Author : D.Siva Santosh Kumar 1
Date of Publication :16th November 2017
Abstract: In Distributed environment authentication and key-exchange mechanisms plays a major role. Generally in authentication a client and server agree upon a cryptographic key which is mutually exchanged. Earlier passwords were stored in a single server where if an intruder gains access of that server by some malicious attacks then all the passwords stored in the database are to be compromised and therefore the e-commerce application security is endangered. In-order to improve the efficiency and performance of the authentication mechanisms we involve multiple servers to store the passwords and participate in key-exchange and authentication process so as to ensure that even a single server is compromised the whole system’s security is not in threat and also generating a nonce values randomly for every session corresponds to a two level security mechanism where the scope of an attacker to pretend as the legitimate user and login into the system is completely restricted. In this model the passwords are stored in their equivalent hash values and they are spitted into multiple servers. Making it even more difficult for the attacker to determine the password even by reverse engineering he cannot intercept the actual password form segments of hash value. Hence, we can present this model as safe and secure password based authentication scheme using key exchange mechanism.
Reference :
-
- Diffie, W.; Hellman, M. (1976). "New directionsin cryptography" (PDF). IEEE Transactions on Information Theory. 22 (6): 644–654. doi:10.1109/TIT.1976.1055638
- J. Katz, R. Ostrovsky, and M. Yung, “Efficient PasswordAuthenticated Key Exchange Using HumanMemorable Passwords,” Proc. Int‟l Conf. Theory and Application of Cryptographic Techniques: Advances in Cryptology (Eurocrypt ‟01), pp. 457-494, 2001.
- Katz, P. MacKenzie, G. Taban, and V. Gligor, “TwoServer Password-Only Authenticated Key Exchange,” Proc. Applied Cryptography and Network Security (ACNS ‟05), pp. 1-16, 2005
- Y. Yang, R.H. Deng, and F. Bao, “A Practical Password-Based Two-Server Authentication and key Exchange System,” IEEE Trans. Dependable and Secure Computing, vol. 3, no. 2, pp. 105-114, Apr.-June 2006.
- D. Jablon, “Password Authentication Using Multiple Servers,” Proc. Conf. Topics in Cryptology: The Cryptographer‟s Track at RSA (RSA-CT ‟01), pp. 344-360, 2001.
- Kalyani, D., and R. Sridevi. "Survey on identity based and hierarchical identity based encryption schemes." International Journal of Computer Applications134.14(2016).
- Robust distributed key issuing protocol for identity based cryptography D Kalyani, R Sridevi … Informatics (ICACCI), 2016