Federated Authentication using the Cloud (Cloud Aura)

Individuals, businesses and governments undertake an ever-growing range of activities online and via various Internet-enabled digital devices. Unfortunately, these activities, services, information and devices are the targets of cybercrimes. Verifying the user legitimacy to use/access a digital device or service has become of the utmost importance. Authentication is the frontline countermeasure of ensuring only the authorised user is granted access; however, it has historically suffered from a range of issues related to the security and usability of the approaches. Traditionally deployed in a point-of-entry mode (although a number of implementations also provide for re-authentication), the intrusive nature of the control is a significant inhibitor. Thus, it is apparent that a more innovative, convenient and secure user authentication solution is vital. This thesis reviews the authentication methods along with the current use of authentication technologies, aiming at developing a current state-of-the-art and identifying the open problems to be tackled and available solutions to be adopted. It also investigates whether these authentication technologies have the capability to fill the gap between the need for high security whilst maximising user satisfaction. This is followed by a comprehensive literature survey and critical analysis of the existing research domain on continuous and transparent multibiometric authentication. It is evident that most of the undertaken studies and proposed solutions thus far endure one or more shortcomings; for instance, an inability to balance the trade-off between security and usability, confinement to specific devices, lack or negligence of evaluating users’ acceptance and privacy measures, and insufficiency or absence of real tested datasets. It concludes that providing users with adequate protection and convenience requires innovative robust authentication mechanisms to be utilised in a universal manner. Accordingly, it is paramount to have a high level of performance, scalability, and interoperability amongst existing and future systems, services and devices. A survey of 302 digital device users was undertaken and reveals that despite the widespread interest in more security, there is a quite low number of respondents using or maintaining the available security measures. However, it is apparent that users do not avoid applying the concept of authentication security but avoid the inconvenience of its current common techniques (biometrics are having growing practical interest). The respondents’ perceptions towards Trusted Third-Party (TTP) enable utilising biometrics for a novel authentication solution managed by a TTP working on multiple devices to access multiple services. However, it must be developed and implemented considerately. A series of experimental feasibility analysis studies disclose that even though prior Transparent Authentication Systems (TAS) models performed relatively well in practice on real live user data, an enhanced model utilising multibiometric fusion outweighs them in terms of the security and transparency of the system within a device. It is also empirically established that a centralised federated authentication approach using the Cloud would help towards constructing a better user profile encompassing multibiometrics and soft biometric information from their multiple devices and thus improving the security and convenience of the technique beyond those of unimodal, the Non-Intrusive and Continuous Authentication (NICA), and the Weighted Majority Voting Fusion (WMVF) and what a single device can do by itself. Furthermore, it reduces the intrusive authentication requests by 62%-74% (of the total assumed intrusive requests without operating this model) in the worst cases. As such, the thesis proposes a novel authentication architecture, which is capable of operating in a transparent, continuous and convenient manner whilst functioning across a range of digital devices – bearing in mind it is desirable to work on differing hardware configurations, operating systems, processing capabilities and network connectivity but they are yet to be validated. The approach, entitled Cloud Aura, can achieve high levels of transparency thereby being less dependent on secret-knowledge or any other intrusive login and leveraging the available devices capabilities without requiring any external sensors. Cloud Aura incorporates a variety of biometrics from different types, i.e. physiological, behavioural, and soft biometrics and deploys an on-going identity confidence level based upon them, which is subsequently reflected on the user privileges and mapped to the risk level associated to them, resulting in relevant reaction(s). While in use, it functions with minimal processing overhead thereby reducing the time required for the authentication decision. Ultimately, a functional proof of concept prototype is developed showing that Cloud Aura is feasible and would have the provisions of effective security and user convenience.Royal Commission for Jubail and Yanbu, Kingdom of Saudi Arabi

An Overview on Privacy Preserving Biometrics

The Internet has consolidated itself as a very powerful platform that has changed the communication and business way. Nowadays, the number of users navigating through Internet is about 1,552 millions according to Internet World Stats. This large audience demands online commerce, e-government, knowledge sharing, social networks, online gaming . . . which grew exponentially over the past few years. The security of these transactions is very important considering the number of information that could be intercepted by an attacker. Within this context, authentication is one of the most important challenges in computer security. Indeed, the authentication step is often considered as the weakest link in the security of electronic transactions. In general, the protection of the message content is achieved by using cryptographic protocols that are well known and established. The well-known ID/password is far the most used authentication method, it is widely spread despite its obvious lack of security. This is mainly due to its implementation ease and to its ergonomic feature: the users are used to this system, which enhances its acceptance and deployment. Many more sophisticated solutions exist in the state of the art to secure logical access control (one time passwords tokens, certificates . . . ) but none of them are used by a large community of users for a lack of simplicity usage (O'Gorman, 2003)..

