Chapter V Authentication
Definition of Authentication
• Authentication can be defined in two contexts
– The first is viewing authentication as it relates to access control
– The second is to look at it as one of the three key elements of security—authentication, authorization, and accounting
Authentication and Access Control Terminology
• Access control is the process by which resources or services are granted or denied
• Identification
– The presentation of credentials or identification
• Authentication
– The verification of the credentials to ensure that they are genuine and not fabricated
• Authorization
– Granting permission for admittance
• Access is the right to use specific resources
Authentication, Authorization, and Accounting (AAA)
• Authentication in AAA provides a way of identifying a user
– Typically by having them enter a valid password before granting access
• Authorization is the process that determines whether the user has the authority to carry out certain tasks
– Often defined as the process of enforcing policies
• Accounting measures the resources a user “consumes” during each network session
• The information can then be used in different ways:
– To find evidence of problems
– For billing
– For planning
• AAA servers
– Servers dedicated to performing AAA functions
– Can provide significant advantages in a network
Authentication Credentials
• Types of authentication, or authentication credentials
– Passwords
– One-time passwords
– Standard biometrics
– Behavioral biometrics
– Cognitive biometrics
One-Time Passwords
• Standard passwords are typically static in nature
• One-time passwords (OTP)
– Dynamic passwords that change frequently
– Systems using OTPs generate a unique password on demand that is not reusable
• The most common type is a time-synchronized OTP
– Used in conjunction with a token
• The token and a corresponding authentication server share the same algorithm
– Each algorithm is different for each user’s token
• There are several variations of OTP systems
• Challenge-based OTPs
– Authentication server displays a challenge (a random number) to the user
– User then enters the challenge number into the token
• Which then executes a special algorithm to generate a password
– Because the authentication server has this same algorithm, it can also generate the password and compare it against that entered by the user
Standard Biometrics
• Standard biometrics
– Uses a person’s unique characteristics for authentication (what he is)
– Examples: fingerprints, faces, hands, irises, retinas
• Types of fingerprint scanners
– Static fingerprint scanner
– Dynamic fingerprint scanner
• Disadvantages
– Costs
– Readers are not always foolproof
Behavioral Biometrics
• Behavioral biometrics
– Authenticates by normal actions that the user performs
• Keystroke dynamics
– Attempt to recognize a user’s unique typing rhythm
– Keystroke dynamics uses two unique typing variables
• Dwell time
• Flight time
• Voice recognition
– Used to authenticate users based on the unique characteristics of a person’s voice
– Phonetic cadence
• Speaking two words together in a way that one word “bleeds” into the next word
• Becomes part of each user’s speech pattern
• Computer footprint
– When and from where a user normally accesses a system
Cognitive Biometrics
• Cognitive biometrics
– Related to the perception, thought process, and understanding of the user
– Considered to be much easier for the user to remember because it is based on the user’s life experiences
• One example of cognitive biometrics is based on a life experience that the user remembers
• Another example of cognitive biometrics requires the user to identify specific faces
Authentication Models
• Single and multi-factor authentication
– One-factor authentication
• Using only one authentication credential
– Two-factor authentication
• Enhances security, particularly if different types of authentication methods are used
– Three-factor authentication
• Requires that a user present three different types of authentication credentials
• Single sign-on
– Identity management
• Using a single authenticated ID to be shared across multiple networks
– Federated identity management (FIM)
• When those networks are owned by different organizations
– One application of FIM is called single sign-on (SSO)
• Using one authentication to access multiple accounts or applications
• Windows Live ID
– Originally introduced in 1999 as .NET Passport
– Requires a user to create a standard username and password
– When the user wants to log into a Web site that supports Windows Live ID
• The user will first be redirected to the nearest authentication server
– Once authenticated, the user is given an encrypted time-limited “global” cookie
• Windows CardSpace
– Feature of Windows that is intended to provide users with control of their digital identities while helping them to manage privacy
– Types of cards
• Manage cards
• Personal cards
• OpenID
– A decentralized open source FIM that does not require specific software to be installed on the desktop
– A uniform resource locator (URL)-based identity system
• An OpenID identity is only a URL backed up by a username and password
• OpenID provides a means to prove that the user owns that specific URL
Authentication Servers
• Authentication can be provided on a network by a dedicated AAA or authentication server
• The most common type of authentication and AAA servers are
– RADIUS, Kerberos, TACACS+, and generic servers built on the Lightweight Directory Access Protocol (LDAP)
RADIUS
• RADIUS (Remote Authentication Dial in User Service)
– Developed in 1992
– Quickly became the industry standard with widespread support
– Suitable for what are called “high-volume service control applications”
• With the development of IEEE 802.1x port security for both wired and wireless LANs
– RADIUS has recently seen even greater usage
• A RADIUS client is typically a device such as a dial-up server or wireless access point (AP)
