Essay: Network security

Related essay: Online privacy
1.1 Network Security
Today’s network environment is full of dangerous attackers, hackers, crackers, and spammers. Authentication, authorization and auditing are the most important issues of security on data communication. An authentication system must provide adequate security for its intended environment, otherwise it fails to meet its primary goal. A proposed system should at minimum be evaluated against common attacks to determine if it satisfies security requirements. We classify the types of attacks on knowledge-based authentication into two general categories: guessing and capture attacks. In successful guessing attacks, attackers are able to either exhaustively search through the entire theoretical password space, or predict higher probability passwords (i.e., create a dictionary of likely passwords) so as to obtain an acceptable success rate within a manageable number of guesses. Guessing attacks may be conducted online through the intended login interface, or online if some variable text (e.g., hashes) can be used to assess the correctness of guesses. Authentication systems with small theoretical password spaces or with identifiable patterns in user choice of passwords are especially vulnerable to guessing attacks.
Fake websites which appear very similar to the original ones are being hosted to achieve this. Phishing is an attempt by an individual or a group to get confidential information such as passwords and credit card information from unsuspecting victims for identity theft, financial gain and other fraudulent activities. Authentication is the first line of defense against compromising confidentiality and integrity. The various authentication systems were introduced but even they are also suffering from shoulder surfing and screen dump attacks.
1.2 Authentication
Security has become an inseparable issue as information technology is ruling the world. As a result of the astonishingly rapid advancement of various kinds of Internet technologies, more information are transmitted to all parts of the world from everywhere through the net. Some of the objects transmitted online may be important secret images, and in such cases the senders have to take information security issues into consideration before they can trustingly enjoy the speed and convenience that nothing in this world but the Internet can offer.
Cryptography is the study of mathematically related techniques to achieve Information Security in terms of confidentiality, data security, entity authentication and data origin authentication. However, it is not the only means of providing information security.
Cryptography includes a set of techniques to achieve confidentiality (amongst others) when transmitting or storing data. Traditional cryptographic schemes require end users to employ complex operations for encryption as well as decryption. An alternative to encrypt messages is Visual
Cryptography (VC), where the decryption is completely performed by the human visual system. Visual cryptography[1] is a new technique which provides information security which uses simple algorithm unlike the complex, computationally intensive algorithms of traditional cryptography. This technique allows Visual information (pictures, text, etc) to be encrypted in such a way that their decryption can be performed by the human visual system, without any complex cryptographic algorithms. VC schemes hide the secret image into two or more images which are called shares. The secret image can be recovered simply by stacking the shares together without any complex computation involved. The shares are very safe because separately they reveal nothing about the secret image.
1.3 Passwords
Generally passwords are used to provide security to a user in a website. But, password capture attacks involve directly obtaining the password, or part thereof, by capturing login credentials when entered by the user, or by tricking the user into divulging their password. Shoulder surfing, phishing, and some kinds of malware are common forms of capture attacks. In shoulder surfing, credentials are captured by direct observation of the login process or through some external recording device such as a video camera. Phishing is a type of social engineering where users are tricked into entering their credentials at a fraudulent website recording user input.
Malware uses unauthorized software on client computers or servers to capture keyboard, mouse, or screen output, which is then parsed to and login credentials. As will be seen, early graphical password systems tended to focus on one particular strength, for example being resistant to shoulder surfing, but testing and analysis showed that they were vulnerable to one or more other types of attacks. Except in very specific environments, these would not provide adequate security. Often playing an important role related to security is the particular process of encoding or discretization used to transforming the user input into discrete units that can be identified by the system and used for comparison during password re-entry. As will be seen, some schemes require that the system retains knowledge of the exact secret (or portion thereof), either to display the correct set of images to the user or to verify password entries. In other cases, encoded or discretized passwords may be hashed, using a one-way cryptographic hash, to provide additional security in case the password level is compromised.
Since such a stream of passwords is almost impossible to remember (certainly for me), the hapless user is forced to write these passwords down, adding to the insecurity. Thus passwords need to be protected by cryptographic techniques, whether they are stored or transmitted. Several simple techniques can help make the old-fashioned form of passwords easier to memorize. First, the system can present a user with a list of possible random passwords from which to choose. With such a choice, there may be one password that is easier for a given user to remember. Second, the most common passwords are limited to 8 characters, and experience has shown that users have a hard time picking such a short password that turns out to be secure.
