Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Information security > Authentication and access control > Flashcards

Authentication and access control Flashcards

1
Q

Define closed design

A

A type of design where the actual algorithms, and implementation itself are kept secret.
However, secrecy is not the same as security, and a closed design will not be considered secure just because of the secrecy aspect.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is open design (Kerckhoffs principle) ?

A

The implementation, design pattern or algorithm themselves are known, but the system uses a secret input (a key) that is required for en- and decryption.
This allows for algorithms to be public without causing any data leak

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is cryptanalysis?

A

A type of attack where an attacker tries to find out the secret key.
An example is when the attacker has access to the plain text and the ciphertext, and attempts to figure out the key based on these.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a brute force attack?

A

A cryptanalysis attack where an attacker tries to guess a secret key by checking all possible keys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How can you protect against brute force attacks?

A

Making sure the key space is so big that an attacker wouldn’t be able to go through them all.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What happens during a man-in-the-middle attack

A

If we have to subjects, A and B, communication. A third subject C can place themselves in the middle of A and B, and by doing they pretend to be subject B for A, and pretends to be subject A for B.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is symmetric key cryptography?

A

The sender and the receiver share a common key.
Encryption and decryption is done by using this key.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the main functions of symmetric key cryptography?

A

Need a routine, or a way, of generating the shared key.
Need a safe channel to communicate the key between the two trusted parties
Routine for encryption
Routine for decryption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is One Time Pad?

A

The key is the length of the plaintext, and randomly generated.
Exclusive “or” is used on the plaintext from the key.
If an attacker tries to compute a message from the ciphertext, they wouldn’t know when they have the original message. Every possible message that can be computed from the cypher text is just as likely to be the plaintext.
Provides complete secrecy in theory

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why is the One Time Pad not widely used?

A

The burden of creating the keys itself is so big that it is no longer practical.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What algorithms is a symmetric cryptography cryptosystem composed of?

A

KeyGen(L): Key generating algorithm, L: length of key
Enc(K,M) -> C: Encryption algorithm, K:Key, M:Message, returns C:Ciphertext
Dec(K,C) -> M: Decryption algorithm: K: Key, C: Ciphertext, M:Message

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Describe the Caesar cipher(Shift cipher)

A

Each letter is shifted a certain number of places down the alphabet.
Enc = M + K(mod 26)
Dec = C - K(mod 26)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Why isn’t the Caesar cipher secure?

A

Small key space - number of letters in the alphabet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is DES (Data encryption standard)?

A

Internal structures: Feisel, S-boxes, permutations, shifts, XORs
Should not be used - not secure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is triple DES?

A

An decryption algorithm using three DES operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is AES (Advanced encryption standard)?

A

Todays standard when using symmetric cryptography

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Name 6 symmetric key ciphers, and what they are used for.

A

IDEA: Used in PGP
Blowfish: Password hashing in OpenBSD
RC4: (used in WEP), RC5
Double DES, Triple DES
SAFER: Bluetooth
AES: Pervasive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is asymmetric cryptography (public key cryptography)?

A

Every user has two keys
Public key (E): Released to everyone who wants to send a message, used for encryption
Private key (D): Known only to the user using it, used for decryption
The need to share secrets between the communicating parties is alleviated.

You release your public key to the world. People use the public key to encrypt the messages. Only you, with the private key, can decrypt the messages.

Because of how the decryption- and encryption systems work with public key cryptography, these processes are slower than during symmetric key cryptography

Requires very large key spaces. This is because there aren’t that many prime numbers. Minimum 2048 bit key space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are two problems with symmetric cryptography, that asymmetric cryptography alleviates?

A

When using symmetric cryptography system, the communicating subjects first need to share the key over a channel, meaning it is very important to ensure this channel is safe. When using public key cryptography there is no need to share keys, removing this problem.

Also, for every N subjects that want to communicate, there is a need for N squared keys in the system. This number will increase quickly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What concept is very important in asymmetrical cryptography, and widely used in asymmetrical cryptography algorithms,

A

If you have a very large prime number, that is a product of two other primes, it is very difficult to figure out which two primes make up the factors.