– Responsible for sending user credentials and connection parameters in the form of a RADIUS message to a RADIUS server
• The RADIUS server authenticates and authorizes the RADIUS client request
– Sends back a RADIUS message response
• RADIUS clients also send RADIUS accounting messages to RADIUS servers
Kerberos
• Kerberos
– An authentication system developed by the Massachusetts Institute of Technology (MIT)
– Used to verify the identity of networked users
• Kerberos process
– User is provided a ticket that is issued by the Kerberos authentication server
– The user presents this ticket to the network for a service
– The service then examines the ticket to verify the identity of the user
Terminal Access Control Access Control System (TACACS+)
• Terminal Access Control Access Control System (TACACS+)
– An industry standard protocol specification that forwards username and password information to a centralized server
• The centralized server can either be a TACACS+ database
– Or a database such as a Linux or UNIX password file with TACACS protocol support
Lightweight Directory Access Protocol (LDAP)
• Directory service
– A database stored on the network itself that contains information about users and network devices
• X.500
– A standard for directory services
– Created by ISO
• White-pages service
– Capability to look up information by name
• Yellow-pages service
– Browse and search for information by category
• The information is held in a directory information base (DIB)
• Entries in the DIB are arranged in a tree structure called the directory information tree (DIT)
• Directory Access Protocol (DAP)
– Protocol for a client application to access an X.500 directory
– DAP is too large to run on a personal computer
• Lightweight Directory Access Protocol (LDAP)
– Sometimes called X.500 Litea
– A simpler subset of DAP
• Primary differences
– LDAP was designed to run over TCP/IP
– LDAP has simpler functions
– LDAP encodes its protocol elements in a less complex way than X.500
• LDAP is an open protocol
Extended Authentication Protocols (EAP)
• Extensible Authentication Protocol (EAP)
– Management protocol of IEEE 802.1x that governs the interaction between the system, authenticator, and RADIUS server
– An “envelope” that can carry many different kinds of exchange data used for authentication
• The EAP protocols can be divided into three categories:
– Authentication legacy protocols, EAP weak protocols, and EAP strong protocols
Authentication Legacy Protocols
• No longer extensively used for authentication
• Three authentication legacy protocols include:
– Password Authentication Protocol (PAP)
– Challenge-Handshake Authentication Protocol (CHAP)
– Microsoft Challenge-Handshake Authentication Protocol (MS-CHAP)
EAP Weak Protocols
• Still used but have security vulnerabilities
• EAP weak protocols include:
– Extended Authentication Protocol–MD5 (EAP-MD5)
– Lightweight EAP (LEAP)
EAP Strong Protocols
• EAP strong protocols include:
– EAP with Transport Layer Security (EAP-TLS)
– EAP with Tunneled TLS (EAP-TTLS) and Protected EAP (PEAP)
Remote Authentication and Security
• Important to maintain strong security for remote communications
– Transmissions are routed through networks or devices that the organization does not manage and secure
• Managing remote authentication and security usually includes:
– Using remote access services
– Installing a virtual private network
– Maintaining a consistent remote access policy
Remote Access Services (RAS)
• Remote Access Services (RAS)
– Any combination of hardware and software that enables access to remote users to alocal internal network
– Provides remote users with the same access and functionality as local users
Virtual Private Networks (VPNs)
• Virtual private network (VPN)
– One of the most common types of RAS
– Uses an unsecured public network, such as the Internet, as if it were a secure private network
– Encrypts all data that is transmitted between the remote device and the network
• Common types of VPNs
– Remote-access VPN or virtual private dial-up network (VPDN)
– Site-to-site VPN
• VPN transmissions are achieved through communicating with endpoints
• Endpoint
– End of the tunnel between VPN devices
• VPN concentrator
– Aggregates hundreds or thousands of multiple connections
• Depending upon the type of endpoint that is being used, client software may be required on the devices that are connecting to the VPN
• VPNs can be software-based or hardware-based
• Software-based VPNs offer the most flexibility in how network traffic is managed
– Hardware-based VPNs generally tunnel all traffic they handle regardless of the protocol
• Generally, software based VPNs do not have as good of performance or security as a hardware-based VPN
• Advantages of VPN technology:
– Cost savings
– Scalability
– Full protection
– Speed
– Transparency
– Authentication
– Industry standards
• Disadvantages to VPN technology:
– Management
– Availability and performance
– Interoperability
– Additional protocols
– Performance impact
Remote Access Policies
• Establishing strong remote access policies is important
• Some recommendations for remote access policies:
– Remote access policies should be consistent for all users
– Remote access should be the responsibility of the IT department
– Form a working group and create a standard that all departments will agree to
Summary
- Access control is the process by which resources or services are denied or granted
- There are three types of authentication methods
- Authentication credentials can be combined to provide extended security
- Authentication can be provided on a network by a dedicated AAA or authentication server
- The management protocol of IEEE 802.1x that governs the interaction between the system, authenticator, and RADIUS server is known as the Extensible Authentication Protocol (EAP)
- Organizations need to provide avenues for remote users to access corporate resources as if they were sitting at a desk in the office
Thanks ..........
