Date post: | 27-Oct-2014 |
Category: |
Documents |
Upload: | rama-sugavanam |
View: | 303 times |
Download: | 2 times |
REVISITING PRIOR PROPOSALS FOR DEFENSES
AGAINST LARGE-SCALE ONLINE PASSWORD
GUESSING ATTACKS
A PROJECT REPORT
Submitted by
ARUL ISAI.U.S-32308205004
PRIYADHARSHINI.S-32308205039
SUDHA.S-32308205047
in partial fulfillment for the award of the degree
of
BACHELOR OF TECHNOLOGY
in
INFORMATION TECHNOLOGY
MEENAKSHI COLLEGE OF ENGINEERING, CHENNAI
ANNA UNIVERSITY:: CHENNAI 600 025
MAY 2012
i
ANNA UNIVERSITY::CHENNAI 600 025
BONAFIDE CERTIFICATE
Certified that this project report “REVISITING PRIOR PROPOSALS FOR
DEFENSES AGAINST LARGE-SCALE ONLINE PASSWORD GUESSING
ATTACKS” is the bonafide work of “ARUL ISAI.U.S, PRIYADHARSHINI.S
and SUDHA.S” who carried out the project work under my supervision.
SIGNATURE SIGNATURE
Mr.Upendra Babu M.E., (Ph.D) Mrs.S.Rama (M.E.)
HEAD OF THE DEPARTMENT SUPERVISOR
Department of Information TechnologyMeenakshi College of EngineeringWest K.K.NagarChennai-600 078.
Assistant ProfessorDepartment of Information TechnologyMeenakshi College of EngineeringWest K.K.NagarChennai-600 078.
Submitted For the Project Viva-Voce held on ……………………
INTERNAL EXAMINER EXTERNAL EXAMINER
ACKNOWLEDGEMENT
ii
We sincerely and whole heartedly express our gratitude and indebtness to
our esteemed founder, chair person and the authorities of MEENAKSHI
AMMAL EDUCATIONAL TRUST for the patronage and parental care
showered on our welfare rooted in the academic career.
We deeply thank our Director Mrs.R.PREMALATHA KANIKANNAN,
M.E., MBA, for providing immense laboratory and library facilities that helped us
to complete our project successfully.
We express our deep sense of gratitude to our principal
Dr.G.GUNASEKARAN,B.E.,M.E.,Ph.D(Engg) for his support and
encouragement throughout our course of study.
We express our sincere thanks to Mr.UPENDRA BABU, M.E., (Ph.D)
Head of the Department, Information Technology for giving constructive
ideas and valuable criticism on our project.
We immensely oblige to our internal project guide Mrs.S.RAMA, M.E., for
her valuable suggestion, guidance and sustained interest in completing the project
successfully.
We extend our gratitude to all our department teaching, non-teaching staff
members and friends and for their immense guidance throughout our project work.
ABSTRACT
iii
Nowadays, there is an alarming increase of certain Brute Force and
dictionary attacks on password by remote login services. It is a difficult problem to
prevent such attacks in the real-time network so that the legitimate users will find a
convenient login.
The widely used method is Automated Turing Tests (ATTs). It is an easy
approach to identify automated malicious login attempts with reasonable cost of
inconvenience, to users. One effective defense against automated online password
guessing attacks is to restrict the number of failed trials without ATTs to a very
small number (e.g., three),limiting automated programs as used by attackers to
three free password guesses for target account , even if different machines from a
botnet are used. However, this inconveniences the legitimate user who then must
answer an ATT on the next login attempt.
Here we analyze the inadequacy of existing protocols and the proposed login
protocols designed to prevent large scale online dictionary attacks. We propose a
new Password Guessing Resistant Protocol (PGRP) derived upon revisiting prior
proposals to restrict such attacks. It limits the total number of login attempts from
unknown remote hosts to as low as a single attempt per username. Legitimate users
can make several failed login proposals before being challenged with an ATT. We
shall prove that this method is more promising than all the existing proposals.