If the system allows passwords of arbitrary length (fairly common now), then users can employ pass phrases: a phrase or sentence that is not going to be in dictionaries yet is easy for the given user to remember. Personal physical characteristics form the basis for a number of identification methods now in use. The characteristics or biometrics range from finger prints to iris patterns, from voice to hand geometry, among many examples. A simple system password scheme would just have a secret file holding each user’s account name and the corresponding password. There are several problems with this method: if someone manages to read this file, they can immediately pretend to be any of the users listed. Also, someone might find out about a user’s likely passwords from passwords used in the past.
For the reasons above and others, early UNIX systems protected passwords with a one-way function. Along with the account name, the one-way function applied to the password is stored. Thus given a user A, with account name NA and password PA, and given a fixed one-way function h, the system would store NA and h (PA ) as a table entry in the password ‘le, with similar entries for other users. When A supplies his password to the system, the software computes h of his password and compares this result with the table entry. In this way the systems administrators themselves will not know the passwords of users and will not be able to impersonate a user.
In early UNIX systems it was a matter of pride to make the password file world readable. A user would try to guess other’s passwords by trying a guess P: first calculate h (P) and then compare this with all table entries. There were many values of P to try, such as entries in a dictionary, common names, special entries that are often used as passwords, all short passwords, and all the above possibilities with special characters at the beginning or the end. These ‘cracker’ programs have matured to the point where they can always find at least some passwords if there are quite a few users in the system. Now the password file is no longer public, but someone with root privileges can still get to it, and it sometimes leaks out in other ways.
To make the attack in the previous paragraph harder (that attack is essentially the same as cipher text searching), systems can first choose h the one-way function to be more execution time intensive. This only slows down the searches by a linear factor. Another approach uses an additional random table entry, called a salt. Suppose for example that each password table entry has another random t-bit field (the salt), different for each password. When A first puts his password into the system (or changes it), he supplies PA. The system chooses the salt and calculates EA = h (PA, SA), where h is fixed up to handle two inputs instead of one.
The password file entry for A now contains A, SA, and EA. With this change, an attack on a single user is the same, but the attack of the previous paragraph on all users at the same time now takes either an extra factor of time equal to either 2t or the number of users, whichever is smaller. Without the salt, an attacker could check if ‘Vachaspati’ were the password of any user by calculating h (‘Vachaspati’) and doing a fast search of the password ‘le for this entry. With the salt, to check if A is using ‘Vachaspati’ for example, the attacker must retrieve A’s salt SA and calculate h (‘Vachaspati’, SA). Each user requires a different calculation, so this simple device greatly slows down the dictionary attack.
Text Password:
Password strength is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. In its usual form, it estimates how many trials an attacker who does not have direct access to the password would need, on average, to guess it correctly. The strength of a password is a function of length, complexity, and unpredictability [2]
However, other attacks on passwords can succeed without a brute search of every possible password. For instance, knowledge about a user may suggest possible passwords (such as pet names, children’s names, etc.). Hence estimates of password strength must also take into account resistance to other attacks as well. Using strong passwords lowers overall risk of a security breach, but strong passwords do not replace the need for other effective security controls. The effectiveness of a password of a given strength is strongly determined by the design and implementation of the authentication system software, particularly how frequently password guesses can be tested by an attacker and how securely information on user passwords is stored and transmitted. Risks are also posed by several means of breaching computer security which are unrelated to password strength.
Determining Password Strength:
There are two factors to consider in determining password strength: the ease with which an attacker can check the validity of a guessed password, and the average number of guesses the attacker must make to find the correct password. The first factor determined by how the password is stored and what it is used for, while the second factor is determined by how long the password is, what set of symbols it is drawn from and how it is created.
Password Guess Validation:
The most obvious way to test a guessed password is to attempt to use it to access the resource the password was meant to protect. However, this can be slow and many systems will delay or block access to an account after several wrong passwords are entered. On the other hand, systems that use passwords for authentication must store them in some form to check against entered values. Usually only hash value of a password is stored instead of the password itself. If the hash is strong enough, it is very hard to reverse it, so an attacker who gets hold of the hash value cannot directly recover the password. However, if the cryptographic hash data files have been stolen, knowledge of the hash value lets the attacker quickly test guesses.
Password Creation:
Passwords are created either automatically (using randomizing equipment) or by a human. The strength of randomly chosen passwords against a brute force attack can be calculated with precision. Commonly, passwords are initially created by asking a human to choose a password, sometimes guided by suggestions or restricted by a set of rules. This typically happens at the time of account creation for computer systems or Internet Web sites. In this case, only estimates of strength are possible, since humans tend to follow patterns in such tasks, and those patterns may assist an attacker [3].
