INTRODUCITON

 Computer security is vital for protecting the confidentiality, integrity, and availability of computer systems, resources, and data. Without confidentiality, there can be lost of trade secrets or personally identified information. An unsecured computer can be unknowingly transformed into a botnet, and the botnet could in turn be used to launch attacks against institutions containing secret information.

                                          

                 Authentication can be quoted as form of computer security verifying the identity of the user logging into a network. Passwords, digital certificates,   biometrics [10] can be used to prove the identity of the user to the network. There are human response authentication, challenge-response authentication, password, digital signature and biometrics.

                     

                             Human authentication is the verification that a person initiated the transaction, not the computer. Challenge-response authentication is an authentication method used to prove the identity of a user logging onto the network. Two-factor authentication requires two independent ways to establish identity and privileges. The method of using more than one factor of authentication is also called strong authentication. This contrasts with traditional password authentication, requiring only one factor in order to gain access to a system. Password is a secret word or code used to serve as a security measure against unauthorized access to data. It is normally managed by the operating system or DBMS. However, a computer can only verify the legality of the password, not the legality of the user.

                            There are different types of attacks on the password authentication like Brute-force attacks, Dictionary attacks, spyware attacks, hidden camera attacks and shoulder surfing attack. Different password mechanisms are introduced to over these attacks.

                             In traditional authentication [9] approach the server maintains a password table which stores the usernames and passwords. This procedure gives some compromising issues over the security of the users. If an intruder or hacker performs some attacks like SQL injection he/she can access the password table which he can disclose the user information. Even storing the information in encrypted for like hashing [18,19,24] may not provide
enough security if the intruder can break the cipher with reverse hashing [24] etc.

                            

                Table 2.1 Table Showing User Names and Passwords.