For example, a private key would contain information about the two primes, whereas the public key could be any number which would later be used to compute inverses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What concept is very important in asymmetrical cryptography, and widely used in asymmetrical cryptography algorithms,

A

If you have a very large prime number, that is a product of two other primes, it is very difficult to figure out which two primes make up the factors.

For example, a private key would contain information about the two primes, whereas the public key could be any number which would later be used to compute inverses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the components of an asymmetric cryptography system?

A

KeyGen(L): Return K_pub, K_priv
Enc(K_pub, M) -> C
Dec(K_priv, C) -> M

NB: given K_pub, it is extremely difficult to compute K_priv

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How does digital signatures work?

A

Encryption is done by using a private key, and decryption is done by using the public key.

C = Enc(K_priv, M)
M = Dec(K_pub, C)

This means that everyone can in fact read the message sent, as everyone will have access to the public key. However, no one would be able to substitute the original message with their own, as they do not have the private key to encrypt their own message.

Because of this, digital signatures can be used to confirm the identity of the sender.

Digital signatures work slow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the properties of cryptographic hash functions?

A
  • Can apply to data of any length
  • Output is fixed length
  • Relatively easy to compute h(x), given x
  • Deterministic, given the same x - h(x) will always output the same
  • One-wayness property: Infeasible to get x, given h(x)
  • Weak-collision resistance property: Given x, infeasible to find y such that h(x) = h(y)
  • Strong-collision resistance property: Infeasible to find any pair x and y, such that h(x) = h(y).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How often does collisions occur?

A

For a hash of length n bits, a collision can be found in 2^(n/2) trials

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How is hashes and digital signatures combined?

A

As creating a digital signature for a large message is an expensive process, we first create a hash of the data, and then a digital signature of that hash.
The clear text message is then sent along with the signed hash value of the text.

h = H(m), hash of message
S = Enc(K_priv, h), hash signature

The reciprient can then calculate the hash of the message and see if it matches:

h = H(M)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is PKI? (Public key infrastructure)

A

A system for key distribution.
A PKI is a trusted server that will create signatures and sign things for their users.

Digital certificates are one of the fundamental building blocks of PKI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is digital signatures?

A

A mathematical scheme for verifying the authenticity of digital messages and documents.
A digital signature upholds properties of both authentication and integrity, by providing a strong reason for the recipient to know that the message indeed came from the given sender, and that the message was not altered in transit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Describe the steps of signing some data with a digital signature.

A

Data -> hash function -> hash

S = Enc(K_priv, hash), create signature by encrypting the hash

Send signature + data = Digitally signed data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Describe the steps of verifying data that is signed with a digital signature.

A

First run the data through the has function.
H(M) = h

Then decrypt the signature with the signers public key.
Dec(S, K_pub) = h

Check if the two hashes are equal, only then can the data be verified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a digital certificate and what does it contain?

A

An electronic document proving ownership of a public key.
Contains:
- Information about the key
- Information about the identity of the owner (subject)
- The digital signature of an entity that has verified the certificate’s contents (issuer)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How is digital certificates used in PKI systems

A

PKI servers does not only need to verify who a message came from. They also need to provide information about the public keys themselves. For example, if and key have an expiration date, and when this might be.

A CA (Certification Authority) signs digital certificates and attest for the key and give information about this key.
This information includes things like
- why you know that this is a certain subject’s key.
- Who issued them
- Version number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How can PKIs be structured in a hierarchical way?

A

Have one CA that gives out certificates to all serves, devices and computers you want to issue them for.

CA -> User certificate, Server certificate, Device certificate

In practice, it is too burdensome for only one CA to handle all the certificates, making it more practical to implement multi-level hierarchies.

The root CA has the authority to issue certificates for certain entities. This entities can their own CA’s that can issue certificates to other sub-entities

Root CA -> CA_1, CA_2, User
CA_1 -> User_1, User_2, User_3
CA_2 -> User_4, User_5, User_6

PKI’s can use cross-certification, where two CA sign for each other. Trusting one of them will automatically lead to trusting the other
CA_1 - CA_2
CA_1 -> user1, user2, user 3
CA_2 -> user4, user5, user6

PKI’s can use bridge CA, where one CA acts as a bridge that certifies all the other CA’s, and all the others certify the bridge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How is certificates validated in practise where multi-level CA hierarchies are used?

