Description

A malicious developer can plant backdoors by hiding logic in source code, by planting delicate vulnerabilities, or even by using weak cryptographic algorithms. Because of the common usage of cryptographic techniques and code protection in authentication modules, it is very difficult to detect and eliminate backdoors from login systems. In this paper, we propose a framework for RCA systems to ensure that the authentication process is not affected by backdoors. Our approach decomposes the authentication module into components. Components with simple logic are verified by code analysis for correctness, components with cryptographic/ obfuscated logic are sand boxed and verified through testing. The key component of our approach is NaPu, a native sandbox to ensure pure functions, which protects the complex and backdoor-prone part of a login module. We also use a testing-based process to either detect backdoors in the sand boxed component or verify that the component has no backdoors that can be used practically. We demonstrated the effectiveness of our approach in real-world applications by porting and verifying several popular login modules into this framework. In existing system the system uses the network intrusion detection system (NIDS) for backdoor detection based on network behavior, back door detection by program analysis, backdoor prevention and hardware backdoor. The existing system had some drawbacks so the system proposed a frame work for Response computable authentication (RCA). In this work the system used NaPu a native pure function enforcing sand box. The idea of enforcing functional purity could be used for multiple applications beyond login modules.