In 2010,Lee et al proposed two simple and efficient three-party password-authenticated key exchange protocols that had been proven secure in the random oracle model.They argued that the two protocols could resist offl...In 2010,Lee et al proposed two simple and efficient three-party password-authenticated key exchange protocols that had been proven secure in the random oracle model.They argued that the two protocols could resist offline dictionary attacks.Indeed,the provable approach did not provide protection against off-line dictionary attacks.This paper shows that the two protocols are vulnerable to off-line dictionary attacks in the presence of an inside attacker because of an authentication flaw.This study conducts a detailed analysis on the flaw in the protocols and also shows how to eliminate the security flaw.展开更多
In the digital age, phishing attacks have been a persistent security threat leveraged by traditional password management systems that are not able to verify the authenticity of websites. This paper presents an approac...In the digital age, phishing attacks have been a persistent security threat leveraged by traditional password management systems that are not able to verify the authenticity of websites. This paper presents an approach to embedding sophisticated phishing detection within a password manager’s framework, called PhishGuard. PhishGuard uses a Large Language Model (LLM), specifically a fine-tuned BERT algorithm that works in real time, where URLs fed by the user in the credentials are analyzed and authenticated. This approach enhances user security with its provision of real-time protection from phishing attempts. Through rigorous testing, this paper illustrates how PhishGuard has scored well in tests that measure accuracy, precision, recall, and false positive rates.展开更多
To tackle with the security lack in the password-authenticated key exchange protocol, this paper proposes a two-party password-authenticated key exchange protocol based on a verifier. In the proposed protocol, a user ...To tackle with the security lack in the password-authenticated key exchange protocol, this paper proposes a two-party password-authenticated key exchange protocol based on a verifier. In the proposed protocol, a user stores his password in plaintext, and the server stores a verifier for the user’s password, using DL difficult problem and DH difficult problem, through the session between user and server to establish a session key. The security discussion result shows that the proposed protocol provides forward secrecy, and can effectively defend against server compromising fake attacks, dictionary attacks and middleman attacks. Protocol efficiency comparisons reveal our protocol is more reasonable.展开更多
Three-party password authenticated key exchange (3PAKE) protocol plays a significant role in the history of secure communication area in which two clients agree a robust session key in an authentic manner based on pas...Three-party password authenticated key exchange (3PAKE) protocol plays a significant role in the history of secure communication area in which two clients agree a robust session key in an authentic manner based on passwords. In recent years, researchers focused on developing simple 3PAKE (S-3PAKE) protocol to gain system e?ciency while preserving security robustness for the system. In this study, we first demonstrate how an undetectable on-line dictionary attack can be successfully applied over three existing S-3PAKE schemes. An error correction code (ECC) based S-3PAKE protocol is then introduced to eliminate the identified authentication weakness.展开更多
物联网(Internet of Things,IOT)是由大量连接的对象或设备组成的一种新型互联网络。物联网中的物理对象或传感设备能够收集周围环境产生的敏感数据,然后通过不安全的公开信道进行数据信息的交换和共享。因此,必须创建安全的媒介来保护...物联网(Internet of Things,IOT)是由大量连接的对象或设备组成的一种新型互联网络。物联网中的物理对象或传感设备能够收集周围环境产生的敏感数据,然后通过不安全的公开信道进行数据信息的交换和共享。因此,必须创建安全的媒介来保护数据的机密性和完整性,防止遭受敌手的攻击。在这方面,认证密钥协商(Authenticated Key Agreement,AKA)协议能够实现网络通信实体之间的相互认证,并生成一个共享的对称会话密钥,用于加密未来传送的数据。首先,回顾了一些面向物联网应用场景提出的AKA协议,这些AKA协议使用椭圆曲线密码学或切比雪夫混沌映射密码机制作为构建模块进行设计。随后,列举了这些AKA协议容易遭受的攻击和缺乏的安全属性。最后,针对设计安全高效的AKA协议提出了几条有用的建议,这些建议有助于AKA协议设计者实现其所声称的安全功能属性。展开更多
基金Supported by the Natural Science Foundation of Jiangsu Province (Key Program) (BK2011023)
文摘In 2010,Lee et al proposed two simple and efficient three-party password-authenticated key exchange protocols that had been proven secure in the random oracle model.They argued that the two protocols could resist offline dictionary attacks.Indeed,the provable approach did not provide protection against off-line dictionary attacks.This paper shows that the two protocols are vulnerable to off-line dictionary attacks in the presence of an inside attacker because of an authentication flaw.This study conducts a detailed analysis on the flaw in the protocols and also shows how to eliminate the security flaw.
文摘In the digital age, phishing attacks have been a persistent security threat leveraged by traditional password management systems that are not able to verify the authenticity of websites. This paper presents an approach to embedding sophisticated phishing detection within a password manager’s framework, called PhishGuard. PhishGuard uses a Large Language Model (LLM), specifically a fine-tuned BERT algorithm that works in real time, where URLs fed by the user in the credentials are analyzed and authenticated. This approach enhances user security with its provision of real-time protection from phishing attempts. Through rigorous testing, this paper illustrates how PhishGuard has scored well in tests that measure accuracy, precision, recall, and false positive rates.
文摘To tackle with the security lack in the password-authenticated key exchange protocol, this paper proposes a two-party password-authenticated key exchange protocol based on a verifier. In the proposed protocol, a user stores his password in plaintext, and the server stores a verifier for the user’s password, using DL difficult problem and DH difficult problem, through the session between user and server to establish a session key. The security discussion result shows that the proposed protocol provides forward secrecy, and can effectively defend against server compromising fake attacks, dictionary attacks and middleman attacks. Protocol efficiency comparisons reveal our protocol is more reasonable.
基金the National Science Council (Nos. NSC 99-2218-E-011-014 and NSC 100-2219-E-011-002)
文摘Three-party password authenticated key exchange (3PAKE) protocol plays a significant role in the history of secure communication area in which two clients agree a robust session key in an authentic manner based on passwords. In recent years, researchers focused on developing simple 3PAKE (S-3PAKE) protocol to gain system e?ciency while preserving security robustness for the system. In this study, we first demonstrate how an undetectable on-line dictionary attack can be successfully applied over three existing S-3PAKE schemes. An error correction code (ECC) based S-3PAKE protocol is then introduced to eliminate the identified authentication weakness.
文摘物联网(Internet of Things,IOT)是由大量连接的对象或设备组成的一种新型互联网络。物联网中的物理对象或传感设备能够收集周围环境产生的敏感数据,然后通过不安全的公开信道进行数据信息的交换和共享。因此,必须创建安全的媒介来保护数据的机密性和完整性,防止遭受敌手的攻击。在这方面,认证密钥协商(Authenticated Key Agreement,AKA)协议能够实现网络通信实体之间的相互认证,并生成一个共享的对称会话密钥,用于加密未来传送的数据。首先,回顾了一些面向物联网应用场景提出的AKA协议,这些AKA协议使用椭圆曲线密码学或切比雪夫混沌映射密码机制作为构建模块进行设计。随后,列举了这些AKA协议容易遭受的攻击和缺乏的安全属性。最后,针对设计安全高效的AKA协议提出了几条有用的建议,这些建议有助于AKA协议设计者实现其所声称的安全功能属性。