A

The software will use Trust Path Building.

The software that is going to validate the certificate (browsers, etc..) are often pre-installed with a set of trusted certificates.
The software will then see if it can find a path of certificates from one of the certificates it trusts, down to the certificate the software is trying to get to. (Follow a chain of trust).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How is certificates validated in practise where multi-level CA hierarchies are used?

A

The software will use Trust Path Building.

The software that is going to validate the certificate (browsers, etc..) are often pre-installed with a set of trusted certificates.
The software will then see if it can find a path of certificates from one of the certificates it trusts, down to the certificate the software is trying to get to. (Follow a chain of trust)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is cross certification?

A

Cross certification is when two CA’s sign for each other. Meaning, that if either of them is in a system’s trusted CA’s, you will be able to follow a trust path from them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is Bridge CA?

A

When one CA operates as a hub, or a bridge CA, that sits in the middle of a lot of trust relationships. Meaning it validates a lot of CA’s and all the other CA’s certifies this bridge.
This structure does put a lot of paths through one CA, potentially causing issues

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What components does PKI’s contain?

A

Certificate authority (CA): Responsible for issuing certificates
Registration authority (RA): Verifies the identity of the individual requesting a certificate
Certificate repository and revocation information: Hold information about which certificates are still valid

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What does the registration authority do in PKI’s?

A

Verifies the identity of the subject requesting a certificates.
Tries to figure out why we would belive that the subject is who they say they are.

A subject or user would communicate directly to the registration authority by providing authentication of who you are, so you can obtain a certificate. How this authentication happen varies based on what type of certificate you are getting.

Registration authorities can be people but also machines and software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

In what situations would it be necessary to revoke a certificate?

A

If private keys have been compromised.
Certification information is no longer valid.
KeyGen algorithm has been proven insecure.
Encryption algorithm has been proven insecure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is a Certificate Revocation List (CRL) ?

A

A certificate that list who you revoke trust in.
For each certificate in the list, its serial number, the time of revocation and reason for revocation is listed.
The CA will then sign it and communicate that these should no longer be trusted.
A system would need to download this list.
The CRL contains information about the key, which trust should be revoked, revocation data and signature.
Is released at a CDP (CRL Distribution Point)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Describe the revocation timeline

A

Key compromise event - Certification revocation request - CA signs Certificate revocation - new CRL is issued communicating to users the certificate can’t be used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are some issues with CRL’s?

A

The revocation process takes a lot of time, burdensome, doesn’t work well in practise.
CRL’s can be generated very slowly because of how some CA’s may operate.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is the Online Certificate Status Protocol (OSCP)?

A

A server tells you if a certificate has been revoked.
Preferable compared to CRL’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What are some issues with OSCP?

A

Additional cost for having the system be online all the time.
Certificates being stale

44
Q

What does CA’s do (Certificate authority)?

A

Do not generated keys.
Organisations will generate keys, and then go to a CA to prove that they own that key-pair.
CA’s will then provide and sign the organisation a certificate that states that the organisation does in fact own that key pair.

45
Q

Define authentication

A

Authentication is when you prove your identity to another actor

46
Q

What is the 3-step challenge-and-response process in authentication

A

User claims an identity (often by providing a username)
The server challenges the user by asking for a password
The user supplies this password as proof of identity

47
Q

What are the three categories of authentication?

A
  1. Something you have
  2. Something you are
  3. Something you know
48
Q

Describe the “Something-you-have” chategory of authentication

A

A person wouldn’t leave their home without their phone. Because of this the phone can be used as a form of authentication, just because of the fact that you would always bring it.

When you have the key to your house, you authenticate that you in fact are the owner of the house.

Drawback: Phone/key could be stolen

49
Q

Describe the “Something-you-are” category of authentication

A

Use biometrics to identify
Face, fingerprints, DNA, voice recognition

50
Q

Describe the “Something-you-know” category of authentication

A

Passwords
It’s very scalable and people understand how to use them well.

Drawbacks:
- Difficult to create strong passwords, password reuse
- People can figure out you password (look over your shoulder, etc.)

