SBIR Phase I: Tools for Protecting Against Online Password Guessing Attacks

这个小型企业创新研究第一阶段项目解决了保护联网计算机系统免受复杂密码猜测或词典攻击的需要。此类攻击会导致攻击者获知密码或由于帐户锁定而导致拒绝服务。在许多情况下，帐户锁定实际上是不可行的，因为支持客户的成本增加了。最近的对策要求将人在环路或反向测试(RTT)作为身份验证协议的一部分。本项目将演示许多RTT协议容易受到中继攻击。在一种情况下，RTT挑战被传递给毫无戒心的各方，后者产生的响应然后被传递回挑战者。本项目探讨了这种攻击威胁，提出了解决它的机制，并探索了对基于RTT的登录协议的具体增强。我们方法的一个主要特点是提高了安全性、可用性、灵活性和可配置性。该协议将根据特定环境、用户类别和应用程序进行定制。这些功能对于任何实际采用基于RTT的解决方案都是必要的。该项目的成功将带来更安全的网络，更方便用户，更灵活，更可配置。

This Small Business Innovation Research Phase I project addresses the need to protect networked computer systems from sophisticated password guessing or dictionary attacks. Such attacks result in the adversary learning the password or causing a denial of service due to account locking. In many cases account locking is not practically feasible due to the increased costs of supporting customers. Recent countermeasures require human-in- the-loop or Reverse Turing Tests (RTT) as part of the authentication protocol. This project will demonstrate that many RTT protocols are vulnerable to relay attacks. In one instance, RTT challenges are relayed to unsuspecting parties, who generate responses that are then relayed back to the challenger. This project explores this threat of attack, propose mechanisms to address it, and explore specific enhancements to an RTT-based login protocol. A major feature of our approach is increased security, usability, flexibility, and configurability. The protocol will be tailored to match particular environment, classes of users, and applications. These features are necessary for any practical adoption RTT-based solutions. The success of this project will lead to more secure networks that are more user-friendly, flexible and configurable.