Recent Application in Biometrics

In the recent years, a number of recognition and authentication systems based on biometric measurements have been proposed. Algorithms and sensors have been developed to acquire and process many different biometric traits. Moreover, the biometric technology is being used in novel ways, with potential commercial and practical implications to our daily activities. The key objective of the book is to provide a collection of comprehensive references on some recent theoretical development as well as novel applications in biometrics. The topics covered in this book reflect well both aspects of development. They include biometric sample quality, privacy preserving and cancellable biometrics, contactless biometrics, novel and unconventional biometrics, and the technical challenges in implementing the technology in portable devices. The book consists of 15 chapters. It is divided into four sections, namely, biometric applications on mobile platforms, cancelable biometrics, biometric encryption, and other applications. The book was reviewed by editors Dr. Jucheng Yang and Dr. Norman Poh. We deeply appreciate the efforts of our guest editors: Dr. Girija Chetty, Dr. Loris Nanni, Dr. Jianjiang Feng, Dr. Dongsun Park and Dr. Sook Yoon, as well as a number of anonymous reviewers

Älypuhelin kotiverkkojen luottamusankkurina

Kun tietoverkot kodeissa monimutkaistuvat, eivät kotikäyttäjät osaa tai halua enää ylläpitää niitä. Kotiverkkojen ylläpito ei eroa nykyisin paljon yritysympäristöistä. Käyttäjältä vaaditaan läsnäolo, tunnukset ja tietämys laitteiden operointiin. Näitä vaatimuksia täytyy soveltaa, jos ylläpito ulkoistettaisiin ja pääsy kotiverkkoihin sallittaisiin. Luotettava toimija on palkattava ja jaettava tälle tunnistautumiskeino sekä pääsy kohdelaitteelle ulkoa käsin. Tämä edellyttää ennakkotoimia ja tunnistautumisavainten jakelua. Käyttäjän älypuhelimessa toimiva sovellus toimii tässä luotettuna toimijana. Matkapuhelinliittymällään käyttäjä on jo osa luotettua tilaajarekisteriä, ja tätä ominaisuutta käytetään hyväksi työssä luottamuksen rakentajana. Matkapuhelintunnistuksena käytetään SIM-kortin tilaajatietoa EAP-menetelmällä. EAP-SIM-pohjaisen tunnistuksen toimivuus esitetään käyttöympäristössä, jossa on simuloitu SIM-kortti ja matkapuhelinoperaattori. Periaatteena on ollut käyttää olemassaolevia tekniikoita yhdistäen niitä uusiin alueisiin, kuten homenet-määritysten kotiverkkoihin ja edustajalle ulkoistettuun hallintaan. Tunnistus- ja valtuutustietojen välittämisen hoitaa WPA2 Enterprise RADIUS-ympäristössä. Välttääksemme monimutkaisuutta ja tarpeetonta hienorakeisuutta, käytämme yksinkertaista hallintaverkkomallia, jonka rajalla on kotiverkosta muuten erillään oleva älypuhelin. Tuloksena näytetään, että matkapuhelimella tehty tunnistautuminen luo luottamusankkurin ulkoisen edustajan ja kodin hallintaverkon välille avaten edustajalle hallintayhteyden kotikäyttäjän valvonnassa. SIM-tunnistuksen hyötyjä ovat vahva tunnistus ja laaja käyttäjäkanta. Haittoina ovat riippuvuus teleoperaattorista, käyttäjän identiteetin paljastumisen uhka ja ei-toivottu automaattinen tunnistautuminen.Today, home networks are complex, and the home owners do not necessarily want to administer all aspects of their networks. Configuring home network devices does not differ much from configuring enterprise devices. One needs access, credentials to login and knowledge to operate the device. If the configuration is outsourced to external parties and done remotely, those requirements need adaptation. Access to an end device from the outside must be provided, a trusted operator must be hired, and login credentials shared. For this purpose, some previously set provisioning and distribution of authentication keys is needed. In this work, an application running on a user's smartphone represents this trusted operator. The fact that the mobile phone subscribers already are part of a reliable infrastructure is used in the study as a trusted base. To benefit from the mobile identification, it is shown how the authentication and authorization are done using an extendable authentication profile (EAP) and a SIM card. A theory to use EAP-SIM authentication at home is presented, and to demonstrate that it works, a simulated testbed is built, tested, and analyzed. The idea is to reuse existing techniques by combining them with such new areas as homenet and delegated management. Authentication claims are transported with WPA2 Enterprise. To further avoid complexity and granularity, we only use a simple model of management network. As a result, we show that the smartphone authentication provides a trust anchor between a configuration agent and the home network. The home network management can be controlled via the smartphone while keeping the local phone user still in control. The benefits of using the SIM are that it is considered strong, and it has a large existing user base, while its disadvantages include dependency onto the mobile operator. Additionally, there remain challenges in keeping the SIM's identity private and in disabling unwanted re-authentications

