An Innovative Multifactor Server Farm Established Key Exchange Tactics with Ultimate Te

IJSTE - International Journal of Science Technology & Engineering | Volume 2 | Issue 10 | April 2016 ISSN (online): 2349-784X

An Innovative Multifactor Server Farm Established Key Exchange Tactics with Ultimate Technology Ajosh Varughese Department of Computer Science & Engineering Christian College of Engineering & Technology Oddanchatram, Dindigul, Tamilnadu-624619, India

Benson. B. Ukken Department of Computer Science & Engineering Christian College of Engineering & Technology Oddanchatram, Dindigul, Tamilnadu-624619, India

Roopesh. R. Nair Department of Computer Science & Engineering Christian College of Engineering & Technology Oddanchatram, Dindigul, Tamilnadu-624619, India

Abhilash. S Department of Computer Science & Engineering Christian College of Engineering & Technology Oddanchatram, Dindigul, Tamilnadu-624619, India

D. Pradeep Assistant Professor Department of Computer Science & Engineering Christian College of Engineering & Technology, Oddanchatram, Dindigul, Tamilnadu-624619, India

Abstract Typically, user authentication based on something that a user knows (typically a PIN, a password) or something that a user has (a key, a token, a magnetic or smart card, a badge, a passport etc.). Unfortunately, these traditional methods of the user authentication do not authenticate the user as such. Traditional methods are based on properties that can be forgotten (password), disclosed, lost or stolen (smart card)[9]. Nowadays, password authentication is the most common authentication system. A strong and efficient server farm authentication method using biometrics-based smart card and elliptic curve cryptography (ECC)[10][20]. In this paper, a new multi-factor authenticated key exchange method, which combines with biometrics, password and the picture puzzle is proposed[4]. Compared with the previous methods, this method has higher security in remote authentication and preserves privacy of biometrics, and most of the previous methods rely on the smart card to verify biometrics[3][15][16]. We then propose a new secure server farm authentication protocol using biometrics and ECC with more security functionalities. The advantage of these approaches is that the user’s biometrics is not shared with the remote server, which can resist insider’s attack and preserve the privacy of the biometrics. To achieve multifactor certification, a new function called one-way function with distance-keeping, which is used to preserve privacy of user’s biometrics, is popularised. It is proven secure under the random oracle and is suitable to the environment which lacked communication resource and needed higher security.

Keywords: Authentication, security, ECC, image recolonization biometrics, Picture Puzzle ________________________________________________________________________________________________________ I.

INTRODUCTION

Authentication is the process of actually confirming that identity. It might involve confirming the identity of a person by validating their identity documents, verifying the validity of a Website with a digital certificate, ensuring that a product is what its packaging and labeling claim to be[13]. In other words, authentication often involves verifying the validity of at least one form of identification[3]. Authentication has relevance to multiple fields.[29] In art and antiques a common problem is verifying that a given artifact was produced by a certain person or was produced in a certain place or period of history. In computer science, verifying a person's identity is often required to secure access to confidential data or systems[9].

Need The single factor and two-factor authentication, which uses one of three factors or combines two of the three factors have some drawbacks in security.[21] The authentication method, which combines these multi factors, has become a new direction in authentication because these multi-factor authentication methods can overcome some drawbacks compared with traditional one or two-factor authentication methods.

Objective For many years peoples have used passwords to authenticate their identity. The security system first implemented on All rights reserved by www.ijste.org

130

An Innovative Multifactor Server Farm Established Key Exchange Tactics with Ultimate Technology (IJSTE/ Volume 2 / Issue 10 / 027)

computers 40 years ago was password.[22] Authorities today agree that effective authentication of a person„s identity requires a combination of at least two of the three independent means of authentication. The factors are PIN, Picture Puzzle, Biometrics (Finger Print)[12][17] along with ECC.[25]Most early authentication mechanisms were purely based on passwords, which have much vulnerability. To strength the security, two factor authentication mechanisms were used. The two factors are password and smartcard[4]; it could also fail if both the authentication factors are compromised. In this case the multi factor authentication mechanism was used to improve the security.[23] The factors are password,picture puzzle and biometrics [3].In order to provide more security we are using elliptic curve cryptography along with these factors. [25] Authorization A security guard checks a person's identity card before allowing them to enter a office. The process of authorization is distinct from that of authentication.Authorization thus presupposes authentication. A client whose authentication request is approved becomes authorized to access the accounts of that account holder, but no others.[18] However note that if a stranger tries to access someone else's account with his own identification credentials, the stranger's identification credentials will still be successfully authenticated because they are genuine and not counterfeit, however the stranger will not be successfully authorized to access the account, as the stranger's identification credentials had not been previously set to be eligible to access the account, even if valid.