51
Q

How are passwords stored

A

Only the password hash is stored

52
Q

How did passwords use to be verified?

A

A password has was stored on creation.
During authentication, a user provides the password and its hash is then compared to the hashed stored. Only if the hashes are identical, authentication would be granted.

Drawbacks:
- Vulnerable to Dictionary attacks: Someone creates a dictionary of common passwords and their hashes. If there is a memory leak of passwords, you can then compare the hashes to the ones in the dictionary and by that figure out the passwords.

53
Q

What are rainbow tables?

A

Uses pre-computed hash chains (hash-reduce-hash-reduce…)
- You have the original hash function
- You have a reduce function (does not invert the hash. Takes the
hash and reduces it to some plain text - not the original though)

Only the first and the last word of the hash chain is stored (start word and the final reduced word)

54
Q

How does the rainbow table algorithm work?

A

You have a hash, and want to find the password for this hash.

Reduce the hash (this gives you some plaintext)
Compare with endpoint in rainbow table
Hash and reduce until the endpoint is found
Entry found, load starting value
Hash and reduce the starting value until the hash is the same as the hash you started with in the beginning (the provided hash value is found)
The final reduced value is the password - the word that gave the hash

55
Q

How do we defend against rainbow tables?

A

Salt hashes
Salts are random values that are put with the plaintext password, before the password is hashed.
What is stored is the random salt and the hash.
An attacker can no longer pre-compute the hashes of common paswords

56
Q

How are salted password verified?

A

A plaintext password is provided with the stored salt.
These are then hashed and compared to the stored hash.

57
Q

What is a common issue with authentication by something we know?

A

Weak password, password reuse
Attacks: Dictionary attack, rainbow table attack

58
Q

How can we nudge users into using better passwords?

A

Enforcing password policies (min 8 signs, upper and lowercase, …)

59
Q

What are todays threats to passwords

A

Phising
Malware
Online bruteforce (go to a site and trying passwords until you find the right one)
Offline brute force attacks

60
Q

Describe offline password attacks

A

The password file must leak and be undetected
- If leak is detected - the password can be reset and the offline attack is ineffective
The leak can result in you getting:
- Plaintext password (offline attack unneeded, you have the password)
- Unsalted and hashed (Rainbow table lookup)
- Salted and hashed (Offline bruteforce attack)
- Reversibly encrypted (decryption key leak: offline attack unneeded - have plaintext, decryptioin key unleaked: offline attack not possible)

61
Q

What is an offline bruteforce attack

A

Password attack used on hashed and salted passwords.
Can be mitigated by having strong, and long passowrds.

62
Q

What are password meters?

A

Indicators of how strong a password is.
Giving feedback to the user during creation time

63
Q

What are some of the results found of using password meters

A

Users choose longer passwords
Decrease guessability of passwords

64
Q

What are graphical passwords?

A

Three different approaches:
- recognition: presented with different images, and you must remember your own
recall: user remember their visual
cued recall: prompted with a picture and then have to interact with it

Advantage:
- Easier to remember images than words
- Visual objects seems to offer a larger set of usable passwords

65
Q

What are som weaknesses with graphical passwords

A

Interaction with photos are psychological and culturally biased - behaviour can be predicted

Make FOA maps (focus-of-attention): Images can be prosessed and estimate where the image is likely to be clicked

66
Q

What is a FOA map?

A

Focus-of-attention map
Gives probability of each estimated click point on an image
Calculated probability based on low-level properties (contrast, color)

67
Q

What is biometric authentication

A

Something-we-are

Biometric: Biological characteristic that can identify an individual

Authentication based on identifying characteristic of the user
(face, fingerprint, voice, …)

Two groups: behavioural biometrics and physical

68
Q

What are the 4 properties that qualifies something to be a biometric?

A

Universal (everyone must have it)
Distinctiveness (limited to you, nobody should have the same as you)
Permanence (the characteristic should stay the same over time)
Collectability

69
Q

What are some issues in a practical biometric system

A

Performance: If the system takes a long time to log in, nobody would want to use it

Acceptability: The biometric must be acceptable, nobody would want their DNA to be used to log into facebook

Circumvention: The biometric system shouldn’t be able to be circumvented. I.e if you don’t have a camera and a fingerprint scanner - just use your password. The system is now circumvented.

