Stronger Authentication

By Ibrahim Patwekar Roll no 12 M.E. (Electronics) SAKEC

Introduction
User authentication is growing in importance in e-commerce Many organizations are calling for stronger authentication mechanisms than the typical password-based schemes
e.g., FFIEC guidance on authentication in Internet banking (Oct. 2005); FSTC Better Mutual Authentication project
10/22/2012 confidential 2

..
As these efforts illustrate, authentication strength depends on more than just the factors And the authentication story depends on more than just the user

10/22/2012

confidential

User Authentication Model

User Agent Resource

Evidence

Auth. Factors
Users Devices

Auth. Protocol

Forward Authentication Steps User and Users Devices present Evidence to Agent demonstrating possession of Authentication Factors

Agent conveys Evidence to Resource in Authentication Protocol

10/22/2012 confidential 4

Variations on the Model

Local authentication: User authenticates directly to resource, without agent e.g.: Log into PC. Authentication server: User authenticates once to authentication server, which relays ticket or authentication assertion to resource e.g.: Kerberos; Identity providers Validation server: Resource relies on separate validation server for part or all of authentication decision e.g.: Credential federation Contextual factors: Where & when did the protocol originate?
10/22/2012 5

Describing an Authentication Mechanism

An authentication mechanism is a ceremony* involving:
Selected authentication factors Particular evidence about those factors; and a Specific protocol for conveying the evidence

Simple authentication mechanism has one resource, one authentication decision

10/22/2012 confidential

Composing Authentication Mechanisms

Compound authentication mechanism combines two or more mechanisms more than one authentication decision Recursive composition: One mechanism enables access to factors of another
e.g.: Unlock smart card with PIN,
10/22/2012 confidential 7

.
Sequential composition: One mechanism adds to another e.g.: Authenticate to resource with password, then later with answers to life questions; Risk-based approaches

10/22/2012

confidential

Example Factors
Something you know:
Password / PIN Knowledge-based authentication

Something you have:

One-time password token Smart card / USB token Mobile phone

Something you are / can do:

Biometrics
10/22/2012 confidential 9

Example Authentication Protocols

Agent can send evidence directly to resource over secure channel
e.g.: Password over SSL/TL

Or, can prove knowledge of evidence

10/22/2012

confidential

10

Security Challenges
Corrupted agent can misuse evidence Rogue resource can also misuse evidence, unless agent runs strong protocol Man-in-the-middle is also a threat, depending on protocol Key question: How does user authenticate the resource and the agent?
10/22/2012 confidential 11

Resource Authentication Model

User Agent Resource

Evidence

Auth. Factors
Users Devices

Auth. Protocol

Reverse Authentication Steps

Resource demonstrates authenticity to Agent in Authentication Protocol

Agent presents Evidence of authenticity to User and Users Devices

10/22/2012

confidential

12

Resource Authentication Examples

1.Resource PKI
Resource authenticates to agent with certificate Agent presents evidence via lock icon, certificate status But how does user know lock is actually from agent? Also, certificate trust lists can easily be confused

10/22/2012

confidential

13

Resource Authentication Examples (contd)

2.Next one-time password
Resource authenticates to user by providing next one-time password (assumes user has OTP device as one factor) Agent presents next OTP directly to user But only authenticates that resource is present doesnt detect man-in-themiddle
10/22/2012 confidential 14

..
3. Dynamic security skins
Resource authenticates to agent with certificate Agent presents resource identifier via pattern based on hash of resource identifier

10/22/2012

confidential

15

Resource Authentication Examples (contd)

4. Watermark or user-selected image
Resource authenticates to user by providing a previously registered watermark or image Agent presents picture directly to user Again, doesnt detect man-in-the-middle

10/22/2012

confidential

16

Summary: Mutual User Authentication

Each approach to resource authentication has pros and cons in terms of usability, security against various threats Agent needs a trustworthy user interface*, otherwise user cant rely on evidence presented

10/22/2012

confidential

17


Resource should enable some evidence that the agent can present to user Rapport-building is important if user cant be sure that agent is running strong protocols
Contextual factors provide a foundation

10/22/2012

confidential

18

Related Example: RFID Tag Authentication

Radio-frequency ID tags tiny chips with antennas are used to track inventory, and increasingly to authenticate items
e.g.: Passports, containers, etc.

Authentication model is similar to user authentication:

User / Devices = RFID tag Agent = Reader 10/22/2012 confidential Resource = Back-end system

19

Conclusions
All parties need assurance that the others are authentic both the user or tag, and the system Obtaining this assurance is an important challenge in protocol design whether for e-commerce or physical objects Authentication is more than just about factors the evidence
10/22/2012 confidential 20

Contact Information
www.rsasecurity.com/rsalabs

10/22/2012

confidential

21

.
Thank you

10/22/2012

confidential

22