Abstract

Whenever there is communication between Client and Server over a public link and resources are to be accessed from remote systems, then proving an identity becomes quiet complex because there is need of proper access rights with authentication. Complete security at the transport layer starts with proof of authentication, majority organizations only use password for security but this research paper would include one more tier of security to the transport layer security protocol by using fingerprints for identity authentication. Bio Hashing with the help of Minutiae Points at the fingerprints would be used for mutual authentication. Complete comparative analysis of all the existing password authentication schemes on the basis of security requirements and attacks is done in this paper. Result is generated that which existing scheme could withstand security requirement of mutual authentication for using fingerprint as identity parameter along with password. Proof is generated that with mutual authentication intruders could not practice Phishing, IP or Server Spoofing, Smurf attack and DNS Poisoning etc. Research paper focuses on implementing Password and Fingerprints for mutual authentication in Multi Server environment which will generate an Ideal Password Authentication Scheme and will result in fortification of Transport Layer Security Protocol.

References

• E. Bresson, O. Chevassut, and D. Pointcheval," Security Proofs for an Efficient Password-Based Key Exchange," in 10th ACM Conference on Computer and Communications Security, pp. 1-2,October 27, 2003, Washington, DC, USA.
• Peter Buhler, Thomas Eirich, Michael Steiner and Michael Waidner," Secure Password-Based Cipher Suite for TLS", in Network and Distributed Systems Security Symposium(NDSS 2000),San Diego, California, February 2000.
• Craig A. Huegen, "Network-Based Denial of Service Attacks," www. pentics. net/ denial-of-service/presentations/. . . /19980209_dos. pp. . .
• David A. McGrew and Scott R. Fluhrer ,"Multiple forgery attacks against Message Authentication Codes," eprint. iacr. org/2005/161. pdf ,Cisco Systems, Inc. , May 31, 2005
• Vipul Goyal, Virendra Kumar, Mayank Singh, Ajith Abraham and Sugata Sanyal ," CompChall: Addressing Password Guessing Attacks," http://eprint. iacr. org /2004/136. pdf , 2003
• Kim Davis," DNS Cache Poisoning Vulnerability Explanation and Remedies," www. iana. org/about/. . . /davies-viareggio-entropyvuln-081002. pdf,Viareggio Italy October 2008,
• DongGook Park, Colin Boyd and Sang-Jae Moon ,"Forward Secrecy and Its application to Future Mobile Communications Security," www. dgpark6. com/ Down/pkc2000_FwdSec. pdf
• "Mutual Authentication," en. wikipedia. org/wiki/Mutual_authentication
• Rajaram Ramasamy, Amutha Prabakar Muniyandi ,"New Remote Mutual Authentication Scheme using Smart Cards," Transactions on Data Privacy ,Volume 2, p-141—152,2009
• Tom Davis," RSA Encryption," http://www. geometer. org/mathcircles,October 10, 2003
• Brent Waters, Allison Bishop, El Gamal Encryption CS395T Advanced Cryptography, Lecture 3,27th January 2009
• "ElGamal Encryption Example," www. informatics. indiana. edu/markus/i400/ lecture7. ppt
• Kumar Mangipudi and Rajendra Katti,"A Hash-based Strong Password Authentication Protocol with User Anonymity," International Journal of Network Security, Vol. 2, No. 3, PP. 205–209, May 2006 (http://isrc. nchu. edu. tw/ijns/)
• Hanjae Jeong, Dongho Won and Seungjoo Kim ,"Weaknesses and Improvement of Secure Hash-Based Strong-Password Authentication Protocol," Information Security Group, Journal Of Information Science and Engineering 26, 1845-1858 (2010)
• "Basic Types of fingerprints," http://www. odec. ca/projects/2004/fren4j0/public_html/ fingerprint_patterns. htm
• Sahil Goyal and Mayank Goyal," Generation of hash functions from fingerprint scans," October 2011