Biometric systems are in practise pattern recognition systems: the biometric will not be exact every time it is measured (noice in sensor, noice in biometric - dirty fingerprint). The system must allow biometrics that are close enough to the original to be accepted

70
Q

Which requirements should a biometri system meet?

A

Accuracy
speed
resource requirement
Harmless to user
accepted by intended population
sufficient robust to various attacks

71
Q

What is the pipeline of a biometric system

A

Sensor module
Feature module: Take raw data and extract meaning from it
Matcher module: Try to find a match in the database
System database module: Stores biometric

72
Q

What is the verification mode of a biometric system?

A

The user provides an identity and a biometric to prove the identity.
System checks if biometric belong to the identity provided

login -> feature extraction -> matcher <- System database sends ONE template

73
Q

What is the identification mode of biometric systems?

A

No identity is being claimed, only the biometric is sent.
The system will check if the biometric is stored in the database

login ->feature extraction -> matcher <- database sends N template

74
Q

What errors can occur in biometric systems?

A

Can get a false match: The biometric matches the wrong individual
Can get a false non-match: The biometric doesn’t match the true identity
FTC: Failure to capture (sensor doesn’t et a good enough reading)
FTE: Failure to enroll (provided data doesn’t give a good enough match that a security decision can be made)

75
Q

Name one way biometric systems are different from passwords

A

The system aren’t looking for an exact match, in a way passwords has to be exact.

The system will use pattern recognition to find a match that is close enough

76
Q

In what way does biometric systems use hypothesis

A

H_0: Input X_Q does not come from the same person as the template X (this is the null-hypothesis)

H_1: Input X_Q comes from the same person as the template X
(the alternative hypothesis)

The system then make decisions based on the hypothesis:
- D_0: person is not who they claim to be
- D_1: The person is who they claim to be

Look at input:
S(x_Q, X_I) >= t, then D_1, else D_0

(If the similarities between the input and the template is above a threshold)

77
Q

Define a false match in mathematical terms

A

D_1 when H_0

The decision D_1 (person is who they claim to be) is made when in reality the null hypothesis H_0 is correct

78
Q

Define a false non-match in mathematical terms

A

D_0, when H_1

The decision D_0 (person is not who they claim to be) is made when in reality the alternative hypothesis H_1 is correct

79
Q

What is FMR?

A

The probability o a false-match error happening is biometric systems

FMR = P(D_1 | H_0)

80
Q

What is FNMR?

A

The probability of a false non-match error happening in biometric systems

FNMR= P(D_0 | H_1)

81
Q

What is behavioural biometrics

A

How you talk, walk, type, etc…

82
Q

What are the three groups of application of biometric systems

A

Commercial (What users use often, credit card, cellular phone, atm)
Government (id card, drivers licence, passport control, hightened threat model )
Forensic (terrorist identification, missing person)

83
Q

What are some disadvantages with using biometric systems?

A

Speed: Can be slow to compute
FMR will increase when scaling up the amount of users
Irrevocability - if a data leak happens, people can’t change their biometrics

84
Q

What are some limitations of unimodal biometric systems

A
  • Noise in sensed data
  • Distinctiveness: The first measure might not be distinctive. E.g if you only measured parts of you fingerprint
  • Spoof attacks: Your biometric gets measured and stored somewhere else and then put to use (fingerprint on glass)
85
Q

What are multimodal biometric systems

A

Take multiple measurements of biometric and combine them

This fusion can happen on sensor level, feature, opinion or decision level

86
Q

What three combination strategies can be used in multimodal biometric systems

A

Fixed rules: Everything gets equal weight
Trained rules: Uses different classifiers, unequal weight
Adaptive rules: Adaptive weight

87
Q

What are som issues with decision level fusion?

A

During decision level fusion, each classifier has defined a class for the measurement, or given weight to the possible classes based on the measurement.

When combining the output from the different classifiers there might be some ties

88
Q

What is AND-combination?

A

Improves the False-Acceptance-Ration
System 1 -> AND -> System 2

The AND must be true
Ex. fingerprint AND face must match

89
Q

What is OR-combination?

