the web based system and makes it difficult for the attackers to decipher the keyword of the user.

Proposed system provide a safe zone to users who willing to transmit their confidential information over internet. Here we are using grid based authentication with OTP as a front end security. Here user register his/her user name and password at registration time. And at the login time user have to submit user name and password. Here user submit password using GRID. Password contains user defined password + OTP (received by message).

For example, user selected password is “user123” and OTP received is “475”, then user have submit password “user123475” in GRID. And at the back-end we provide a security to user‟s confidential data transmitting over internet. Here we developed a new encryption and decryption technique for ensuring security to data from attacker to decipher.

Fig. 6: Proposed system V. CONCLUSION In this paper, Grid Based Authentication system provides the solution to the problems like “Shoulder Surfing”, “Keystroke logging”, “Duplicate login pages”.

It enhances the security of the web based system and makes it difficult for the attackers to decipher the keyword of the user. It ensures security to data transmission and makes difficult for the intruders to decode the transmitted data.

REFERENCES [1] A. C. Yao and Y. Zhao, “privacy-preserving Authenticated Key-Exchange over Internet” January 2014.

[2] S. Al-Riyami and K. Paterson, “Certificate less publickey cryptography,” in Proc. Asiacrypt 2003, pp. 452– 473.

[3] D. Harkins and D. Carreal, “The Internet key-exchange (IKE),” IETF (The Internet Engineering Task Force), New York, NY, USA, Tech. Rep. 2409, Nov. 1998.

[4] C. Kaufman, “Internet key exchange (IKEv2) protocol,” The Internet Engineering Task Force, London, U.K., Tech. Rep. 4306, Dec. 2005.

[5] H. Krawczyk, “SIGMA: The „SIGn-and-MAc‟ approach to authenticated Diffie-Hellman and its use in the IKE-protocols,” in Proc. CRYPTO 2003, pp. 400– 425.

[6] D. Boneh and M. Franklin, “Identity-based encryption from the weil pairing,” in Proc. CRYPTO 2001, pp.

213–229.

[7] A. C. Yao and Y. Zhao, “Deniable Internet keyexchange,” IACR (The International Association for Cryptologic Research), San Diego, CA,USA, Tech.

Rep. 2011/035, Jan. 2011.

[8] Suwarna jungari, Vrushali Bhujbal, Shital Sonawane, prof. Shital Salve: “authentication session password scheme using texts and colors”, 2014.

[9] VAISHNAVI PANCHAL, CHANDAN P. PATIL a user study using “Authentication schemes for session password” March 2013.

[10] R. Dhamija, and A. Perrig. “Déjà Vu: A User Study Using Images for Authentication”. In 9th USENIX Security Symposium, 2000.

[11] A. F. Syukri, E. Okamoto, and M. Mambo, "A User Identification System Using Signature Written with Mouse," in Third Australasian Conference on Information Security and Privacy (ACISP): SpringerVerlag Lecture Notes in Computer Science (1438), 1998, pp. 403-441.

[12] Jermyn, I., Mayer A., Monrose, F., Reiter, M., and Rubin. “The design and analysis of graphical passwords” in Proceedings of USENIX Security Symposium, August 1999.

[13] Real User Corporation: Pass faces, www.passfaces.com.

[14] Haichang Gao, Zhongjie Ren, Xiuling Chang, Xiyang Liu UweAickelin, “A New Graphical Password Scheme Resistant to Shoulder-Surfing [15] M SREELATHA, M SHASHI, M ANIRUDH “Authentication Schemes for Session Passwords using Colour and Images” May 2011.

[16] M. Bellare and P. Rogaway, “Entity authentication and key distribution,” in Proc. CRYPTO 1993, pp. 273–289.

All rights reserved by www.ijsrd.com

513