Password strength depends on symbol set and length:
Increasing the number of possible symbols from which random passwords are chosen will increase the strength of generated passwords of any given length. For example, the printable characters in the American Standard Code for Information Interchange (ASCII) character set (roughly those on a standard U.S. English keyboard) include 26 letters (in two case variants), 10 digits, and 33 non-alphanumeric symbols (i.e., punctuation, grouping, etc.), for a total of 94 symbols (95 if space is included). However the same strength can always be achieved with a smaller symbol set by choosing a longer password. In the extreme, binary passwords can be very secure, even though they only use two possible symbols. Thus a 14 character password consisting of only random lowercase letters has the same strength (4.7??14 = 65.8 bits) as a ten character password chosen at random from all printable ASCII characters (65.55 bits).
Guide Lines for Passwords:
Common guidelines for choosing good passwords are designed to make passwords less easily discovered by intelligent guessing [4-7]:
‘ Password length should be around 12 to 14 characters if permitted, and longer still if possible while remaining memorable
‘ Use randomly generated passwords where feasible
‘ Avoid any password based on repetition, dictionary words, letter or number sequences, usernames, relative or pet names, romantic links (current or past), or biographical information (e.g., ID numbers, ancestors names or dates).
‘ Include numbers, and symbols in passwords if allowed by the system
‘ If the system recognizes case as significant, use capital and lower-case letters
‘ Avoid using the same password for multiple sites or purposes
‘ If we write our passwords down, keep the list in a safe place, such as a wallet or safe, not attached to a monitor or in an unlocked desk drawer
Protecting passwords:
Computer users are generally advised to “never write down a password anywhere, no matter what” and “never use the same password for more than one account.” However, an ordinary computer user may have dozens of password-protected accounts. Users with multiple accounts needing passwords often give up and use the same password for every account. When varied password complexity requirements prevent use of the same (memorable) scheme for producing high-strength passwords, overly simplified passwords will often be created to satisfy irritating and conflicting password requirements. A Microsoft expert was quoted as saying at a 2005 security conference: “I claim that password policy should say we should write down our password. I have 68 different passwords. If I am not allowed to write any of them down, guess what I am going to do? I am going to use the same password on every one of them [2].
Limitations of alphanumeric passwords:
The main problem with the alphanumeric passwords is that once a password has been chosen and learned the user must be able to recall it to log in. But, people genarally forget their passwords. If a password is not frequently used it will be even more susceptible to forgetting.
The recent surveys have shown that users select short, simple passwords that are easily guessable, for example, personal names of their family members, names of pets, date of birth etc. [8].The most important issue is having a password that can be remembered reliably and input quickly. They are unlikely to give priority to security over their need to get on with their work.
1.3.1 Graphical Passwords
Like text passwords, graphical passwords[9] are knowledge-based authentication mechanisms where users enter a shared secret as evidence of their identity. However, where text passwords involve alphanumeric and/or special keyboard characters, the idea behind graphical passwords is to leverage human memory for visual information, with the shared secret being related to or composed of images or sketches.
Graphical password technique is one of methods which may provide more secure and more efficiency system for authentication. A set of secure passwords needs to be long enough and random , but that will be a problem for human to remember. Everyone will forget their settings everyday if they didn’t use again. The research results showed that, when users forget their password, they can only remember part of the correctness. Usable and easy memorization is the main research issues of graphical password authentication.
1.4 Visual Cryptography
One of the best known techniques to protect data is cryptography. It is the art of sending and receiving encrypted messages that can be decrypted only by the sender or the receiver.
Cryptography
Figure 1.1 Sequences of Steps in Cryptography
Visual Cryptography is a secret-sharing method that encrypts a secret image into several shares but requires neither computer nor calculations to decrypt the secret image. Instead, the secret image is reconstructed visually: simply by overlaying the encrypted shares the secret image becomes clearly visible .
A Visual Cryptography Scheme (VCS) [1] on a set ?? of n participants is a method of encoding a ‘secret’ image into n shares such that original image is obtained only by stacking specific combinations of the shares onto each other. It is a cryptographic technique that allows for the encryption of visual information such that decryption can be performed using the human visual system. We can achieve this by one of the following access structure schemes.
‘ (2, 2)- Threshold VCS scheme- This is a simplest threshold scheme that takes a secret message and encrypts it in two different shares that reveal the secret image when they are overlaid.
