ZERO KNOWLEDGE PASSWORD AUTHENTICATION PROTOCOL

In many applications, the password is sent as cleartext to the server to be authenticated thus providing the eavesdropper with opportunity to steal valuable data. This paper presents a simple protocol based on zero knowledge proof by which the user can prove to the authentication server that he has the password without having to send the password to the server as either cleartext or in encrypted format. Thus the user can authenticate himself without having to actually reveal the password to the server. Also, another version of this protocol has been proposed which makes use of public key cryptography thus adding one more level of security to the protocol and enabling mutual authentication between the client & server

Authentication Mechanism Based on Adaptable Context Management Framework for Secure Network Services

A system, which uses context information is a new trend in IT. A lot of researcherscreate frameworks, which collect some data and perform actions based on them. Recently, there havebeen observed more and more different security solutions, in which we can use context. But not eachworks dynamically and ensures a high level of user's quality of experience (QoE). This paper outlineswhat the context information is and shows a secure and user-friendly authentication mechanism for amail box in cloud computing, based on using contextual data

Rede virtual privada Embrapa Florestas.

bitstream/CNPF-2009-09/41802/1/doc142.pd

Security of Eduroam Passwords

Tartu Ülikool on otsustanud, et ülikooli traadita ühenduse kasutajanimi ja parool peab ühtima ülikooli kontos kasutusel oleva kasutajanime ja parooliga. See tähendab, et juhul kui ülikooli eduroam võrgul leidub mõni nõrkus, on seda potentsiaalselt võimalik ära kasutada kasutajate ülikooli kontole ligipääsuks. Antud uurimistöö on avastanud ühe sellise nõrkuse, milles luuakse võltsitud traadita ühenduse pääsupunkt, et saada kätte kasutaja autentimiseks kasutatava protokolli kasutajapoolset vastust. Selle vastuse põhjal on ründajal võimalik kätte saada kasutaja parooli räsi, mida on omakorda võimalik kasutada Tartu Ülikooli Samba serveriga autentimiseks. Antud uurimistöö sisaldab eduroami ning rünnakus vaja minevate protokollide kirjeldusi ning ettepanekuid, kuidas Tartu Ülikooli eduroami turvalisemaks muuta.The University of Tartu has decided that the university's eduroam accounts will share the same user credentials as the rest of the university's services. This could potentially be abused by exploiting weaknesses in wireless security in order to gain access to a user's university account. The aim of this research was to uncover any such weaknesses. In the course of the research, an attack was discovered, which uses a spoofed access point to capture a handshake between the user and the authenticator, which can be used to retrieve a hash of the user's password. That hash is then used to authenticate to the university's Samba server. The thesis also provides the reader with details on how eduroam and the protocols used in the attack work, and discusses potential improvements to strengthen the security of Tartu University's eduroam

Two-factor authentication

The purpose of this thesis is to describe the setup of a two-factor authentication system at Register.si, which will ensure a greater protection of information. The system consists of a FreeRADIUS server that takes care of user authentication in connection to the MultiOTP tool, as well as of AuthenticationApi web services that accept user authentication requirements. The thesis will present an importance of two-factor authentication, as well as offer descriptions of various authentication algorithms and protocols, and security devices. Concerning two-factor authentication, the username and the password cover the first factor, while a one-time password token generator was chosen as the second factor, as the most appropriate one for a predetermined criteria

Two-factor authentication

The purpose of this thesis is to describe the setup of a two-factor authentication system at Register.si, which will ensure a greater protection of information. The system consists of a FreeRADIUS server that takes care of user authentication in connection to the MultiOTP tool, as well as of AuthenticationApi web services that accept user authentication requirements. The thesis will present an importance of two-factor authentication, as well as offer descriptions of various authentication algorithms and protocols, and security devices. Concerning two-factor authentication, the username and the password cover the first factor, while a one-time password token generator was chosen as the second factor, as the most appropriate one for a predetermined criteria