iv
TABLE OF CONTENTS
CHAPTER NO TITLE PAGE NO
ABSTRACT iv
LIST OF TABLES viii
LIST OF FIGURES ix
LIST OF ABBREVATIONS
xi
1. INTRODUCTION
1.1 General Description 2
1.2 Project Overview 4
1.3 Existing system 9
1.4 Proposed system 10
2. LITERATURE SURVEY 13
3. REQUIREMENT SPECIFICATION
3.1 Introduction 19
3.2 Hardware and Software specification 19
3.3 Technologies Used
3.3.1 Java 20
3.3.2 Introduction to Java 20
3.3.3 Working of Java 21
3.3.4 Java Server Pages 25
3.3.5 Java Server Faces 28
v
4. SYSTEM DESIGN
4.1 Introduction 30
4.2 Overall Architecture 34
4.3 Introduction to UML Representation 36
4.4 Activity Diagram
40
4.5 Sequence Diagram 42
4.6 Use Case Diagram 43
4.7 Class Diagram 44
5. SYSTEM DESCRIPTION
5.1 List of Modules 46
5.1.1 Captcha Security 46
5.1.2 Password Guessing Resistant Protocol 47
5.1.3 Implementation of captcha security 49
6. SYSTEM TESTING
6.1 Types of Testing 53
6.2 Software Testing Strategies 64
6.3 Objectives of Testing 65
6.4 Error finding Test Methods 69
6.5 Test Case 70
6.5.1 Test Case Format 70
6.5.2 Purpose of a good Test Case 71
vi
6.5.3 Review of Software Test Cases 72
6.5.4 Structure of Test Case 74
6.5.5 Test Case Design 74
6.5.6 Guidelines To Prepare Test Case 75
6.6 Test Case Report Generation 77
7. CODING
7.1 Coding standards 82
7.2 Source code 85
8. SCREENSHOTS 146
9. CONCLUSION 155
10. FUTURE ENHANCEMENT 157
10. REFERENCES 159
vii
LIST OF TABLES
TABLE NO. TITLE PAGE NO.
1 Description of UML Diagrams 38
2 Error Finding Test Methods 69
3 Test Case Report for the Entire Project 77
4 Test Case Report for Negative Testing 78
5 Test Case Report for Positive Testing 79
6 Test Case Report for Black-Box Testing 80
7 Test Case Report for White-Box Testing 80
viii
LIST OF FIGURES
FIGURE NO. TITLE PAGE NO.
1.1 EXISTING CAPTCHA 101.2 PROPOSED
ARCHITECTURE11
3.1 FLOW OF PLATFORM INDEPENDENT JAVA CODE BETWEEN DIFFERENT PLATFORM
24
3.2 JAVA PROGRAM USING JAVA PLATFORM TO GAIN PLATFORM INDEPENDENCY
25
4.1 SDLC Life Cycle 324.2 OVERALL
ARCHITECTURE34
4.3 TYPES OF UML DIAGRAMS
37
4.4 ACTIVITY DIAGRAM 404.5 SEQUENCE DIAGRAM 424.6 USECASE DIAGRAM 434.7 CLASS DIAGRAM 445.1 CAPTCHA
GENERATION47
5.2 USER LOGIN PAGE 50
ix
5.3 EXAMPLE OF IMAGE CAPTCHA
50
8.1 SNAPSHOT FOR HOME PAGE
147
8.2 SNAPSHOT FOR LOGIN PAGE
148
8.3 SNAPSHOT FOR REGISTRATION PAGE
149
8.4 SNAPSHOT FOR LOGIN PAGE WITH USERNAME FIELD ENABLED
150
8.5 SNAPSHOT FOR CAPTCHA GENERATION
151
8.6 SNAPSHOT FOR IDENTIFYING CAPTCHA
152
8.7 SNAPSHOT OF LOGIN PAGE WITH PASSWORD FIELD ENABLED
153
8.8 SNAPSHOT OF THE WEBPAGE FOR THE DESIRD USER
154
x
LIST OF ABBREVATIONS
ATT - Automated Turing Tests
JVM - Java Virtual Machine
JSP - Java Server Pages
JSF - Java Server Faces
MVC - Model Viewing Controller
VDL - View Description Language
API - Application Programming Interface
HTML - Hyper Text Markup Language
PGRP - Password Guessing Resistant Protocol
xi
xii