The most common computer authentication method is to use alphanumerical usernames and passwords. This method has been shown to have significant drawbacks. For example, users tend to pick passwords that can be easily guessed. On the other hand, if a password is hard to guess, then it is often hard to remember. To address this problem, some researchers have developed authentication methods that use pictures as passwords. In this paper, I conduct a comprehensive survey of the existing graphical password techniques. I classify these techniques into two categories: recognition-based and recall-based approaches. I discuss the strengths and limitations of each method and point out the future research directions in this area. I also developed three new techniques against the common problem exists in the present graphical password techniques. In this thesis, the scheme of each new technique will be proposed; the advantages of each technique will be discussed; and the future work will be anticipated.

Security issues have become a key problem with most e-commerce platforms these days and information sent over the internet needs to be protected. When operating an e-commerce platform such as studentdevelop.com financial transactions are involved. Data communication is very vital to e-commerce and needs to be processed securely. This thesis shall investigate Secure Socket Layer (SSL) as a possible solution to provide added security such as data integrity and confidentiality on the StudentDevelop.com web portal. This thesis shall also compare other known security suites available for use which could suit the StudentDevelop.com web platform. A vivid comparison shall be carried out to evaluate SSL and Pretty Good Privacy (PGP) with the aim of testing the preferred choice to provide encryption and data confidentiality on the StudentDevelop.com platform. Protocols like SSL make up the next layers of mechanisms that support applications with electronic payment schemes. Cryptography being an essential security technology involving the encryption algorithm and digital signatures can provide the basic building blocks. SSL shall be tested on the StudentDevelop.com platform by installing a self-signed certificate, including a test of a digital certificate obtained from a certificate authority. In SSL, the web browser is the client and the web-site server is the server. As a result to authenticate consumers on e-commerce platform such as studentdevelop.com, SSL increased the security for web transactions by using public-key encryption and digital certificate to achieve authentication. Encryption algorithm and digital signatures provided the basic building blocks, while SSL protocol made up the next layer of mechanisms that in return support the application layer. In the fourth coming sub chapters, we will look in to the problem description of this thesis and the investigation of security solutions for studentdevelop.com.

Wireless Internet has become increasingly popular due to anywhere anytime access feature. The Internet architecture was designed underlying the existing of the end-to-end path connection. The promise of wireless Internet networks is to provide roaming users connectivity anywhere anytime. However, quality of service (QoS) is still an open issue in wireless networks, which are characterized by possible intermittent connectivity and large transmission delays, due to user mobility, sparse mobile node distribution, link failures (because of hostile propagation medium), and/or other high-priority traffc. In this thesis, a credit-based user authentication scheme is proposed for delay tolerant mobile wireless networks. The proposed authentication scheme isolates the uncertain network condition in the high delay wireless backhaul with high error rate, and accelerates the overall authentication process when the mobile terminal roams in the visited network. Furthermore, an analytical study of overall network performance is presented for the authentication scheme in terms of authentication cost and delay. Simulation results demonstrate that the proposed credit-based authentication scheme reduces the overall real time transaction cost and delay for delay tolerant mobile wireless networks.

User Authentication is the process of establishing confidence in the User identities presented to an information system. This thesis establishes a method of assigning a confidence level to the output of a user authentication process based on what attacks and threats it is vulnerable to. Additionally, this thesis describes the results of an analysis where the method was performed on several different authentication systems and the confidence level in the authentication process of these systems determined. Final conclusions found that most systems lack confidence in their ability to authenticate users as the systems were unable to operate in the face of compromised authenticating information. Final recommendations were to improve on this inadequacy, and thus improve the confidence in the output of the authentication process, through the verification of both static and dynamic attributes of authenticating information. A system that operates confidently in the face of compromised authenticating information that utilizes voice verification is described demonstrating the ability of an authentication system to have complete confidence in its ability to authenticate a user through submitted data.

<p>Denial-of-Service (DoS) flooding attacks have become a serious threat to the reliability of the Internet. For instance, a report published by Arbor Networks reveals that the largest DoS flooding attack observed in 2010 reaches 100Gbps in attack traffic volume. The defense against DoS flooding attacks is significantly complicated by the fact that the Internet lacks accountability at the network layer: it is very difficult, if not impossible, for the receiver of an IP packet to associate the packet with its real sender, as the sender is free to craft any part of the packet.</p><p>This dissertation proposes to mitigate DoS flooding attacks with a two-step process: first to establish accountability at the network layer, and second to utilize the accountability to efficiently and scalably mitigate the attacks. It proposes Passport, a source authentication system that enables any router forwarding a packet to cryptographically verify the source Autonomous System (AS) of the packet. Passport uses symmetric key cryptography to enable high-speed verification and piggy-backs its key exchange into the inter-domain routing system for efficiency and independence from non-routing infrastructures.</p><p>On top of Passport, this dissertation proposes NetFence, a DoS flooding attack mitigation system that provides two levels of protection against the attacks: if a victim can receive and identify the attack traffic, it can throttle the attack traffic close to the attack sources; otherwise, the attack traffic cannot be eliminated, but it would not be able to consume more than the attack sources' fair shares of the capacity of any bottleneck link. NetFence achieves its goals by putting unforgeable congestion policing feedback into each packet. The feedback allows bottleneck routers to convey congestion information back to the access routers that police the traffic accordingly. A destination host can throttle unwanted traffic by not returning the feedback to the source host.</p><p>We have implemented prototypes of Passport and NetFence in both ns-2 simulator and Linux. We have also implement a prototype of Passport on a NetFPGA board. Our evaluation of the prototypes as well as our security and theoretical analysis demonstrate that both Passport and NetFence are practical for high-speed router implementation and could mitigate a wider range of attacks in a more scalable way compared to previous work.</p> / Dissertation

