Virtualization based password protection against malware in untrusted operating systems

Password based authentication remains as the mainstream user authentication method for most web servers, despite its known vulnerability to keylogger attacks. Most existing countermeasures are costly because they require a strong isolation of the browser and the operating system. In this paper, we p...

Full description

Saved in:
Bibliographic Details
Main Authors: CHENG, Yueqiang, DING, Xuhua
Format: text
Language:English
Published: Institutional Knowledge at Singapore Management University 2012
Subjects:
Online Access:https://ink.library.smu.edu.sg/sis_research/1670
https://ink.library.smu.edu.sg/context/sis_research/article/2669/viewcontent/trust12.pdf
Tags: Add Tag
No Tags, Be the first to tag this record!
Institution: Singapore Management University
Language: English
id sg-smu-ink.sis_research-2669
record_format dspace
spelling sg-smu-ink.sis_research-26692020-04-24T08:10:47Z Virtualization based password protection against malware in untrusted operating systems CHENG, Yueqiang DING, Xuhua Password based authentication remains as the mainstream user authentication method for most web servers, despite its known vulnerability to keylogger attacks. Most existing countermeasures are costly because they require a strong isolation of the browser and the operating system. In this paper, we propose KGuard, a password input protection system. Its security is based on the hardware-based virtualization without safeguarding the browser or OS. A security-conscious user can conveniently and securely activate or deactivate the password protection by using key combinations. We have implemented KGuard and experimented our prototype on Windows with Firefox. The results show that no significant performance loss is induced by our protection mechanism when a user authenticates to commercial web servers. 2012-06-01T07:00:00Z text application/pdf https://ink.library.smu.edu.sg/sis_research/1670 info:doi/10.1007/978-3-642-30921-2_12 https://ink.library.smu.edu.sg/context/sis_research/article/2669/viewcontent/trust12.pdf http://creativecommons.org/licenses/by-nc-nd/4.0/ Research Collection School Of Computing and Information Systems eng Institutional Knowledge at Singapore Management University Password protection Password-based authentication Performance loss Protection mechanisms Protection systems User authentication
institution Singapore Management University
building SMU Libraries
continent Asia
country Singapore
Singapore
content_provider SMU Libraries
collection InK@SMU
language English
topic Password protection
Password-based authentication
Performance loss
Protection mechanisms
Protection systems
User authentication
spellingShingle Password protection
Password-based authentication
Performance loss
Protection mechanisms
Protection systems
User authentication
CHENG, Yueqiang
DING, Xuhua
Virtualization based password protection against malware in untrusted operating systems
description Password based authentication remains as the mainstream user authentication method for most web servers, despite its known vulnerability to keylogger attacks. Most existing countermeasures are costly because they require a strong isolation of the browser and the operating system. In this paper, we propose KGuard, a password input protection system. Its security is based on the hardware-based virtualization without safeguarding the browser or OS. A security-conscious user can conveniently and securely activate or deactivate the password protection by using key combinations. We have implemented KGuard and experimented our prototype on Windows with Firefox. The results show that no significant performance loss is induced by our protection mechanism when a user authenticates to commercial web servers.
format text
author CHENG, Yueqiang
DING, Xuhua
author_facet CHENG, Yueqiang
DING, Xuhua
author_sort CHENG, Yueqiang
title Virtualization based password protection against malware in untrusted operating systems
title_short Virtualization based password protection against malware in untrusted operating systems
title_full Virtualization based password protection against malware in untrusted operating systems
title_fullStr Virtualization based password protection against malware in untrusted operating systems
title_full_unstemmed Virtualization based password protection against malware in untrusted operating systems
title_sort virtualization based password protection against malware in untrusted operating systems
publisher Institutional Knowledge at Singapore Management University
publishDate 2012
url https://ink.library.smu.edu.sg/sis_research/1670
https://ink.library.smu.edu.sg/context/sis_research/article/2669/viewcontent/trust12.pdf
_version_ 1770571445834874880