arXiv subjects

Manik Lal Das

Publications and source records attributed to Manik Lal Das.

14 recordsLinked to original sources

arXiv2020

On Aadhaar Identity Management System

A unique identification for citizens can lead to effective governance to manage and provide citizen-centric services. While ensuring this service, privacy of the citizens needs to be preserved. Aadhaar, the identification system by UIDAI has faced some critics regarding its privacy preserving feature. This paper discusses those concerns in Aadhaar system and proposed a new model for the Aadhaar system. The proposed solution is aimed to address the issue of collusion of third party service providers and profiling of Aadhaar users. The proposed solution uses a distributed model capturing the Aadhaar system, in which data of users is decentralized and stored in zonal office's databases as well as the CIDR. The proposed solution provides the functioning of the authentication process of the Aadhaar system more effective, as it reduces the number of requests being handled directly by the CIDR and also tackles the concern of correlation of data.

cs.CR↗

arXiv2020

Web Application Attack Detection using Deep Learning

Modern web applications are dominated by HTTP/HTTPS messages that consist of one or more headers, where most of the exploits and payloads can be injected by attackers. According to the OWASP, the 80 percent of the web attacks are done through HTTP/HTTPS requests queries. In this paper, we present a deep learning based web application attacks detection model. The model uses auto-encoder that can learn from the sequences of word and weight each word or character according to them. The classification engine is trained on ECML-KDD dataset for classification of anomaly queries with respect to specific attack type. The proposed web application detection engine is trained with anomaly and benign web queries to achieve the accuracy of receiver operating characteristic curve of 1. The experimental results show that the proposed model can detect web applications attack successfully with low false positive rate.

cs.CR↗

arXiv2018

DigiLock: User-controlled and Server-aware Digital Locker System

The growing popularity of digital systems have paved the way for digital locker that ensures security and safety of the digital documents in store. While facilitating this system to user and availing its services offered by service provider, non-repudiation of service offered and service consumed is an important security requirement in the digital locker system. In this paper, we present a digital locker system that addresses the aspect of confidentiality, integrity, and non-repudiation along with other security properties. The proposed protocol ensures the confirmed participation of the user as well as the service provider while accessing the digital locker. The protocol is analyzed against potential threats in the context of safety and security of the digital locker system.

cs.CR↗

arXiv2017

Image Authentication using Visual Cryptography

This report gives a novel technique of image encryption and authentication by combining elements of Visual Cryptography and Public Key Cryptography. A prominent attack involving generation of fake shares to cheat honest users has been described and a demonstration of the proposed system employing a centralised server to generate shares and authenticate them on the basis of requests is made as a counter to the described attack.

cs.CR↗

arXiv2013

Reputation Algebra for Cloud-based Anonymous Data Storage Systems

Given a cloud-based anonymous data storage system, there are two ways for managing the nodes involved in file transfers. One of them is using reputations and the other uses a micropayment system. In reputation-based approach, each node has a reputation associated with it, which is used as a currency or feedback collection for file exchange operations. There have been several attempts over the years to develop a strong and efficient reputation system that provides credibility, fairness, and accountability. One such attempt was the Free Haven Project that provides a strong foundation for cloud-based anonymous data storage systems. The work proposed in this paper is motivated by the Free Haven Project aimed at developing a reputation system that facilitates dynamic operations such as adding servers, removing servers and changing role of authorities. The proposed system also provides algorithm for scoring and maintaining reputations of the servers in order to achieve credibility, accountability and fairness.

cs.DC↗

arXiv2009

GSM Security Using Identity-based Cryptography

Current security model in Global System for Mobile Communications (GSM) predominantly use symmetric key cryptography. The rapid advancement of Internet technology facilitates online trading, banking, downloading, emailing using resource-constrained handheld devices such as personal digital assistants and cell phones. However, these applications require more security than the present GSM supports. Consequently, a careful design of GSM security using both symmetric and asymmetric key cryptography would make GSM security more adaptable in security intensive applications. This paper presents a secure and efficient protocol for GSM security using identity based cryptography. The salient features of the proposed protocol are (i) authenticated key exchange; (ii) mutual authentication amongst communicating entities; and (iii) user anonymity. The security analysis of the protocol shows its strength against some known threats observed in conventional GSM security.

cs.CR↗

arXiv2008

Comment - Practical Data Protection

Recently, Rawat and Saxena proposed a method for protecting data using ``Disclaimer Statement''. This paper presents some issues and several flaws in their proposal.

cs.CR↗

arXiv2008

On the Security of ``an efficient and complete remote user authentication scheme''

Recently, Liaw et al. proposed a remote user authentication scheme using smart cards. Their scheme has claimed a number of features e.g. mutual authentication, no clock synchronization, no verifier table, flexible user password change, etc. We show that Liaw et al.'s scheme is completely insecure. By intercepting a valid login message in Liaw et al.'s scheme, any unregistered user or adversary can easily login to the remote system and establish a session key.

cs.CR↗

arXiv2008

A Flexible and Secure Remote Systems Authentication Scheme Using Smart Cards

The paper presents an authentication scheme for remote systems using smart card. The scheme prevents the scenario of many logged in users with the same login identity, and does not require password/verifier table to validate the users' login request. The scheme provides a user-friendly password change option, and withstands the replay, impersonation, stolen-verifier, guessing, and denial-of-service attacks.

cs.CR↗

arXiv2007

Proxy Signature Scheme with Effective Revocation Using Bilinear Pairings

We present a proxy signature scheme using bilinear pairings that provides effective proxy revocation. The scheme uses a binding-blinding technique to avoid secure channel requirements in the key issuance stage. With this technique, the signer receives a partial private key from a trusted authority and unblinds it to get his private key, in turn, overcomes the key escrow problem which is a constraint in most of the pairing-based proxy signature schemes. The scheme fulfills the necessary security requirements of proxy signature and resists other possible threats.

cs.CR↗

arXiv2007

Comments on "Improved Efficient Remote User Authentication Schemes"

Recently, Tian et al presented an article, in which they discussed some security weaknesses of Yoon et al's scheme and subsequently proposed two ``improved'' schemes. In this paper, we show that the Tian et al's schemes are insecure and vulnerable than the Yoon et al's scheme.

cs.CR↗

arXiv2007

A Dynamic ID-based Remote User Authentication Scheme

Password-based authentication schemes are the most widely used techniques for remote user authentication. Many static ID-based remote user authentication schemes both with and without smart cards have been proposed. Most of the schemes do not allow the users to choose and change their passwords, and maintain a verifier table to verify the validity of the user login. In this paper we present a dynamic ID-based remote user authentication scheme using smart cards. Our scheme allows the users to choose and change their passwords freely, and do not maintain any verifier table. The scheme is secure against ID-theft, and can resist the reply attacks, forgery attacks, guessing attacks, insider attacks and stolen verifier attacks.

cs.CR↗

arXiv2006

Algorithms and Approaches of Proxy Signature: A Survey

Numerous research studies have been investigated on proxy signatures over the last decade. This survey reviews the research progress on proxy signatures, analyzes a few notable proposals, and provides an overall remark of these proposals.

cs.CR↗

arXiv2005

Cryptanalysis of Key Issuing Protocols in ID-based Cryptosystems

To remove key escrow problem and avoid the need of secure channel in ID based cryptosystem Lee et al. proposed a secure key issuing protocol. However we show that it suffers from impersonation, insider attacks and incompetency of the key privacy authorities. We also cryptanalyze Sui et al.'s separable and anonymous key issuing protocol.

cs.CR↗