3.0 Security Overview on Personal Devices
Several major security issues loom over the use of such devices, including [2]:(a) Mobile devices are often stolen or missing, due to their small sizes;(b) The contents in the mobile devices are unencrypted or encrypted under a flawed protocol;(c) Mobile devices are proned to middle-man attack or viruses attack from wireless connection;(d) User authentication is weak or disabled or in a common default mode, the authentication mechanism
–
single static password authentication can be circumvented easily;To overcome the security problems mentioned above, computer locks or laptop locks are general solution for betterguardian of such devices physically. In order to enhance the security in data transmission, data encryption andhashing with complicated algorithms are practiced. The Advanced Encryption Standard (AES) announced by NationalInstitute of Standards and Technology (NIST), which has a fixed block size of 128 bits and a key size of 128, 192 or256 bits, is one of the most popular algorithms used in symmetric key cryptography [3]. Hashing, the transformationof a string of characters into a usually shorter fixed-length value or key that represents the original string, is used toencrypt and decrypt digital signatures, and further authenticate message senders and receivers. The digital signatureis transformed with the hash function and then both the hashed value (known as a message-digest) and the signatureare sent in separate transmissions to the receiver. Using the same hash function as the sender, the receiver derivesa message-digest from the signature and compares with the message-digest it also received and returns the samemessage as original [4]. In this way, middle-man attack can be avoided.As for user authentication issue, biometric authentication has already introduced and implemented in desktop, laptop,tablet, mini notebook, Ultra Mobile Personal Computer (UMPC) or PDA. The Fujitsu U810 is a mini notebook thatpromoting biometric authentication for better security, with its integrated AuthenTec fingerprint scanner andembedded TPM [5]. The Sony VAIO VGN-UX390N is an example of UMPC embedded with a fingerprint scanner [6].Hence, same as mobile phones, biometric authentication offers higher security when comparing with conventionalpassword authentication.
4.0 Authentication Security: Types of Authenticators
There are three means of authenticating a user’s ident
ity, which can be used alone or in combination:(a) Something the individual knows (a secret
–
e.g., a password, Personal Identification Number (PIN), orcryptographic key);(b) Something the individual possesses (a token
–
e.g., an ATM card or a smart card);(c) Something the individual is (a biometric
–
e.g., such characteristics as a voice pattern, handwritingdynamics, or a fingerprint).Table 1: Types of authenticators and attributes
Authenticator
Knowledge-Based Object-Based ID-Based
Commonly Referred to as
Password, Secret Token Biometric
Support Authentication by
Secrecy or obscurity Possession Uniqueness andpersonalization
Security Defense
Closely kept Closely held Forge-resistant
Traditional Method
Combination lock Metal key
Driver’s license
Digital Method
Computer password Key-less car entry Fingerprint
Security Drawback
Less secret with each use Insecure if lost Difficult to replace
5.0 User Authentication on Mobile Phones5.1 PIN Authentication
The traditional method of securing a mobile phone is by using PIN as password authentication. Theconcept of single static passwords is widely employed globally. One major benefit of single staticpassword is easy to remember. However in the sense of security, single static password is insufficientas it can be h
acked. According to O’Gorman [7
], authentication systems based on passwords andtokens can be attacked by:(a) Client attack: By guessing passwords or stealing tokens;(b) Host attack: By accessing plain text file containing password;(c)
Eavesdropping: By “shoulder surfing” for passwords;
(d) Repudiation: By claiming that token was misplaced;(e) Trojan horse attack: By installing bogus log-in screen to steal passwords;(f) Denial of service: By disabling the system by deliberately supplying an incorrect passwordseveral times
Proceeding of the 3rd International Conference on Informatics and Technology, 2009
©Informatics '09, UM 2009
RDT6 -
231
Leave a Comment