COEN 250AuthenticationHuman Machine AuthenticationSlide 4Slide 5Slide 6Slide 7Slide 8Slide 9Slide 10Slide 11Slide 12Slide 13Slide 14Slide 15Slide 16Slide 17Slide 18Slide 19Slide 20Slide 21Slide 22Slide 23Slide 24Authentication Security Policy Defining Protection LevelsSlide 26Slide 27Network Access ControlSlide 29Login PoliciesUser AccountsPassword PoliciesTelecommuting / Remote Access PoliciesMobile EquipmentCOEN 250AuthenticationAuthenticationBetween human and machineBetween machine and machineHuman Machine AuthenticationAuthentication protocols are based onWhat you know.E.g. password, pass-phrase, (secret key, private key).What you have.Physical key, smart card.What you are.Biometrics.Where you are.E.g. trusted machine, access to room, …AuthenticationPasswordsPredate computers.As do some attacks (stealing, guessing)Older cell phone technology transmits originating number with a password.Password good, call goes through.Eavesdropper receives phone number – password combination.Eavesdropper can now cl one the phone.AuthenticationPassword AttacksGuessingOn-lineTime consuming.Authentication attempts are usually logged.Can detect attack long before it is likely to succeed.Can disrupt the attack.Off-lineAttacker needs to steal relevant data from which password(s) can be determined.Attacker can use arbitrary amount of computing power.Capturing PasswordsEavesdroppingLogin Trojan HorseAuthenticationPasswords are storedOn each server Alice uses.Centrally: Authentication Storage Node:Each server retrieves the information when it wants to authenticate Alice.Centrally: Authentication Facilitator Node:Each server takes Alice’s data and password and goes to the AFN.AuthenticationPassword can be storedUnencryptedSimpleDangerousImplicitly as hashes of passwordsAs in UNIX, VMSEncryptedHashed and EncryptedAuthenticationExample: Network Information Service(Yellow Pages)Directory service is the authentication storage node.Stores hashed passwords of users.Typically, hashed passwords list is world readable Access by claiming to be a server.NIS authentication storage node does not authenticate itself to users.Allows impersonation of authentication service.AuthenticationPasswords for machine – machine communication can be made difficult to guess.Arbitrary lengthTruly random choice of characters.Human-machine passwordsGuessableSubject to dictionary attack.AuthenticationDictionary attackMost passwords are natural language words.Or derived from natural language words.Guess the language.Use a dictionary to try out all words in the language.Start with common passwords first.Replace a single character in a word, attach a random character, etc.AuthenticationBrute-Force AttackGenerate all possible password.Sometimes make assumptions on the alphabet only printable charactercharacters on a key-boardAuthenticationSalting Protects hashed passwords against an offline attack.Brute Force attack attacks all passwords in password file simultaneously.AuthenticationSaltingStore a salt with each passwordHash depends on salt and password.Use different salts for different passwords.Store salt with password.AuthenticationSaltingBrute force attack, dictionary attack can only attack a single password.AuthenticationPasswords are compromised:By obtaining password file.Safeguard byHashing and SaltingEncryptionBy eavesdropping on an exchangeUse one-way passwords:Lamport HashAuthenticationAddress BasedCommon in early UNIXRtools:.rhosts In user home directory(Computer, Account) pairsThese pairs are allowed access to the user’s account/etc/hosts.equivList of network addresses of “equivalent” machinesAccount name on A is equivalent to account name on B.Users have to have identical account names.AuthenticationAddressed based authentication threatened byAccess escalationAttacker gains access to one hosts.Access cascades to equivalent hosts / rhosts.Spoofing addressesVery easy to spoof source address.Harder to intercept traffic back.AuthenticationEthernet network address impersonationEasy on the same link.Hubs do not protect.Switches can be spoofed through the ARP protocol.Routers are harder to fool, but can be attacked and provided with misleading routing data.AuthenticationCryptographic authenticationAlice proves her identity to Bob by proving to Bob that she knows a secret.HashesSecret key cryptographyPublic key cryptography.Human Machine AuthenticationInitial password distribution to humansPre-expired, strong passwordsThrough mailDerivable from common knowledgeStudent IDHuman Machine AuthenticationAuthentication TokenPossession of the token proves right to access.Magnetic stripe as on credit cards.Harder to reproduce“Impossible” to guessDemand special hardwareCan be lost or stolenAdd pin or password protectionAre not safe against communication eavesdropping and forgingHuman Machine AuthenticationAuthentication TokenSmart Card.Needs to be inserted in a smart card reader.Card authenticates to the smart card reader.PIN protected smart cards.Stops working after a number of false PINs.Cryptographic challenge / response cardsCard contains a cryptographic key.Authenticating computer issues a challenge.Card solves the challenge after PIN is entered.Harder to crack than PIN protected smart cards because key is never revealed.Human Machine AuthenticationAuthentication TokenSmart Card.Readerless smart card (Cryptographic calculator)Communicates with owner through mini-keyboard and display.Authenticating computer issues a challenge to Alice.Alice types in challenge into readerless smart card.Readerless smart card solves the challenge.After Alice puts in her password.Alice transfers the answer to the computer.Human Machine AuthenticationBiometricsRetinal scannerFingerprint readerFace recognitionIris scannerHandprint readersVoiceprintsKeystroke timingSignaturesAuthentication Security PolicyDefining Protection LevelsPartitioning Computing ResourcesUsually necessary (law) to have special security for sensitive areas:Human
View Full Document