Abstract One Time Passwords (OTP) are being widely used for authentication of user to access a number of services offered online. The security vulnerabilities in classical execution of OTP schemes are addressed using Quantum OTP (QOTP) scheme with user biometrics. This scheme requires sharing of user biometric data with every service provider. The chances of leakage of user biometrics increase with increase in number of entities holding the data. Further, loss of data by any entity compromises user identity for all other services. The work carried out in this article addresses the above‐mentioned challenges by incorporating a trusted third party which holds user biometric data and carries out authentication on its behalf. The proposed model continues leveraging upon inherent security benefits provided by Quantum Entanglement and Quantum Communication and utilizing user biometrics as authentication data. It modifies the QOTP scheme by carrying out mutual authentication for user and server against a particular transaction. The proposed model brings in the advantages of Single Sign On facility in terms of hardware to reduce infrastructure cost and No Secret Sharing of user biometric data with the servers to protect against rogue servers. The security analysis demonstrates the merit of the inherent procedures of the proposed work which leverage on the no‐cloning and quantum cryptography principles.
Abstract One Time Passwords (OTP) are being widely used for authentication of user to access a number of services offered online. The security vulnerabilities in classical execution of OTP schemes are addressed using Quantum OTP (QOTP) scheme with user biometrics. This scheme requires sharing of user biometric data with every service provider. The chances of leakage of user biometrics increase with increase in number of entities holding the data. Further, loss of data by any entity compromises user identity for all other services. The work carried out in this article addresses the above‐mentioned challenges by incorporating a trusted third party which holds user biometric data and carries out authentication on its behalf. The proposed model continues leveraging upon inherent security benefits provided by Quantum Entanglement and Quantum Communication and utilizing user biometrics as authentication data. It modifies the QOTP scheme by carrying out mutual authentication for user and server against a particular transaction. The proposed model brings in the advantages of Single Sign On facility in terms of hardware to reduce infrastructure cost and No Secret Sharing of user biometric data with the servers to protect against rogue servers. The security analysis demonstrates the merit of the inherent procedures of the proposed work which leverage on the no‐cloning and quantum cryptography principles.
Abstract Two‐way authentication methods are utilized in every online user authentication transactions. Use of one time passwords (OTP) have proved to be more secure method, than one factor authentication when the two authentication schemes are carried out on different media. However, current use of OTP restricts authentication to the device itself rather than the user. The fraud cases with OTP based transactions have also increased due to growth of technology. Hence, there is a requirement of enhancing security of OTP based transactions. The study in this paper anchors on mathematically proven properties of quantum cryptography and utilizes the quantum entanglement property to generate quantum OTP (QOTP) for authenticating the user based on its biometrics. The proposed method takes into consideration various quantum computing capabilities of user, thus paving path for gradual upgradation of infrastructure. The work in the paper gives the outline of infrastructure required for implementing the proposed model and concludes by comparing security analysis of existing and proposed model against man‐in‐the‐middle attack (MITM) and user end vulnerabilities to bring forth the importance of QOTP. The practical implementation of the proposed model is envisaged as future research work due to evolving nature of quantum experiments.
Abstract Authentication of the entity is the initial step toward secure transaction over the internet. The evolution in the nature and types of attacks have forced the commerce industry to move from single factor to multi‐factor authentication technique largely employing biometric codes for human based entity. These biometric codes are unique and therefore, are synonymous to a user identity in the digital world. Hence, safeguarding the Biometric data becomes important for the user. Also, the classical authentication techniques relying on public key encryption schemes are no longer considered safe in the post quantum era. The research in this paper therefore, proposes a quantum based mutual authentication user‐server protocol which employs the principles of quantum mechanics to carry out secure exchange and storage of confidential data. The mathematical formulae validated through demonstration of properties of quantum mechanics verifies the ability of the protocol to work in compromised channel. The detailed security analysis carried out further quantifies the same and builds in confidence to adopt the quantum based mutual authentication protocol for critical user‐server data exchange.
