AN INTEGRATED ATTACK CONTROL MECHANISM FOR INTERNET/INTRANET SERVICES

Mail, messaging, data sharing and computational services are shared under the Intranet and Internet environment. User access on the services is allowed with reference to the user account information. User ID and passwords are applied in the user verification process. Graphical passwords are used to verify the users. Captcha techniques are employed to identify the request is received from the machine or human. Captcha as Graphical Passwords (CaRP) technique integrates the Captcha and Graphical passwords methods. Recognition based method and recognition and recall based methods are adapted in the CaRP scheme. Text and image captchas are used in the CaRP scheme. Click points are selected by the user and verified by the authentication server environment. Guessing attacks, rely attacks and transmission attacks are raised against the CaRP scheme. An integrated attack controlling scheme is adapted to handle the attacks under the Internet and Intranet services. Pixel location and color based pattern analysis methods are employed to control guessing attacks. Cryptography and data integrity verification methods are used to handle directory attacks and transmission attacks. Shoulder surfing attacks are also handled with image dimming and dynamic mouse cursor movements. Hash codes are used to maintain the password information. Password strength estimation mechanism improves the password construction process. The system protects the user authentication process with security ad attack control mechanism.