1. Angelos Barmpoutis angelbar@csd.auth.gr1 Web-based Authentication Technique for Systems without database Server Angelos Barmpoutis Aristotle University of Thessaloniki

2. Angelos Barmpoutis angelbar@csd.auth.gr2 Introduction We would like to: Control software access Know the users of a product Communication Commerce

3. Angelos Barmpoutis angelbar@csd.auth.gr3 Techniques Algorithmic techniques Database server techniques Web-based technique

4. Angelos Barmpoutis angelbar@csd.auth.gr4 Algorithmic technique There is an algorithm that produces access passwords Every user sets a username A unique registry code is required

5. Angelos Barmpoutis angelbar@csd.auth.gr5 Algorithmic technique Server is not required Network is not required Algorithm can’t be changed Distance System - User

6. Angelos Barmpoutis angelbar@csd.auth.gr6 Server technique There is a server and a database with the data of the users Every user opens an account Users set a password Users can update their data

7. Angelos Barmpoutis angelbar@csd.auth.gr7 Server technique Small distance System-User Real-time procedures Database server cost Network required

8. Angelos Barmpoutis angelbar@csd.auth.gr8 Web-based technique It is a combination of the algorithmic and database server techniques Every user opens an account Small distance System - User There isn’t any database server No database server cost

9. Angelos Barmpoutis angelbar@csd.auth.gr9 Features We don’t want to have a database server but… We want every user to open an account Every user can open an account and have access every time!

10. Angelos Barmpoutis angelbar@csd.auth.gr10 New user 1. Every new user fills a registry form 2. There is a PIN generator algorithm 3. Then the user receives an e-mail with a password So, every time somebody can open an account

11. Angelos Barmpoutis angelbar@csd.auth.gr11 PIN Generator The algorithm remains stable But input can be changed So we use variable web-file input We can “change” the algorithm Safer technique

12. Angelos Barmpoutis angelbar@csd.auth.gr12 Entrance algorithm 1. A user gives his username-PIN combination. Set FLAG=false. 2. Set this username as input to the Generator algorithm and generate a temporary PIN. 3. If user PIN = temporary PIN then set FLAG=true and go to step 6. Else go to step 4. 4. Search a web-placed database file, for a record with the username-PIN combination. 5. If username-PIN was found then set FLAG=true. 6. Result = FLAG.

13. Angelos Barmpoutis angelbar@csd.auth.gr13 Entrance algorithm There is a database web-file Personal data of users are stored How? Remember… 1. Every new user fills a form 2. Receives a password form PINGen. 3. Access with username and the PIN

14. Angelos Barmpoutis angelbar@csd.auth.gr14 Update personal data Every user can update his data This isn’t a real-time procedure  Updated data are send by e-mail to the system administrator  Administrator uses an e-mail data collector and updates the database web- files  He is the only person, who changes the database web-files

15. Angelos Barmpoutis angelbar@csd.auth.gr15 Web-based technique  An e-mail account is used  Few MB space in the web Users have their account New accounts can be opened and accessed every time Accounts can be updated Database server isn’t required

16. Angelos Barmpoutis angelbar@csd.auth.gr16 Diagram of technique

17. Angelos Barmpoutis angelbar@csd.auth.gr17 Advantages  Small System-User distance Because of account opening  Real-time account opening Because of PIN Generator  Users can update their personal data Because of using e-mail protocol  But… this isn’t a real-time procedure

18. Angelos Barmpoutis angelbar@csd.auth.gr18 Combination of features FeaturesAlgorithmicDatabase Server Web-based User accounts NoYes Database server NoYesNo PIN Generator YesNoYes Web required NoYes

19. Angelos Barmpoutis angelbar@csd.auth.gr19 Database length / Users

20. Angelos Barmpoutis angelbar@csd.auth.gr20 Uses Web-based authentication and user controlling technique is useful to:  Web services  e-learning  e-commerce  Advertising methods  Small companies  Personal Pages etc

21. Angelos Barmpoutis angelbar@csd.auth.gr21 Example Free music catalog software This software is a multimedia application with texts, photos, sounds, videos etc Users are controlled by this web-based technique

22. Angelos Barmpoutis angelbar@csd.auth.gr22 Example 1. A new user sets a username and he fills the registration form 2. He receives an e-mail with a PIN 3. He uses the username and PIN to have access to the system 4. He changes his password 5. Administrator updates the database files

23. Angelos Barmpoutis angelbar@csd.auth.gr23 Diagram of technique

24. Angelos Barmpoutis angelbar@csd.auth.gr24 Implementation PSIFIAK Digital Circuit Designer & Simulator www.psifiak.8m.com Informatics Department of Aristotle University of Thessaloniki uses Psifiak- Digital Circuit Designer and Simulator, for academic purpose, during Digital Circuit Design and Digital Electronics courses.

25. Angelos Barmpoutis angelbar@csd.auth.gr25 Implementation

26. Angelos Barmpoutis angelbar@csd.auth.gr26 Summary Web-based authentication technique is a combination of the algorithmic and the database server techniques. There isn’t a database server, we use the e-mail protocol Many advantages Is useful to free web services, e-commerce, e-learning, etc.

27. Angelos Barmpoutis angelbar@csd.auth.gr27 References 1.Andrew S. Tanembaum, Computer Networks, 3 rd Edition, Prentice-Hall Inc, 1996 2.Raghu Ramakrishnan, Johannes Gehrke, Database Management Systems, The McGraw-Hill Companies Inc, 1998 3.Stallings W., Network and Internetwork Security, Engelwood Cliffs, Prentice-Hall, 1995b 4.Merkle R.C, Fast Software Encryption Functions, Advances in Cryptology-CRYPTO '90 Proceedings, New York, Springer- Verlag, 1991 5.Van Der Linden P, Just Java, Engelwood Cliffs, Prentice- Hall, 1996

28. Angelos Barmpoutis angelbar@csd.auth.gr28 Web-based Authentication Technique for Systems without database Server Angelos Barmpoutis Informatics Department, School of Science Aristotle University of Thessaloniki e-mail: angelbar@csd.auth.grangelbar@csd.auth.gr URL: http://users.auth.gr/angelbarhttp://users.auth.gr/angelbar Voice: +30 – 6972686728 Psifiak: http://www.psifiak.8m.comhttp://www.psifiak.8m.com

29. Angelos Barmpoutis angelbar@csd.auth.gr29 Web-based Authentication Technique for Systems without database Server Thank you!