A significant problem facing cybersecurity is that most client/server identity authentication schemes depend on computational complexity which is recently challenged by the super exponential computational abilities of quantum computers. Quantum cryptography with its quantum mechanics principles solves this problem and provides mathematically un-hackable secure communication for the quantum computers epoch. Biometric authentication has a big challenge related to its protection as it has to be submitted and stored in encrypted form. Unfortunately, most existing biometric cryptosystems rely on classical cryptography, so they are insecure in quantum era. This problem is solved in this paper by introducing a novel three-factor biometric quantum identity authentication scheme combining something you know (password), something you produce (client’s voice), and something you are (client’s face image) is proposed. The scheme consists of two phases: client enrollment and client login/authentication. The methodology is to use in the enrollment phase, two layers of quantum encryption for the client’s voice signal. Each layer consists of two simple quantum circuits of SWAP and C-NOT quantum gates respectively using a different pseudorandom key obtained from a cellular automata (CA) pseudorandom generator. The proposed scheme has many merits. Firstly, it introduces a new design of muti-factors quantum biometric authentication scheme as the biometric voice data is processed, transmitted, and stored at the server database in an encrypted unconditionally secure quantum form which provides parallel processing, real-time communications, inherent level of security against attacks, tamper-proof security and exponential powerful storage capability due to the quantum properties. Secondly, the proposed scheme achieves double-layers security by combing quantum voice encryption and quantum secure direct communication in one process such that the quantum channel eavesdropper cannot obtain any valuable information in case of information leakage. Thirdly, the distribution and management of encryption key problem is solved as there is no need for key exchange prior to communication. Fourthly, it achieves high communication efficiency as although it is a three-factor biometric identity authentication, only one biometric data is sent in quantum encrypted form to the server. Fifthly, the numerical simulations showed that the proposed scheme has large key space, high key sensitivity and more robust performance against different types of attacks compared to other existing classical and quantum voice encryption schemes. Finally, as an identity authentication method, the proposed scheme achieves identification accuracy of 100% with zero False Rejection Rate (FRR) and zero False acceptance rate (FAR) which is perfect.
Problem statement: Traditional user authentication system uses passwords for their secured accessibility in a central server, which is prone to attack by adversaries.The adversaries gain access to the contents of the user in attack prone servers.To overcome this problem, the multi-server systems were being proposed in which the user communicate in parallel with several or all of the servers for the purpose of authentication.Such system requires a large communication bandwidth and needs for synchronization at the user.Approach: Present an efficient two server user password authentication and reduce the usage of communication traffic and bandwidth consumption between the servers.Integration of quantum and classical key exchange model is deployed to safeguard user access security in large networks.The proposed work presented, a two server system, front end service server interacts directly to the user and the back end control server visible to the service server.The performance measure of the user password made for the transformed two long secrets held by both service and control server.Further the proposal applied quantum key distribution model along with classical key exchange in the two server authentication.Three-party Quantum key distribution used in this model, one with implicit user authentication and other with explicit mutual authentication, deployed for ecommerce buyer authentication in internet peer servers.Results: Effect of online and offline dictionary attacks prevailing in the single and multi-server systems are analyzed.The performance efficiency test carried out in terms success rate of authenticity for two server shows 35% better than single server.The performance of integrated Quantum Key Distribution (QKD) systems and classical public key model have shown experimentally better performance in terms of computational efficiency and security rounds (11% improvement) than traditional cryptic security model.Conclusion: With the results obtained it is concluded that intricate security principle of quantum theory and traditional public key model integration provides an improved security model for password authentication between the password exchanges of two servers.
With online transactions and processing, a large amount of data is generated in today’s internet world, and securing this information is a challenge. It considers security and privacy as the degree of resistance to information and different transaction details from threats and vulnerabilities. The primary concern in online banking is user authentication, information confidentiality, and the channel/media through which the information is shared. Towards this purpose, the paper majorly focuses on the security techniques under classical and quantum cryptography used in online banking to address the issues and different attacks during service utilization. Paper presents a model used to authenticate a client through quantum-safe channel technique in conjunction with one-time pad (OTP) concept to increase security and avoid reply attacks. The idea of introducing quantum cryptography aims to analyze the performance for the operational feasibility of the proposed solution. Combining quantum computing and classical algorithms can boost fraud detection performance and processing speed in financial transactions. Hence, the proposed scheme considers implementing a hybrid technique and QKD for secure online banking in a quantum cryptography environment.
This paper presents an overview of quantum errors and noise channels, their mathematical modeling and its implementation in quantum one time password (QOTP) based user authentication. Quantum noise plays a pivotal role in understanding quantum information theory which is important to build up quantum communication theory. The Kraus operators provide a powerful mathematical tool in understanding and modeling various quantum channels. Use of QOTP provides an impressive method of carrying out user authentication involving quantum operations based on user biometrics. However, the efficiency of this method can be better envisaged by incorporating noise models during qubit transmission.