2 Authentication - Access Control & Cryptography

1
SECURITY IN
COMPUTING,
FIFTH EDITION
Chapter 2: Toolbox: Authentication, Access
Control, and Cryptography
2
Authentication
• The act of proving that a
user is who she says she is
• Methods:
• Something the user knows
• Something the user is
• Something user has
3
Something You Know

• Passwords
• Security questions
• Attacks on “something you know”:
• Dictionary attacks
• Inferring likely passwords/answers
• Guessing
• Defeating concealment
• Exhaustive or brute-force attack
• Rainbow tables
4
Distribution of Password Types

5
Password Storage
Plaintext Concealed
6
Time it takes hackers to brute force passwords

7
Biometrics: Something You Are
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.
8
Problems with Biometrics

• Intrusive
• Expensive
• Single point of failure
• Sampling error
• False readings
• Speed
• Forgery
Recent advances in smartphones have begun to make biometrics cheaper

and easier to use.
Biometrics are still inadequate for extremely sensitive applications, but their
convenience makes them a great alternative to weak passwords.
9
Tokens: Something You Have

10
Federated Identity Management
A federated identity management scheme is a union of separate identification

and authentication systems. Authentication is performed in one place, and
separate processes and systems determine that an already authenticated user
is to be activated
11
Single Sign-On
Single sign-on lets a user log on once per session but access many different
applications/systems.
It often works in conjunction with federated identity management, with the federated
identity provider acting as the source of authentication for all the applications.
12
Access Policies
• Goals:
• Check every access
• Enforce least privilege
• Verify acceptable usage
• Track users’ access
• Enforce at appropriate
granularity
• Use audit logging to
track accesses
13
Implementing Access Control

• Reference monitor
• Access control directory
• Access control matrix
• Access control list
• Privilege list
• Capability
• Procedure-oriented access control
• Role-based access control
14
Reference Monitor
15
Access Control Directory

16
Access Control Matrix

17
Access Control List

18
Problems Addressed by Encryption

• Suppose a sender wants to send a message to a
recipient. An attacker may attempt to
• Block the message
• Intercept the message
• Modify the message
• Fabricate an authentic-looking alternate message
19
Encryption Terminology
• Sender
• Recipient
• Transmission medium
• Interceptor/intruder
• Encrypt, encode, or encipher
• Decrypt, decode, or decipher
• Cryptosystem
• Plaintext
• Ciphertext
20
A history of encryption
21
Encryption/Decryption Process
22
Symmetric vs. Asymmetric
23
Stream Ciphers
24
Block Ciphers
25
Stream vs. Block

26
DES: The Data Encryption Standard

• Symmetric block cipher
• Developed in 1976 by IBM for the US National Institute of
Standards and Technology (NIST)
27
AES: Advanced Encryption System
• Symmetric block cipher

• Developed in 1999 by
independent Dutch
cryptographers
• Still in common use
28
DES vs. AES

29
Public Key (Asymmetric) Cryptography

• Instead of two users sharing one secret
key, each user has two keys: one public
and one private
• Messages encrypted using the user’s
public key can only be decrypted using the
user’s private key, and vice versa
30
Secret Key vs. Public Key Encryption
31
Public Key to Exchange Secret Keys
32
Key Exchange Man in the Middle

33
Error Detecting Codes

• Demonstrates that a block of data has been modified
• Simple error detecting codes:
• Parity checks
• Cyclic redundancy checks
• Cryptographic error detecting codes:
• One-way hash functions
• Cryptographic checksums
• Digital signatures
Parity Check
34
One-Way Hash Function Digital Signature

35
Certificates: Trustable Identities and Public Keys
• A certificate is a public key

and an identity bound
together and signed by a
certificate authority.
• A certificate authority is an
authority that users trust to
accurately verify identities
before generating
certificates that bind those
identities to keys.
36
Certificate Signing and Hierarchy
HTTPS helps greatly in reducing the information

leaked to third parties. However, it does not
prevent tracking. Modern browser fingerprinting
techniques work even behind HTTPS. Security
Diana’s certificate is made using Edward’s researchers have developed a browser
signature. Delwyn’s certificate includes extension called HTTPS Everywhere that
Diana’s certificate so that it can effectively attempts to use HTTPS whenever possible and
be tied back to Edward, creating a chain of at the same time mitigate the use of
trust. fingerprinting techniques.
37
Cryptographic Tool Summary

38
What happens with URLs?

39
Summary
• Users can authenticate using something they know,
something they are, or something they have
• Systems may use a variety of mechanisms to implement
access control
• Encryption helps prevent attackers from revealing,
modifying, or fabricating messages
• Symmetric and asymmetric encryption have
complementary strengths and weaknesses
• Certificates bind identities to digital signatures

2 Authentication - Access Control & Cryptography

Uploaded by

Copyright:

Available Formats

2 Authentication - Access Control & Cryptography

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

2 Authentication - Access Control & Cryptography

Uploaded by

Copyright:

Available Formats

1

Something You Know

Distribution of Password Types

Time it takes hackers to brute force passwords

Biometrics: Something You Are

Problems with Biometrics

Recent advances in smartphones have begun to make biometrics cheaper

Tokens: Something You Have

Federated Identity Management

A federated identity management scheme is a union of separate identification

Implementing Access Control

Access Control Directory

Access Control Matrix

Access Control List

Problems Addressed by Encryption

Symmetric vs. Asymmetric

Stream vs. Block

DES: The Data Encryption Standard

AES: Advanced Encryption System

• Symmetric block cipher

DES vs. AES

Public Key (Asymmetric) Cryptography

Secret Key vs. Public Key Encryption

Public Key to Exchange Secret Keys

Key Exchange Man in the Middle

Error Detecting Codes

One-Way Hash Function Digital Signature

Certificates: Trustable Identities and Public Keys

• A certificate is a public key

Certificate Signing and Hierarchy

HTTPS helps greatly in reducing the information

Cryptographic Tool Summary

What happens with URLs?

You might also like