A practical application of a text-independent speaker authentication system on mobile devices

The growing market of mobile devices forces to question about how to protect users’ credentials and data stored on such devices. Authentication mechanisms remain the first layer of security in the use of mobile devices. However, several of such mechanisms that have been already proposed were designed in a machine point of view. As a matter of fact, they are not compatible with behaviors human have while using their mobile devices in the daily life. Consequently, users adopted unsafe habits that may compromise the proper functioning of authentication mechanisms according to the safety aspect. The first main objective of this research project is to highlight strengths and weaknesses of current authentication systems, from the simpler ones such as PIN (Personal Identification Number) to the more complex biometric systems such as fingerprint. Then, this thesis offers an exhaustive evaluation of existing schemes. For this evaluation, we rely on some existing criteria and we also propose some new ones. Suggested criteria are chiefly centered on the usability of these authentica-tion systems. Secondly, this thesis presents a practical implementation of a text-independent speaker au-thentication system for mobile devices. We place a special attention in the choice of algorithms with low-computational costs since we want that the system operates without any network communication. Indeed, the enrollment, as well as the identification process are achieved onto the device itself. To this end, our choice was based on the extraction of Linear Prediction Cepstral Coefficients (LPCCs) (Furui 1981; O'Shaughnessy 1988) to obtain relevant voice features and the Naïve Bayes classifier (Zhang 2004) to predict at which speaker a given utterance corresponds. Furthermore, the authenti-cation decision was enhanced in order to overcome misidentification. In that sense, we introduced the notion of access privileges (i.e. public, protected, private) that the user has to attribute to each appli-cation installed on his/her mobile device. Then, the safest authority is granted through the result of the speaker identification decision as well as the analysis of the user’s location and the presence of a headset. In order to evaluate the proposed authentication system, eleven participants were involved in the experiment, which was conducted in two different environments (i.e. quiet and noisy). Moreover, we also employed public speech corpuses to compare this implementation to existing methods. Results obtained have shown that our system is a relevant, accurate and efficient solution to authenticate users on their mobile devices. Considering acceptability issues which were pointed out by some users, we suggest that the proposed authentication system should be either employed as part of a multilayer authentication, or as a fallback mechanism, to cover most of the user needs and usages. La croissance du marché des dispositifs mobiles implique de se questionner au sujet de comment protéger l’identité ainsi que les données personnelles des utilisateurs qui sont stockées sur ces appareils. En ce sens, les mécanismes d’authentification demeurent la première couche de sécurité dans l’utilisation des mobiles. Cependant, il apparaît que la plupart des mécanismes d’authentification qui ont été proposés, ont été conçus suivant un point de vue orienté machine plutôt qu’humain. En effet, ceux-ci ne s’adaptent généralement pas avec l’usage quotidien qu’ont les utilisateurs lorsqu’ils se servent leur téléphone. En conséquence, ils ont adopté des habitudes dangereuses qui peuvent compromettre le bon fonctionnement des systèmes d’authentification. Celles-ci peuvent alors remettre en question la sécurité de leur identité ainsi que la confidentialité de leur contenu numérique. Le premier objectif principal de ce projet de recherche est de faire ressortir les forces et les faiblesses des méthodes d’authentification qui existent actuellement, des plus simples comme le NIP (Numéro d’Identification Personnel) aux solutions biométriques plus complexes comme l’empreinte digitale. Par la suite, ce mémoire offre une évaluation exhaustive de ces solutions, basée sur des critères existant ainsi que de nouveaux critères que nous suggérons. Ces derniers sont majoritairement centrés sur l’utilisabilité des mécanismes d’authentification qui ont été examinés. Dans un second temps, ce mémoire présente une implémentation pratique, pour périphériques mobiles, d’un système d’authentification d’orateur indépendant de ce qui est prononcé par l’utilisateur. Pour concevoir un tel système, nous avons porté une attention particulière dans le choix d’algorithmes admettant un faible temps d’exécution afin de se prémunir des communications réseau. En effet, ceci nous permet alors de réaliser le processus d’entraînement ainsi que la reconnaissance, directement sur le mobile. Les choix technologiques se sont arrêtés sur l’extraction de coefficients spectraux (Linear Prediction Cepstral Coefficients) (Furui 1981; O'Shaughnessy 1988) afin d’obtenir des caractéristiques vocales pertinentes, ainsi que sur une classification naïve bayésienne (Zhang 2004) pour prédire à quel utilisateur correspond un énoncé donné. La décision finale, quant à elle, a été améliorée afin de se prémunir des mauvaises identifications. En ce sens, nous avons introduit la notion de droits d’accès spécifiques (i.e. publique, protégé ou privé) que l’utilisateur doit attribuer à chacune des applications installées sur son mobile. Ensuite, l’autorisation d’accès la plus adaptée est accordée, grâce au résultat retournée par l’identification de l’orateur, ainsi que par l’analyse de la localisation de l’utilisateur et de l’emploi d’un micro-casque. Pour réaliser l’évaluation du système que nous proposons ici, onze participants ont été recrutés pour la phase d’expérimentation. Cette dernière a été menée dans deux types d’environnements différents (i.e. silencieux et bruyant). De plus, nous avons aussi exploité des corpus de voix publiques afin de comparer notre implémentation à celles qui ont été proposées par le passé. Par conséquent, les résultats que nous avons obtenus ont montré que notre système constitue une solution pertinente, précise et efficace pour authentifier les utilisateurs sur leurs périphériques mobiles. Compte tenu des problèmes d’acceptabilité qui ont été mis en avant par certains testeurs, nous suggérons qu’un tel système puisse être utilisé comme faisant part d’une authentification à plusieurs facteurs, mais aussi comme une solution de repli, en cas d’échec du mécanisme principal, afin de couvrir la majorité des besoins et des usages des utilisateurs

