ABSTRACT

CHAPTER ONE

INTRODUCTION

1. 1. Background of the Study

The impact of the Internet over the last few years has meant fundamental changes in the way we access corporate and business systems via the internet. The network security perimeter has crumbled at all levels while the number of users wanting network access has grown. The geographical location of users has also widened to a situation where they can be, not just in a different department or company branch office, but anywhere in the world. While there are enormous productivity benefits available from increased access, the security risks have greatly increased. The traditional method of securing system access was by authentication through the use of static passwords (Kalaikavitha et al., 2013).

Unfortunately, traditional password authentication is totally unsuitable for securing the access requirements of today’s distributed users. According to the DTI Information Security Breaches Survey 2006, businesses are still overwhelmingly dependent on user IDs and passwords to check the identity of users attempting to access their systems. Weak single factor authentication is the use of single static passwords and still employed by most companies and corporate organizations. The benefit is that static passwords are easy to remember. However, when you have different passwords for different systems, they start to become very difficult to remember and have to be written down, making them vulnerable. The many disadvantages of single static passwords include how easy it is to crack them. They are short and based on topics close to the user, such as birthdays, partner names, children’s names, etc.; and sometimes they are typically letters only. They are also vulnerable to social engineering i.e. people asking for your password or guessing it. They can also be picked up by spyware. The alternative method of password management is to change passwords regularly. Operated correctly, this has the benefit of being more inherently secure than static passwords. A disadvantage of frequently changing passwords is that they can be easily forgotten, leading to very high support costs and significantly increased administration costs of managing corporate organizations and companies web systems(Kalaikavitha et al., 2013).

According to Kshirsagar and Singh (2015), there are mainly two types of password, Static password and Dynamic password. Static password is the traditional password which is usually changed only when it is necessary: it is changed when the user has to reset the password, i.e., either the user has forgotten the password or the password has expired. Static passwords are highly susceptible to cracking, because passwords used will get cached on the hard drives.

With the enormous disadvantages associated with static passwords, and especially eavesdropping, which is one form of attack on computing system connected to the Internet, aimed on network connections to obtain login id’s and password of a legitimate user. The captured login id and password are, at a later time, used to gain access to the system. One Time Password (OTP) systems are designed to counter this type of attack. There are two sides to the operation of the OTP system. On the client side, the appropriate OTP generated from the server must be received via SMS or email. On the host side, the server must verify the OTP and permit the secure login of the user (Mahto et al., 2015).

In this research we proposed an encrypted OTP system, using Message-Digest Algorithm 5 (MD5) encryption technique to counter brute force and dictionary attack on OTPs.

1.2     Statement of the Problem

Static passwords has been used for user authentication for websites which was traced back before past few decades while registering accounts on a website ,the user enters the username and text password. Once the account is created, he/she has to remember the password for logging into the website. As humans are not experts in memorizing text strings, weak passwords will be selected which leads to brute force and dictionary attacks and another problem is that the same password will be used for more than a website which causes password reuse attack.  Based on the aforementioned, we are proposing an encrypted OTP system, using Message-Digest Algorithm 5 (MD5) encryption technique that will encrypt OTP before forwarding it via SMS to the user’s mobile number, thereby countering the weaknesses of static passwords.

1.3     Aim and Objectives of the Study

The aim of this research work is to design and implement a Digital Privacy of One Time Password Using Base64 Encryption Technique.

The specific objective includes:

1. To review related literatures pointing to Secure One Time Password Using Base64 Hashing.
2.  Design a Secure One Time Password Using Base64 Hashing system using UML controls.
3. Create a database for the system using MySQL database.
4.  Implement the system designed in (ii) using HTML, CSS, JavaScript and PHP on the server side.

iv. Test the system implemented in (iv) above for performance.

1.4     Significance of the Study

This study will serve to mitigate the issues surrounding static passwords and OTPs by using an the Base64 hashing encryption technique to encrypt OTP before forwarding it to users mobile number.

The software is also relevant in the following ways:

i.   It will aid in further research by other researchers with respect to case study.

ii.  It will be useful in countering reuse attacks.

iii. It will be useful in countering dictionary attacks.

iv. It will be useful in mitigating the disadvantages of static passwords.

1.5     Scope of the Study

This research work covers the design and implementation of a secure one-time password using base64 hashing algorithm to encrypt OTPs and forward to users mobile numbers.

1.6   Limitation of the Study

The researcher faced some limitations during the course of this research. Some of this limitations/constraint includes;

i. Time constraint: Time factor was the major factors as the timeframe to submit the project was too short for a rigorous research.

ii. Financial constraint:  Lack of adequate finance to fund the researcher as to the purchase of data to review related works online was another major setback.

1.7     Definition of Terms

1. Authenticate: To have one’s identity verified.
2. Brute Force Attack: Also known as exhaustive search, is a cryptographic hack that relies on guessing possible combinations of a targeted password until the correct password is been discovered.
3. Dictionary Attack: This is an attempt to gain illicit access to a computer system by using a very large set of words to generate potential passwords.
4. Digital: (of signals or data) expressed as series of digits 0 and 1.
5. Dynamic Password: This is a password that is only valid for only one login session.
6. Eavesdropping: Also known as sniffing or snooping attack, is a theft of information as transmitted over a network by a computer smartphone or other computer device.
7. Electronic: (of a device) having or operating with components such as microchips and transistors that control and direct electric currents.
8. Encryption: This is the process of encoding information, where the text to be encoded is called plaintext while the encoded text is called cypher-text.
9. Internet: Internet is a global system of interconnected computer networks that use the standard Internet protocol suite (TCP/IP) to serve billions of users worldwide. It is also known as the network of networks.
10. Base64: is a group of binary-to-text encoding schemes that represent binary data (more specifically, a sequence of 8-bit bytes) in an ASCII string format by translating the data into a radix-64 representation
11. OTP: One Time Password or One Time Pin is a dynamic password that is only valid for only one login session or transaction on a computer system or other digital device.
12. Password: This is a memorized string of characters often used to confirm the identity of a particular user.
13. Phishing Attack: This is a fraudulent attempt to obtain sensitive information such as username, passwords or credit card details by disguising oneself as a trustworthy entity in an electronic communication.
14. Privacy: This is a processing of secluding personal information by expressing them selectively.
15. Static password: This are reusable passwords that may or may not expire, they are typically user generated.
16. System: A system is a set of detailed methods, procedures and routines created to carry out a specific activity, perform a duty, or solve a problem
17. Website: A website is a collection of webpages with related content that is been identified by a single domain name and published on the World Wide Web.