An enhancement of honey encryption algorithm applied in online patient portals

ABSTRACT: The Honey Encryption Algorithm is a novel encryption scheme designed to encrypt messages using low-entropy keys, such as passwords. Using an incorrect key returns a honeyword---a fictitious message intended to mislead attackers into thinking they have accessed the correct data. However, in password-based authentication systems, a usability issue arises when legitimate users accidentally input their password in a way that results in a honeyword. This study addresses the problem of typo safety in the Honey Encryption Algorithm by employing Long-Short-Term Memory (LSTM) models combined with the Demarau-Levenshtein distance metric to generate honeywords that are less likely to be typed by legitimate users while still being effective against adversarial attacks. The Enhanced Honey Encryption Algorithm achieved a typo rate at 41.80%, with only 22.54% of typos producing a honeyword candidate. The original Honey Encryption Algorithm using the Chaffing-by-Tail-Tweaking method had a 51.80% typo rate, with 77.46% of typos resulting in honeyword candidates. A password survey was conducted with 100 participants, asking them to re-enter 10 passwords under timed and environmental constraints for ecological validity. Both algorithms were tested using honeyword sets generated from passwords sourced from the phpBB password list. The Enhanced Honey Encryption Algorithm’s reduced typo and honeyword candidate rates indicate a lower probability of legitimate users typos resulting in a honeyword, demonstrating a significant improvement in usability in password-based authentication systems. In addition, the algorithm achieved stronger security through a higher avalanche effect of 45.00% compared to 37.91% in the original, indicating better resistance to ciphertext modification attacks. Finally, integrating LZW and Huffman coding achieved a 52.38% reduction in ciphertext size, improving storage efficiency without compromising decryption integrity, making the Enhanced Encryption Algorithm a more practical and secure solution for modern authentication systems.

Filipiniana