Big Data Security (Volume 3)

After a short description of the key concepts of big data the book explores on the secrecy and security threats posed especially by cloud based data storage. It delivers conceptual frameworks and models along with case studies of recent technology

Development of a secure multi-factor authentication algorithm for mobile money applications

A Thesis Submitted in Fulfillment of the Requirements for the Degree of Doctor of Philosophy in Information and Communication Science and Engineering of the Nelson Mandela African Institution of Science and TechnologyWith the evolution of industry 4.0, financial technologies have become paramount and mobile money as one of the financial technologies has immensely contributed to improving financial inclusion among the unbanked population. Several mobile money schemes were developed but, they suffered severe authentication security challenges since they implemented two-factor authentication. This study focused on developing a secure multi-factor authentication (MFA) algorithm for mobile money applications. It uses personal identification numbers, one-time passwords, biometric fingerprints, and quick response codes to authenticate and authorize mobile money subscribers. Secure hash algorithm-256, Rivest-Shamir-Adleman encryption, and Fernet encryption were used to secure the authentication factors, confidential financial information and data before transmission to the remote databases. A literature review, survey, evolutionary prototyping model, and heuristic evaluation and usability testing methods were used to identify authentication issues, develop prototypes of native genuine mobile money (G-MoMo) applications, and identify usability issues with the interface designs and ascertain their usability, respectively. The results of the review grouped the threat models into attacks against privacy, authentication, confidentiality, integrity, and availability. The survey identified authentication attacks, identity theft, phishing attacks, and PIN sharing as the key mobile money systems’ security issues. The researcher designed a secure MFA algorithm for mobile money applications and developed three native G-MoMo applications to implement the designed algorithm to prove the feasibility of the algorithm and that it provided robust security. The algorithm was resilient to non-repudiation, ensured strong authentication security, data confidentiality, integrity, privacy, and user anonymity, was highly effective against several attacks but had high communication overhead and computational costs. Nevertheless, the heuristic evaluation results showed that the G-MoMo applications’ interface designs lacked forward navigation buttons, uniformity in the applications’ menu titles, search fields, actions needed for recovery, and help and documentation. Similarly, the usability testing revealed that they were easy to learn, effective, efficient, memorable, with few errors, subscriber satisfaction, easy to use, aesthetic, easy to integrate, and understandable. Implementing a secure mobile money authentication and authorisation by combining multiple factors which are securely stored helps mobile money subscribers and other stakeholders to have trust in the developed native G-MoMo applications

Desarrollo de una pasarela y nodos LoRaWAN como solución de bajo coste para implantaciones IoT