A

Improves the False-Rejection-Ration
Either this OR this

90
Q

How can you mitigate data leakage in biometric systems

A

A problem with biometric data leaking is that it is inrevokable. A person cannot get a new DNA or a fingerprint.

To protect against this template protection can be used. Here, the biometric is measured by the sensor, registered and then processed before it is stored. If a leakage would occur, the processed template would leak and not the biometric itself. This template is revokable, because you can change the method for processing the template.

91
Q

What are the three categories of template protection?

A

Straight feature protection
Key-generating

Key-binding

92
Q

What is straight feature protection?

A

Protect the features by using a transformation on the biometric. The template stored is an irreversible transformation of the biometric

93
Q

What is key generating

A

The biometric goes into a keyGen or hashing algorithm, and out comes a key

94
Q

What is key binding?

A

Biometric cryptosystem that binds key data with the biometric data. You generate a random key at enrollment, and mix that with the biometric in a way that is reversible.
During verification, you supply the biometric to the template and remove it to see if you are left with the correct key.

95
Q

What is robust hashing?

A

Maps two similar inputs to the same hash value
One way
error tolerant (if reading is little off, you still get same hash)
easy to generate
Scalability (collision free)

96
Q

What is fuzzy vaults?

A

A key-binding approach
Start with a numerical secret that can be broken down to a polynomial
During enrollment, minutiae from the fingerprints are plotted on the polynomial.
Now the graf is just a mess of points based on the minutiae - chaf points that are hiding the polynomial

During verification you take the same minutiae from the fingerprint and remove it from the graph, to get back the secret polynomial

97
Q

What is fuzzy commitment

A

Key-binding approach
Have a codeword C that is encoded in binary
Then you use a fixed length biometric feature vector X (fingerprint, …)
A commitment is then made by XOR-ing X with C
A hash of C and the commitment is stored in the database

98
Q

What are the recognition techniques used in behavioural biometric systems?

A

Example: touch recognition

Data alignment:
- x- and y-coordinates for touch during different time
- How is the specific fingers moving, are they crossing or just going up and down?
Distance function
Dissimilarity score

99
Q

What is two factor authentication?

A

When you combine two out of the three types of authentication
(something you are, -have, -know)

100
Q

What are software OTPs (one time password)

A

A password is generated and sent to you (your phone etc.)
Is event based - the moving factor is triggered by an event

101
Q

What is hardware OTPs?

A

You have a token that contains a number, and then you provide that number to be verified by an authentication service.

Time based OTP - moving factor is time

OTP is changing on the hardware token and the server at the same time interval

102
Q

What is Kerberos?

A

A protocol for authentication based on tickets.
Relies on a key server, that provides third party authentication in a distributed network.
The access control based on the server is used to access the computer resources in the network

103
Q

Define access control

A

A series of mechanisms that specify what a user can do, which resources they can access and what operations they can perform on the system.

Restrain behaviour, use and content of a system.

104
Q

What are the three functions that access control must serve in order to be successful?

A

Identification, authentication and authorization

105
Q

What is identification?

A

Identifying a subject based on a piece of public information, such as a username. Each username or identification information should be unique and should follow a standard naming scheme.
The value should be non-descriptive of the subject’s role or position - people often change position and tasks over time.

106
Q

What is authentication?

A

Proving the identity of a user, by using something the subject has, is or know.

107
Q

What is authorization?

A

Determining that the proven identity of a subject has some characteristics that gives them the right to access the requested object.
The access criteria can be thought of as roles or rules

108
Q

What is a reference monitor?

A

A secure, always-used and testable module that controls all access to data objects or devices.

It verifies the request against a table of allowable access typesfor each process on a system.

It should not be possible to bypass the reference monitor (always-used)

Subject request - > Reference monitor - > Deny / Grant requets
Policy - >

109
Q

What is discretionary access control (DAC)?

A

A system allows the owner of the objects to control which subjects has access to which objects.
Access control is at the discretion of the owner

110
Q

What is mandatory access control (MAC)?

A

Access based on a security labeling system.
Users have security clearance and objects has labels that contains data classifications.
Used when classification and confidentiality is very important.

Information security (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions