The Experts below are selected from a list of 8499 Experts worldwide ranked by ideXlab platform

Chuck Mortimore - One of the best experts on this subject based on the ideXlab platform.

Nick Feamster - One of the best experts on this subject based on the ideXlab platform.

  • dos and don ts of Client Authentication on the web
    USENIX Security Symposium, 2001
    Co-Authors: Emil Sit, Kendra Smith, Nick Feamster
    Abstract:

    Client Authentication has been a continuous source of problems on the Web. Although many well-studied techniques exist for Authentication, Web sites continue to use extremely weak Authentication schemes, especially in non-enterprise environments such as store fronts. These weaknesses often result from careless use of authenticators within Web cookies. Of the twenty-seven sites we investigated, we weakened the Client Authentication on two systems, gained unauthorized access on eight, and extracted the secret key used to mint authenticators from one. We provide a description of the limitations, requirements, and security models specific to Web Client Authentication. This includes the introduction of the interrogative adversary, a surprisingly powerful adversary that can adaptively query a Web site. We propose a set of hints for designing a secure Client Authentication scheme. Using these hints, we present the design and analysis of a simple Authentication scheme secure against forgeries by the interrogative adversary. In conjunction with SSL, our scheme is secure against forgeries by the active adversary.

A D Rubin - One of the best experts on this subject based on the ideXlab platform.

  • secure remote access to an internet web server
    IEEE Network, 1999
    Co-Authors: C Gilmore, D Kormann, A D Rubin
    Abstract:

    We address the problem of secure remote access to a site's internal Web server from outside the firewall. The goal is to give authorized users access to sensitive information, while protecting the information from others. We implemented our solution using a one-time password scheme for Client Authentication and secure socket layer (SSL) for confidentiality. Our main design considerations were security, performance, ease of use, availability, and scale. We were further constrained by the desire to leave our firewall and local infrastructure unchanged.

Jiashu Zhang - One of the best experts on this subject based on the ideXlab platform.

  • improving the security of a flexible biometrics remote user Authentication scheme
    Computer Standards & Interfaces, 2007
    Co-Authors: Muhammad Khurram Khan, Jiashu Zhang
    Abstract:

    Recently, Lin-Lai proposed 'a flexible biometrics remote user Authentication scheme,' which is based on El Gamal's cryptosystem and fingerprint verification, and does not need to maintain verification tables on the server. They claimed that their scheme is secured from attacks and suitable for high security applications; however, we point out that their scheme is vulnerable and can easily be cryptanalyzed. We demonstrate that their scheme performs only unilateral Authentication (only Client Authentication) and there is no mutual Authentication between user and remote system, thus their scheme is susceptible to the server spoofing attack. To fill this security gap, we present an improvement which overcomes the weakness of Lin-Lai's scheme. As a result, our improved security patch establishes trust between Client and remote system in the form of mutual Authentication. Moreover, some standards for biometric-based Authentication are also discussed, which should be followed during the development of biometric systems.

  • an efficient and practical fingerprint based remote user Authentication scheme with smart cards
    Lecture Notes in Computer Science, 2006
    Co-Authors: Muhammad Khurram Khan, Jiashu Zhang
    Abstract:

    , Recently, Lee et al. proposed a fingerprint-based remote user Authentication scheme using smart cards. We demonstrate that their scheme is vulnerable and susceptible to the attack and has some practical pitfalls. Their scheme performs only unilateral Authentication (only Client Authentication) and there is no mutual Authentication between user and remote system, so their scheme suscepts from the server spoofing attack. Furthermore, in their scheme, remote system generates and assigns the passwords, and users cannot choose and change their passwords. Moreover, passwords are long pseudorandom numbers and difficult to remember for a user. To solve these problems, we propose an efficient and practical fingerprint-based remote user Authentication scheme using smart cards, which is based on one-way collision free hash functions. Proposed scheme not only overcomes all the drawbacks and problems of Lee et al.'s scheme, but also provides a secure and user-friendly fingerprint-based remote user Authentication over insecure network. In addition, computational costs and efficiency of the proposed scheme are better than Lee et al.'s scheme.

Michael Jones - One of the best experts on this subject based on the ideXlab platform.