Design of Password Guessing Prevention Protocol for Levelled-Security System

Author Name(s): R. L. Bagad, A. N. Magar, S. N. Mali, R. R. Rathod
Author Email: maliswapnil982@gmail.com

Abstract Most applications use the password for authentication of the legitimate user. These applications maintain a database of username and corresponding password. In databases, passwords are stored in the form of hash values which are irreversible. A potential hacker may use brute force attack or dictionary attack for guessing the password. In brute force attack; hacker tries all possible combinations of passwords to gain unauthorized access to user’s account. In a dictionary attack, the hacker uses dictionary file containing possible passwords and tries every password from that file. It is noted that, even though password with certain patterns is accepted as strong by existing systems, they are vulnerable to dictionary attack. The proposed system allows the user to choose a password which is not present in the dictionary. Also, all possible alterations of passwords are matched against the supplied dictionary. Password containing personal information is not accepted by the system. The present study proposes a security method based on login attempts and respective security levels for the password. The concept of security levels is introduced which aims at increasing the strength of the password on detection of malicious activity such as invalid login attempts, login attempts performed for the same user account from two different locations in little time difference which are far away from each other, etc. On detection of any suspicious activity, the security level of the password gets upgraded to the higher level which increases length and strength of the password by making it more complex and hard to crack.

Introduction

Passwords are the most common way to provide authentication to the user. However, several threats have proven that many people’s passwords are vulnerable to being cracked. Thus the security of user’s information is threatened all the time [1]. Password is the weakest link in authentication. Due to human memory limitation, it is not possible to have a truly random password [2], [3], [4], [5], [6]. This might be the reason behind the choosing weak passwords by humans which are easily cracked by dictionary or brute force attack

Conclusion

Authentication systems face critical problems due to weak and easily guessable passwords. Since password remains same unless and until the user changes it, so the hacker can easily crack it by brute force method using available tools. The proposed system introduces the concept of security level which corresponds to increasing the strength of the password automatically when malicious activity is detected. Currently, available schemes use two-factor authentication which requires having secondary devices like a mobile device, but the proposed system does not require to carry any secondary devices with the user. The proposed system doesn’t allow users personal information to reside in the password. Hence it is difficult for an attacker to crack the password through a dictionary attack. Also proposed system changes password to higher security level upon detection of brute force attack which does not require any account locking. Therefore attacker cannot employ DOS or DDOS attack. The proposed system does not require to generate ATTs, hence there is no overhead of generating ATTs on the server side.

1,058 total views, no views today

Download PDF File

About the author: admin