‘ (n, n) -Threshold VCS scheme- This scheme encrypts the secret image to n shares such that when all n of the shares are combined will the secret image be revealed.
‘ (k, n) -Threshold VCS scheme- This scheme encrypts the secret image to n shares such that when any group of at least k shares are overlaid the secret image will be revealed.[10]
In case of (2, 2) VCS, each pixel P in the original image is encrypted into two sub pixels called shares.
VCS with random shares the traditional VCS or simply the VCS. In general, a traditional VCS takes a secret image as input, and outputs shares that satisfy two conditions:
1) any qualified subset of shares can recover the secret image;
2) any forbidden subset of shares cannot obtain any information of the secret image other than the size of the secret image.
Visual Cryptography
Plaintext (in form of image)
Encryption ( creating shares)
Channel (Fax, Email)
Decryption (Human Visual System)
Figure 1.2 Visual Cryptography
Figure 1.3 Shares of a White Pixel and a Black Pixel
The choice of shares for a white and black pixel is randomly determined (there are two choices available for each pixel). Neither share provides any clue about the original pixel since different pixels in the secret image will be encrypted using independent random choices. When the two shares are superimposed, the value of the original pixel P can be determined. If P is a black pixel, we get two black sub pixels; if it is a white pixel, we get one black sub pixel and one white sub pixel.
The basic principle of the visual cryptography scheme (VCS) was first introduced by Naor and Shamir. VCS is a kind of secret sharing scheme that focuses on sharing secret images[11]. The idea of the visual cryptography model proposed in is to split a secret image into two random shares (printed on transparencies) which separately reveals no information about the secret image other than the size of the secret image. The secret image can be reconstructed by stacking the two shares. The underlying operation of this scheme is logical operation OR. VCS has many special applications, for example, transmitting military orders to soldiers who may have no cryptographic knowledge or computation devices in the battle field. Many other applications of VCS, other than its original objective(i.e., sharing secret image), have been found, for example, authentication and identification, watermarking and transmitting passwords etc.,
Let us go through the practical example:
The figure shown below shows generation and dissolving that image Captcha into two shares using (2, 2) VCS. Image also shows reconstructed image Captcha from the shares. As we can see, Share1 and share2 are shares of Image Captcha and Reconstructed Image Captcha is also shown in the Figure
Figure 1.4 Shares Generation
In the next sections we’ll discuss about Literature Survey, Implementation, Results, Conclusion and Future Scope.
1.5 Alternatives to Password Authentication
The numerous ways in which permanent or semi-permanent passwords can be compromised has prompted the development of other techniques. Unfortunately, some are inadequate in practice, and in any case few have become universally available for users seeking a more secure alternative.
‘ Single-use passwords are only valid once makes many potential attacks ineffective. Most users find single use passwords extremely inconvenient. They have, however, been widely implemented in personal online banking, where they are known as Transaction Authentication Numbers (TANs). As most home users only perform a small number of transactions each week, the single use issue has not led to intolerable customer dissatisfaction in this case.
‘ Time-synchronized one-time passwords are similar in some ways to single-use passwords, but the value to be entered is displayed on a small (generally pocketable) item and changes every minute or so.
‘ Pass Window one-time passwords are used as single-use passwords, but the dynamic characters to be entered are visible only when a user superimposes a unique printed visual key over a server generated challenge image shown on the user’s screen.
‘ Access controls based on public key cryptography e.g. SSH. The necessary keys are usually too large to memorize and must be stored on a local computer, security token or portable memory device, such as a USB flash drive or even floppy disk.
‘ Biometric methods promise authentication based on unalterable personal characteristics, but currently (2008) have high error rates and require additional hardware to scan, for example, fingerprints, irises, etc. They have proven easy to spoof in some famous incidents testing commercially available systems, for example, the gummie fingerprint spoof demonstration [12] and because these characteristics are unalterable, they cannot be changed if compromised; this is a highly important consideration in access control as a compromised access token is necessarily insecure.
‘ Single sign-on technology is claimed to eliminate the need for having multiple passwords. Such schemes do not relieve user and administrators from choosing reasonable single passwords, nor system designers or administrators from ensuring that private access control information passed among systems enabling single sign-on is secure against attack. As yet, no satisfactory standard has been developed.
