2.4 - Summarize authentication and authorization design concepts. Flashcards
- Directory services
*
Keep all of an organization’s usernames and passwords
in a single database
– Also contains computers, printers, and other devices
*
Large distributed database
– Constantly replicated
*
All authentication requests reference this directory
– Each user only needs one set of credentials
– One username and password for all services
*
Access via Kerberos or LDAP
- Federation
*
Provide network access to others
– Not just employees - Partners, suppliers, customers, etc.
– Provides SSO and more
*
Third-parties can establish a federated network
– Authenticate and authorize between the
two organizations
– Login with your Facebook credentials
*
The third-parties must establish a trust relationship
– And the degree of the trust
- Attestation
*
Prove the hardware is really yours
– A system you can trust
*
Easy when it’s just your computer
– More difficult when there are 1,000
*
Remote attestation
– Device provides an operational report to a
verification server
– Encrypted and digitally signed with the TPM
– An IMEI or other unique hardware component can be
included in the report
- Time-based one- time password (TOTP)
*
Time-based One-Time Password algorithm
– Use a secret key and the time of day
– No incremental counter
*
Secret key is configured ahead of time
– Timestamps are synchronized via NTP
*
Timestamp usually increments every 30 seconds
– Put in your username, password, and TOTP code
*
One of the more common OTP methods
– Used by Google, Facebook, Microsoft, etc.
- HMAC-based one-time password (HOTP)
*
One-time passwords
– Use them once, and never again
– Once a session, once each authentication attempt
*
HMAC-based One-Time Password algorithm
– Keyed-hash message authentication code (HMAC)
– The keys are based on a secret key and a counter
*
Token-based authentication
– The hash is different every time
*
Hardware and software tokens available
– You’ll need additional technology to make this work
- Short message service (SMS)
- Token key
- Static codes
*
Authentication factors that don’t change
– You just have to remember
*
Personal Identification Number (PIN)
– Your secret numbers
*
Can also be alphanumeric
– A password or passphrase
- Authentication applications
*
Pseudo-random token generators
– A useful authentication factor
*
Carry around a physical hardware token generator
– Where are my keys again?
*
Use software-based token generator on your phone
– Powerful and convenient
- Push notifications
*
Similar process to an SMS notification
– Authentication factor is pushed to a specialized app
– Usually on a mobile device
*
Security challenges
– Applications can be vulnerable
– Some push apps send in the clear
*
Still more secure than SMS
– Multiple factors are better than one factor
- Phone call
*
A voice call provides the token
– The computer is talking to you
– “Your code is 1-6-2-5-1-7.”
*
Similar disadvantages to SMS
– Phone call can be intercepted or forwarded
– Phone number can be added to another phone
- Smart card authentication
Integrated circuit card - Contact or contactless
*
Common on credit cards - Also used for access control
*
Must have physical card to provide digital access
– A digital certificate
*
Multiple factors
– Use the card with a PIN or fingerprint
Chapple 231
Weiss 324
Gibson 41
- Fingerprint
Chapple
Weiss
Gibson
- Retina
Chapple
Weiss
Gibson
- Iris
Chapple
Weiss
Gibson
- Facial
Chapple
Weiss
Gibson
- Voice
Chapple
Weiss
Gibson
- Vein
Chapple
Weiss
Gibson
- Gait analysis
- the way you walk
- Efficacy rates
- False acceptance
False acceptance rate (FAR)
– Likelihood that an unauthorized user will be accepted
– Not sensitive enough
- False rejection
False rejection rate (FRR)
– Likelihood that an authorized user will be rejected
– Too sensitive
- Crossover error rate
– Defines the overall accuracy of a biometric system
– The rate at which FAR and FRR r equal
– Adjust sensitivity to equalize both values
AAA - (Authentication, authorization, and accounting)
*
Identification
– This is who you claim to be
– Usually your username
*
Authentication
– Prove you are who you say you are
– Password and other authentication factors
*
Authorization
– Based on your identification and authentication,
what access do you have?
*
Accounting
– Resources used: Login time, data sent
and received, logout time