Similarly when someone tries to log on a computer, they are usually first requested to identify themselves with a login name and support that with a password. Afterwards, this combination is checked against an existing login-password validity record to check if the combination is authentic. If so, the user becomes authenticated. Finally, a set of pre-defined permissions and restrictions for that particular login name is assigned to this user, which completes the final step, authorization.

II. ARCHITECTURES Existing Architecture In this Existing system analyses He-Wang‟smethod.Theirmethod is vulnerable to a known session specific temporary information attack and impersonation attack[1].This method does not provide strong user‟s anonymity. He–Wang‟smethod cannot provide the user revocation facility when the smart card is lost/stolen or user‟s authentication parameter is revealed [9].He– Wang‟smethod has some design issues, such as wrong password login and its consequences, and wrong password update during password change phase[1].

User Registration Phase

User Login Phase

Proposed Architecture In this system, a new multi-factor authenticated key exchange method which combines with biometrics, password and the picture puzzle is proposed[4].A strong and efficient server farm authentication method using biometrics-based smart card and elliptic curve cryptography (ECC).Compared with the previous methods, thismethod has higher security [11] in remote authentication and preserves privacy of biometrics.We then propose a new secure server farm authentication protocol using biometric-based smart

All rights reserved by www.ijste.org

131

An Innovative Multifactor Server Farm Established Key Exchange Tactics with Ultimate Technology (IJSTE/ Volume 2 / Issue 10 / 027)

card and ECC with more security functionalities[6]. The advantage of these approaches is that the user‟s biometrics is not shared with the remote server, which can resist insider‟s attack and preserve the privacy of the biometrics.

User Registration Phase

User Login Phase

III. METHODOLOGY Three-Factor Authentication This theme is to analyze a scientific approach for the look of secure three-factor authentication with the protection of user privacy[5]. The method for registration, initial one is science, then provide their fingerprint of the user and a cryptography key is generated to the users email id. When user login with success, user wish to convey their fingerprint[4][14] if each are match it will raise to produce the key code[5]. Using revolving credit based mostly secret authentication protocol and cryptologic rule. [11] But additionally it will contribute a secure and generic upgrade from two-factor authentication to threefactorauthentication[4]. A second authentication issue known as biometric identification will alleviate the matter and any improve the system‟s assurance.

- PIN - PICTURE PUZZLE - BIOMETRICS Fuzzy Vault Fuzzy vault is a cryptographic construction for data protection and user authentication, whose security relies on unexposed biometric characteristics and smart card[2]. The final vault V is the collection of the points which lie on Pol and the noise points which do not lie on Pol. She can recover the secret string K from vault V by providing a biometric template X_ such that the difference between X and X_ satisfies |X − X_| < _, where X − X_ = {x|x∈ X, x /∈ X_}, and _ is an integer which is the fuzziness parameter[2]. This is because that the polynomial Pol can be reconstructed if a sufficient number of points on Pol can be identified.

Fuzzy Extractor Fuzzy extractors convert biometric information into random strings that makes it doable to use cryptographical techniques for biometric security.[27] They’re accustomed encipher and attest users records, with biometric inputs as a key. Codeword is evaluated by polynomial and therefore the secret message is inserted because the coefficients of the polynomial. Fuzzy extractor could be a biometric tool to attest a user victimisation its own biometric guide as a key[27]. As fuzzy extractors modify a way to generate strong keys from life science and alternative clangorous information, it applies cryptography paradigms to biometric information which means that :

All rights reserved by www.ijste.org

132

An Innovative Multifactor Server Farm Established Key Exchange Tactics with Ultimate Technology (IJSTE/ Volume 2 / Issue 10 / 027)

-

Build very little assumptions concerning the biometric information (these information comes from form of unwanted soundurces and do not need individual to take advantage of that so it is best to assume the input is unpredictable) Apply cryptographical application techniques to the input. (for that fuzzy extractor translates biometric details into secret code, uniformly random and dependably consistent random string).