‘ Non-text-based passwords, such as graphical passwords or mouse-movement based passwords [13]. Graphical passwords are an alternative means of authentication for log-in intended to be used in place of conventional password; they use images, graphics or colors instead of letters, digits or special characters. One system requires users to select a series of faces as a password, utilizing the human brain’s ability to recall faces easily [14]. In some implementations the user is required to pick from a series of images in the correct sequence in order to gain access [15]. Another graphical password solution creates a one-time password using a randomly-generated grid of images. Each time the user is required to authenticate, they look for the images that fit their pre-chosen categories and enter the randomly-generated alphanumeric character that appears in the image to form the one-time password [16, 17] .So far, graphical passwords are promising, but are not widely used. Studies on this subject have been made to determine its usability in the real world. While some believe that graphical passwords would be harder to crack, others suggest that people will be just as likely to pick common images or sequences as they are to pick common passwords.
‘ 2D Key (Two-Dimensional Key) is a 2D matrix-like key input method having the key styles of multiline passphrase, crossword, ASCII/Unicode art, with optional textual semantic noises, to create big password/key beyond 128 bits to realize the MePKC (Memorizable Public-Key Cryptography) using fully memorizable private key upon the current private key management technologies like encrypted private key, split private key, and roaming private key.
‘ Cognitive passwords use question and answer cue/response pairs to verify identity.
1.6 Problems Suited to a Neural Network:
Although there are many problems that neural networks are not suited for there are also many problems that a neural network is quite useful for solving. In addition, neural networks can often solve problems with fewer lines of code than a traditional programming algorithm. It is important to understand what these problems are. Neural networks are particularly useful for solving problems that cannot be expressed as a series of steps, such as recognizing patterns, classifying into groups, series prediction and data mining.
1.6.1 Validating Neural Networks:
Once a neural network has been trained it must be evaluated to see if it is ready for actual use. This final step is important so that it can be determined if additional training is required. To correctly validate a neural network, validation data must be set aside that is completely separate from the training data.
As an example, consider a classification network that must group elements into three different classification groups. We are provided with 10,000 sample elements. For this sample data the group that each element should be classified into is known. For such a system we would divide the sample data into two groups of 5,000 elements. The first group would form the training set. Once the network was properly trained the second group of 5,000 elements would be used to validate the neural network.
It is very important that a separate group always be maintained for validation. First training a neural network with a given sample set and also using this same set to predict the anticipated error of the neural network a new arbitrary set, will surely lead to bad results. The error achieved using the training set will almost always be substantially lower than the error on a new set of sample data. The integrity of the validation data must always be maintained.
This brings up an important question. What exactly does happen if the neural network that we have just finished training performs poorly on the validation set? If this is the case, then we must examine what, exactly, this means. It could mean that the initial random weights were not good. Rerunning the training with new initial weights could correct this. While an improper set of initial random weights could be the cause, a more likely possibility is that the training data was not properly chosen.
If the validation is performing badly this most likely means that there was data present in the validation set that was not available in the training data. The way that this situation should be solved is by trying a different, more random, way of separating the data into training and validation sets. If this fails, we must combine the training and validation sets into one large training set. Then new data must be acquired to serve as the validation data [18].
For some situations it may be impossible to gather additional data to use as either training or validation data. If this is the case then we are left with no other choice but to combine all or part of the validation set with the training set. While this approach will forgo the security of a good validation, if additional data cannot be acquired this may be our only alternative.
1.7 Phishing
Phishing is an act of attempting to acquire sensitive information of a person by masquerading as a trust worthy entity in electronic transaction. Phishing is typically carried out by e-mail spoofing or instant messaging. Phishing e-mails contain links to websites infected with malware
List of Phishing Techniques:
There are three types of phishing attacks. They are listed below.
Spear phishing
Phishing attempts directed at specific individuals or companies have been termed as spear phishing.
Clone phishing
This is a type of phishing attack where a legitimate, and previously delivered, email containing an attachment or link has had its content and recipient’s address is taken and used to create an almost identical or cloned email. The attachment or Link within the email is replaced with a malicious version and then sent from an email address spoofed to appear to come from the original sender. It may claim to be a re-send of the original or an updated version to the original.
Whaling
Several recent phishing attacks have been directed specifically at senior executives and other high profile targets within businesses, and the term whaling has been coined for these kinds of attacks.
Working of Phishing
Phishing is generally carried out through e-mail spoofing. Here, attacker sends a mail to the person whose details he wants to track. In the mail attacker hides his true identity and generally he sends a link which appears similar to the genuine website like bank website etc.., Here, attacker adds some message to mislead the user. For e.g., In the mail attacker may send a message saying ‘We are updating our database so we request you to click the following link and update your data in our site.’ Innocent users think it is true and they login to the site providing their credentials and thus falling prey for Phishing attack.