Wireless networks are becoming more and more popular. In current wireless network environments, mobile users can use multiple wireless network interfaces built in their mobile devices to roam around the mobile networks. They can scan the wireless spectrums and utilize the network resources extremely, and they can roam into nearby wireless networks due to the mobility capabilities of the powerful mobile devices. Before connecting to an access point, an authentication process is necessary. There are many interactive wireless authentication protocols which have been proposed in the literature. Under the wireless networks, handover is an important property for a mobile user to change her/his position. However, the existing interactive wireless authentication protocols may cause unstable connection. This is because that a mobile user may perform failed authentications with some nearby invalid access points and thus she/he cannot finish handover in time. Hence, we would like to design a mechanism for a mobile user to determine the validity of access points before the interactive authentication, and the mobile user can choose a valid one when making handover. In our proposed scheme, the mobile user can just scan and receive authentication messages from access points without interactions with them while she/he can determine which one of them is valid. We call this cognitive authentication. Besides, we also propose cooperative defense which allows mobile users to exchange their received authentication messages for detecting illegal access points. Finally, we provide security proofs for our proposed scheme.

In the traditional login systems, we use the username and the password to identify the legalities of users. It is a simple and convenient way to identify, but passwords could be stolen or copied by someone who tries to invade the system illegally. Adding one protective mechanism to identify users, the way of biometrics are brought out, such as keystroke dynamics, fingerprints, DNA, retinas and so on that are unique characteristics of each individuals, it could be more effective in preventing trespassing. This thesis uses keystroke biometrics as research aspects of user authentication. The advantages of this system are low-cost and high security to identify users using keyboard to calculate the time of keystrokes. In this thesis, we use statistical way to examine the researches and experiments. Chosen length of the username and password are greater than or equal to 9 characters, and learning sample sizes are 20 and adapting the sample adaptation mechanism, the results show that we achieved by False Acceptance Rate of 0.85%, False Rejection Rate of 1.51% and Average False Rate of 1.18%; all reach the high levels of safeties.

In the environment of wireless sensor network, while one node want to send a message to another node, the most natural way is used broadcasting to distribute the message to the whole network. In the other words, as long as one node sends messages to the other node, its neighbor nodes can also listen to these messages, and then receive them. The advantage of broadcast networks is that can efficiently distribute data to multiple receivers. However, it has some drawbacks. A sensor network may be deployed in hostile environment where there are malicious attacks. The malicious attacker can send false messages to his neighbor nodes, and then rely on these neighbor nodes to distribute over the network. So if there are not any schemes of the security authentication in the message when a node wants to use broadcast, everyone can impersonate the sender and broadcast false messages. We call this a packet injection attack. So security is a main challenge in broadcast network. In order to authenticate a broadcast message¡Ait would conform to two conditions. First, insure that the data is transmitted from the claimed source. Second, the messages are not be modified en route. TESLA has been proposed to provide such services for sensor networks¡Ait mainly use time synchronization and delay disclosure key to protect encryption key¡CHowever, this scheme still has some drawbacks, so we propose some schemes to modify TESLA in this paper, and we will show these schemes can achieve better performance than previous ones.

In login systems, a user is asked to enter his correct account and password in order to be allowed to enter to the system. The safety of systems is at the risk of leaking out the information, hence, the single mechanism of identity verification has not filled the bill at present. We study the personal typing behavior to get one¡¦s own specific features. In our thesis , we compare three methods and anlysis the advantages and shortcomings of those three. First one is to sort the twenty study data, and distribute the weights into the proper region. If the total weights is less than the threshold then this test data will be accepted, otherwise, it will be rejected. The second and third method are similar. Both of them are trying to rescale the data. The spirit of them is that the typing rate of a person will be faster when they type frequently and will be sloer when they are out of practice. However the relative positions of those keys, the lengths of ons¡¦s fingers, and the time that people making pauses in reading unpunctuated are unique. Those factors can be one¡¦s typing rhythm. There are twenty two individuals involved in this experiment. Each one choose his own proficient account and password to type and set up his typing model. The imposters are randomly choose legal user to imitate.

Wimax (Worldwide Interoperability for Microwave Access) is a standard of wireless metropolitan area networks (WMAN), designed by IEEE 802.16 standards group. The coverage of Wimax is wide, so it is suited for developing in large networks and provides more steady, high-speed, and secure data transmission for fixed and mobile subscribers. As the result, Wimax is designed for solving last mile problem because of the bandwidth is limit and the expensive building cost in the traditional networks. IEEE 802.16 (Wimax) defines two modes of data communication topology: PMP (Point-to-multipoint) mode and Mesh mode. In Mesh mode, the data can route through another subscriber station (SS), so it not only improves coverage range but also raises the throughput. Although IEEE 802.16 defined a secure sub layer in the MAC (Media Access Control) layer to provide privacy by encrypting connections between base station (BS) and subscriber station (SS), but it still face many security problems. In the mesh mode, it is not like PMP mode that the traffic is only between BS and SS, the traffic sometime will pass through another SS, for this reason, it is prone to bring many problems, such as shared secret key exposing, man-in-the-middle attack, eavesdropping threat¡Ketc. On the relay node (we termed sponsor node here), it also involved more unnecessary loads of encryption and decryption. In this thesis, we focus on the MAC layer , and we propose some schemes to modify the present of PKM and the traffic encryption key used for transmitting data, and we will show that these schemes can achieve better security than previous ones, also achieve efficient in data transmission.