SBIR Phase I: Tools for Protecting Against Online Password Guessing Attacks

SBIR 第一阶段：防御在线密码猜测攻击的工具

• 批准号: 0339464
• 负责人: Stuart Stubblebine
• 金额: $ 10万
• 依托单位: Stubblebine Research Labs, LLC
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2004
• 资助国家: 美国
• 起止时间: 2004-01-01 至 2004-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0339464&HistoricalAwards=false
• 关键词: SBIR; Phase; Tools; Protecting; Against

This Small Business Innovation Research Phase I project addresses the need to protect networked computer systems from sophisticated password guessing or dictionary attacks. Such attacks result in the adversary learning the password or causing a denial of service due to account locking. In many cases account locking is not practically feasible due to the increased costs of supporting customers. Recent countermeasures require human-in- the-loop or Reverse Turing Tests (RTT) as part of the authentication protocol. This project will demonstrate that many RTT protocols are vulnerable to relay attacks. In one instance, RTT challenges are relayed to unsuspecting parties, who generate responses that are then relayed back to the challenger. This project explores this threat of attack, propose mechanisms to address it, and explore specific enhancements to an RTT-based login protocol. A major feature of our approach is increased security, usability, flexibility, and configurability. The protocol will be tailored to match particular environment, classes of users, and applications. These features are necessary for any practical adoption RTT-based solutions. The success of this project will lead to more secure networks that are more user-friendly, flexible and configurable.

这个小型企业创新研究第一阶段项目解决了保护联网计算机系统免受复杂密码猜测或字典攻击的需要。此类攻击会导致攻击者获知密码或由于帐户锁定而导致拒绝服务。在许多情况下，由于支持客户的成本增加，帐户锁定实际上并不可行。最近的对策需要人在回路或反向图灵测试（RTT）作为身份验证协议的一部分。这个项目将证明许多RTT协议容易受到中继攻击。在一个实例中，RTT挑战被中继到不知情的各方，这些各方生成响应，然后被中继回挑战者。这个项目探讨了这种攻击威胁，提出了解决它的机制，并探讨了基于RTT的登录协议的具体增强。我们的方法的一个主要特点是提高了安全性、可用性、灵活性和可配置性。该协议将根据特定的环境、用户类别和应用程序进行定制。这些功能对于任何实际采用基于RTT的解决方案都是必要的。该项目的成功将导致更安全的网络，更用户友好，灵活和可配置。