[ES] Desde la aparición de Internet en 1969, el cambio cultural y social que ha generado ha sido más que evidente. El avance tecnológico en las últimas décadas ha sido más que notable, gracias en gran medida a la creación de una red de conocimientos global. Con el paso de los años hemos ido conectando más equipos con el fin de ampliar esta gran red, primero fueron los ordenadores, después aparecieron los móviles inteligentes, y en la actualidad estamos conectando casi cualquier cosa, esta es la próxima revolución tecnológica que estamos viviendo en la actualidad, lo que llamamos Internet de las cosas, o IoT por sus siglas en ingles. Existen en la actualidad diversas tecnologías para conectar estos dispositivos a la red, como es el caso de LoRa, una tecnología de modulación de frecuencia que permite la transmisión de datos a largas distancias y a un bajo coste. Existe un problema en la actualidad con esta tecnología en España, y es la falta de zonas de cobertura. La primera parte de nuestro trabajo consiste en dar solución a este problema, y mostrar la posibilidad de desarrollar una pasarela que incremente la cobertura LoRa gracias a la plataforma TTN. Las ventajas de crear esta red, es la posibilidad de hacer uso de ella para la conexión de dispositivos inteligentes, o como les vamos a denominar a partir de ahora nodos. Estos nodos construidos en base a LoRa tienen la ventaja principal de bajo consumo energético, instalaciones económicas gracias a los alcances de transmisión elevados y conexión gratuita al usar la banda ISM que no requiere de licencia para su utilización. Aunque nuestro interés actual es en la tecnología, no hay mejor muestra de los beneficios que una aplicación real. Por ello la segunda parte de nuestro trabajo consiste en monitorizar una comunidad de vecinos, con el fin de poder controlar el estado de distintas zonas como son la piscina, un parque infantil y el garaje.[EN] Since the aparition of Internet in 1969, the cultural and social change it has generated has been more than evident. Technological advancement in recent decades has been more than remarkable, thanks in large parts to the creation of a global knowledge network. Over the years we have been connecting more devices in order to expand this great network, first were computers, then smartphones appeared, and today we are connecting almost anything, this is the next technological revolution that we are living today, what we call the Internet of Things, or IoT. There are currently various technologies to connect these devices to the network, such as LoRa, a frequency modulation technology that allows the transmission of data over long distances and at a low cost. There is a problem today with this technology in Spain, and it is the lack of coverage areas. The first part of our project is to solve this problem, and show the possibility of developing a gateway that increases LoRa coverage thanks to the TTN platform. The advantages of creating this network, is the possibility to make use of it for the connection of smart devices, or as we are going to call them from now on, nodes. These LoRa-based nodes have the main advantage of low power consumption, economical installations thanks to high transmission ranges, and free connection thanks to the use of non-licensed ISM band. Although our current interest is in technology, there is no better example of the benefits than a real application. Therefore, the second part of our project is to monitor a community of neighbors, in order to be able to control the status of different areas such as the swimming pool, a playground and the garage.Ortega Pérez, A. (2019). Desarrollo de una pasarela y nodos LoRaWAN como solución de bajo coste para implantaciones IoT. Universitat Politècnica de València. http://hdl.handle.net/10251/134125TFG

A formalised ontology for network attack classification

One of the most popular attack vectors against computers are their network connections. Attacks on computers through their networks are commonplace and have various levels of complexity. This research formally describes network-based computer attacks in the form of a story, formally and within an ontology. The ontology categorises network attacks where attack scenarios are the focal class. This class consists of: Denial-of- Service, Industrial Espionage, Web Defacement, Unauthorised Data Access, Financial Theft, Industrial Sabotage, Cyber-Warfare, Resource Theft, System Compromise, and Runaway Malware. This ontology was developed by building a taxonomy and a temporal network attack model. Network attack instances (also know as individuals) are classified according to their respective attack scenarios, with the use of an automated reasoner within the ontology. The automated reasoner deductions are verified formally; and via the automated reasoner, a relaxed set of scenarios is determined, which is relevant in a near real-time environment. A prototype system (called Aeneas) was developed to classify network-based attacks. Aeneas integrates the sensors into a detection system that can classify network attacks in a near real-time environment. To verify the ontology and the prototype Aeneas, a virtual test bed was developed in which network-based attacks were generated to verify the detection system. Aeneas was able to detect incoming attacks and classify them according to their scenario. The novel part of this research is the attack scenarios that are described in the form of a story, as well as formally and in an ontology. The ontology is used in a novel way to determine to which class attack instances belong and how the network attack ontology is affected in a near real-time environment