Migração de ligações Wi-Fi não seguras para ligações seguras, após autenticação em captive portal

Atualmente a popularidade das comunicações Wi-Fi tem crescido, os utilizadores acedem a partir de vários dispositivos como telemóveis, tablets, computadores portáteis sendo estes utilizados por qualquer pessoa nos mais variados locais. Com esta utilização massiva por parte dos utilizadores surgiram os hotspots Wi-Fi públicos (em aeroportos, estações de comboios, etc) que permitem a ligação de clientes recorrendo a ligações wireless não seguras (ou abertas). Tais hotspots utilizam, após a ligação de um cliente, um captive portal que captura o tráfego IP com origem no cliente e o redireciona para uma página Web de entrada. A página Web permite ao cliente comprar tempo de acesso à Internet ou, caso já seja um cliente da empresa, autenticar-se para ter acesso à Internet. A necessidade da ligação aberta assenta na possibilidade do operador do hotspot vender acesso à Internet a utilizadores não conhecidos (caso contrário teria de fornecerlhes uma senha previamente). No entanto, fornecer um acesso à Internet wireless sem qualquer tipo de segurança ao nível físico permite que qualquer outro utilizador consiga obter informação sobre a navegação Web dos utilizadores ligados (ex.: escuta de pedidos DNS). Nesta tese pretende-se apresentar uma solução que estenda um dos atuais mecanismos de autenticação Wi-Fi (WPA, WPA2) para que permita, após autenticação em captive portal, a migração de uma ligação aberta para uma ligação segura.Nowadays, the popularity of Wi-Fi communications has grown because the users can access networks from multiple devices such as mobile phones, tablets, laptops and these being used by anyone in different places all over the world. With this massive use of technologies, Public Wi-Fi hotspots such as airports, train stations, etc. created allowing the connection through unsecured (or open) connections. After the connection with the client, these hotspots use a captive portal that captures the client IP traffic and redirects it to an particular Web page. The website allows customers to buy Internet access time or, if they already have credentials from that company, log-in and access the Internet. The need for open connection is based on the possibility of the hotspot operator to sell Internet accesses to unknown users (otherwise would have to provide them with a password previously). However, to provide a wireless access to the Internet without any kind of security at the physical level allows any user can get information about web browsing of connected users (eg.: listening DNS requests). This thesis is intend to provide a solution based on the extension of the current mechanisms for Wi-Fi authentication (WPA, WPA2) to allow, after an authentication in captive portal, to migrate from an open connection to a secure connection

Identity Detection in TCP/IP Architecture

Tato práce se zabývá detekcí identity uživatelů v rámci počítačových sítí na různých vrstvách architektury TCP/IP. Tyto identity jsou zjišťovány z protokolů běžících na příslušných vrstvách dané architektury. Z hlediska přidělování přístupu do sítí byly vybrány protokoly PPPoE a SLAAC. Druhým typem protokolu je aplikační protokol SMTP. U těchto vybraných protokolů byla analyzována jejich činnost spolu s možnostmi vytváření metainformací o příslušné komunikaci. Výsledkem analýzy jsou stavové automaty. Na základě těchto stavových automatů byl navržen a implementován software, který je určen pro účely zákonných odposlechů. Implementováný software byl následně otestován na vzorových datech, v specializované laboratoři a na produkční síti.This work deals with detection of users within computer networks on different layers of the TCP/IP architecture. These identities are identified by protocols running on the appropriate layers of the given architecture. PPPoE and SLAAC protocols were chosen as protocols that are used for network layer address assignments. The second type of protocol is the application protocol SMTP. We analysed communication using the chosen protocols in order to create metadata about the corresponding communication. The results of the analysis are finite state machines. Based on these finite state machines, software for legal interception was designed and implemented. Implemented software was tested on samples of data, in a specialized laboratory, and in a production network.