Elliptic Curve Cryptography

Elliptical curve cryptography (ECC) is a public key encryption approach based on elliptic curve theory that can be used to create faster, smaller, and more efficient cryptographic keys. ECC generates keys through the properties of the elliptic curve equation instead of the traditional method of generation as the product of very large prime numbers. The technology can be used in conjunction with most public key encryption methods, such as RSA, and Diffie-Hellman.

According to some researchers, ECC can yield a level of security with a 164-bit key that other systems require a 1024bit key to achieve. Because ECC helps to establish equivalent security with lower computing power and battery resource usage, it is becoming widely used for mobile applications. ECC was developed by Certicom ,Elliptic curve cryptography (ECC) is an approach to public-key cryptography based on the algebraic design of elliptic curves over finite fields. ECC requires smaller keys compared to non ECC cryptography to provide equivalent security.

Elliptic curves are applicable for encryption, digital signatures, pseudorandom generators and other tasks. They are also used in several integer factorization algorithms that have applications in cryptography.

IV. CONCLUSION AND FUTURE WORK In this system, we have first reviewed the He-Wang‟smethod and then shown that their method is vulnerable. To withstand these drawbacks, we have proposed a novel and efficient multi-factor server farm authentication protocol using biometric[28]based smart card and ECC. We have shown that our method is secure and provides more functionalities as compared to He-Wang “method.

In the future, we will propose new multi-factor authenticated key exchange method which can be proven secure under the standard model. It is used to fully identify the practical threats on multi-factor authentication and develop concrete multifactor authentication protocols with better performances.

REFERENCES [1]

A Secure Biometrics-Based MultiServer Authentication Protocol Using Smart Cards, IEEE transactions on information forensics and security, vol. 10, no.

9, september 2015 [2] Ari Juels and Martin Wattenberg. A fuzzy commitment method.(1999),‖ In Proc. of the 6th ACM conference on Computer and communications security‖ (CCS‘99), Singapore, pages 28–36. ACM Press.

[3] Chun-Ta Li and Min-Shiang Hwang.(2010),‖An efficient biometrics-based remote user authentication method using smart cards‖. J. Netw. Comput. Appl., 33(1):1–5.

[4] David Pointcheval and S´ebastien Zimmer.(2008),‖Multi-factor authenticated key exchange‖. In Proc. of the 6th international conference on Applied cryptography and network security (ACNS‘08), New York, USA, LNCS, volume 5037, pages 277–295. Springer-Verlag.

[5] Fan Chun-I and Lin Yi-Hui.(2009).‖ Provably secure remote truly three-factor authentication method with privacy protection on biometrics‖. Trans. Info.

For. Sec., 4(4):933–945.

[6] Hyun-Sung Kim, Sung-Woon Lee, and Kee-Young Yoo.(2003),‖ ID-based password authentication method using smart cards and fingerprints‖. SIGOPS Oper. Syst. Rev., 37(4):32–41.

[7] JingXu,Wen-Tao Zhu, and Deng-GuoFeng.(2009) ―An improved smart card based password authentication method with provable security‖. Computer Standards and Interfaces, 31(4):723–728.

[8] Julien Bringer, Herv´eChabanne, and Bruno Kindarji.(2009),‖ Identification with encrypted biometric data made feasible‖. In Proc. of the International Conference on Communications 2009 (ICC‘09), Dresden, Germany.

[9] L.Lamport,“Password authentication with insecure communication,”Commun. ACM, vol. 24, no. 11, pp. 770–772, 1981 [10] S.Kumari and M.K.Khan, “Cryptanalysis and improvement of„astrong smart-card-based remote user password authentication method,”‟ Int. J. Commun.

Syst., vol. 27, no. 12, pp. 3939–3955, 2014.

All rights reserved by www.ijste.org

133