Mobile device authentication has been a highly active research topic for over 10 years, with a vast range of methods having been proposed and analyzed. In related areas such as secure channel protocols, remote authentication, or desktop user authentication, strong, systematic, and increasingly formal threat models have already been established and are used to qualitatively and quantitatively compare different methods. Unfortunately, the analysis of mobile device authentication is often based on weak adversary models, suggesting overly optimistic results on their respective security. In this article, we first introduce a new classification of adversaries to better analyze and compare mobile device authentication methods. We then apply this classification to a systematic literature survey. The survey shows that security is still an afterthought and that most proposed protocols lack a comprehensive security analysis. Our proposed classification of adversaries provides a strong uniform adversary model that can offer a comparable and transparent classification of security properties in mobile device authentication methods.

Adversary Models for Mobile Device Authentication

Powerful cryptographic systems based on mathematically hard problems are utilized to ensure tighter security for data communication purposes. However, these traditional cryptographic systems are bound to fail in the ensuing era of quantum computing. Thus, Artificial Intelligence (AI) inspired security methods are needed to secure communications in the era of quantum computing. This article presents a challenge-response password-based authentication system based on the Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) AI hard problem. In this system, a server sends a challenge text to a client, then the client generates a random image and blends the challenge text inside this random image using his password. Then the client sends the generated image to the server. The server extracts the challenge text from the sent image using his copy of the client's password. If the extracted challenge text is the same as the sent challenge text, then both the client's and the server's copies of the password match and the client is authenticated. The efficiency of the proposed system is analyzed and the outcomes prove that the proposed system is efficient in terms of time and space. Also, a security investigation of the proposed system is employed, and the results prove that the system is probabilistic and very sensitive to changes in its parameters. It does not leak any statistical information about the client's password and the generated images cannot be distinguished from random images. In addition, the security of the proposed system is analyzed against two possible attacks; the brute force attack and the replay attack and the results prove that the proposed system is immune to these attacks. Finally, the proposed system is ensured to be indistinguishably secure against an adaptive chosen-challenge text attack (IND-ACCTA), based on the CAPTCHA AI hard problem when the hash function H is modeled as a random oracle.

/pdf/a-password-based-authentication-system-based-on-the-captcha-3q571ei7pm.pdf

A Password-Based Authentication System Based on the CAPTCHA AI Problem

Today, it is difficult to find an adequate Web site with a registration form that is not protected with some automated human proof test. One of the oldest concepts in Artificial Intelligence as a security mechanism based on the Turing Test is CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart). This test was designed to make a difference between the real users and bots and provide security against malicious attacks. The PROMETHEE-GAIA method was employed for ranking different image-based CAPTCHAs according to their usability in this paper. The aim of this study is a comparative analysis of seven image-based CAPTCHAs based on three different criteria: time to find a solution, a number of attempts, and task difficulty. The weights of the considered criteria were calculated objectively by the entropy method, and for the subjective weights, Analytical Hierarchy Process (AHP) was used. A defined research model was applied through four phases. The survey included 320 randomly selected Internet users and experts in computer science who were familiar with CAPTCHA tests. The proposed model suggested which CAPTCHA offered better human accuracy and lower machine attack rates compared to the existing approaches. The obtained results were very helpful to the web administrators because they indicated that this approach could provide useful insights for the decision-makers about the appropriate mechanisms to protect users against cyber-criminal activities and Internet threats.

An investigation of the usability of image-based CAPTCHAs using PROMETHEE-GAIA method

Nowadays, lots of applications and websites utilize text-based captchas to partially protect the authentication mechanism. However, in recent years, different ways have been exploited to automatically recognize text-based captchas especially deep learning-based ways, such as, convolutional neural network (CNN). Thus, we have to enhance the text captchas design. In this paper, using the features of the randomness for each encoding process in visual cryptography (VC) and the visual recognizability with naked human eyes, VC is applied to design and enhance text-based captcha. Experimental results using two typical deep learning-based attack models indicate the effectiveness of the designed method. By using our designed VC-enhanced text-based captcha (VCETC), the recognition rate is in some degree decreased.

Applying Visual Cryptography to Enhance Text Captchas

A cloud endpoint coordinating CAPTCHA based on multi-view stacking ensemble

Is Image-based CAPTCHA Secure Against Attacks Based on Machine Learning? An Experimental Study

This study aims at investigating the functions of the informal Arabic discourse marker “بعدين” /bʕdɪn/. By figuring out these functions and highlighting the common used ones, this paper tries to help communicators to be aware of those functions in their communication and avoid any possibility of misunderstanding. “Twitter” was the main tool of collecting the data of this study. This social medium provided natural communication contexts that significantly assisted the analysis of this study. The dataset consisted of one hundred and five tweets containing /bʕdɪn/. Those tweets reflected texts written by native Arabic speakers from different nationalities. The analysis was guided by the relevance theory and the methodology of related literature. The findings of the study showed that /bʕdɪn/ has semantic meanings similar to the English adverbs “then” and “later.” It was used semantically as a temporal adverb putting actions in sequence or delaying a move to unspecified time in the future. /bʕdɪn/ was also used as a coherence marker supporting the value of the communicative situations. In this respect and based on the collected data, seven pragmatic functions were elicited in this study for /bʕdɪn/. Those functions were: a marker of orientation shift, a marker of result, a conditional marker, a marker of disagreement, a coordination marker meaning “but,” a marker of agreement and a marker of reason. 

Fatmah H. Alqahtani

Papers

Is Image-based CAPTCHA Secure Against Attacks Based on Machine Learning? An Experimental Study

The Semantic and Pragmatic Functions of /bʕdɪn/ “بعدين” in Informal Arabic