Chapter 4 – Protection in General-Purpose Operating Systems Section 4.5 User Authentication

In this section Authentication Passwords Effective passwords Breaking passwords One-Time Systems Biometrics

User Authentication Most software and OS base there security on knowing who the user is Authentication based on 1 of 3 qualities: Something the user knows – Passwords, PIN, passphrase Something the user has – Key, license, badge, username Something the user is – physical characteristics or biometrics Two forms of these can be combined together

Passwords as Authenticators Most common authentication mechanism Password – a word unknown to users and computers Problems with passwords: Loss Use – time consuming if used on each file or access Disclosure – if Malory finds out the password might cause problems for everyone else. Revocation – revoke one persons right might cause problems with others

Additional Authentication Information Placing other condition in place can enforce the security of a password Other methods: Limiting the time of access Limiting the location of access Multifactor Authentication is using additional forms of authentication The more authentication factors cause more for the system and administrator to manage

Attacks on Passwords Figuring out a password Try all possible passwords Try frequently used passwords Try passwords likely for the user Search for the system password list Ask the user Loose-Lipped Systems Authentication system leaks information about the password or username Provides information at inconvenient times

Exhaustive Attack Brute force attack is when the attacker tries all possible passwords Example: 26 (A-Z)character password of length 1 to 8 characters One password per millisecond would take about two months But we would not need to try every password

Password Problems Probable Passwords Passwords Likely for a user Weakness is in the users choice Weakness is in the control of the system Look at table 4-2 on page 225

Figure 4-15 Users’ Password Choices.

Password Selection Criteria Use characters other than just A-Z Choose long passwords Avoid actual names or words Choose an unlikely password Change the password regularly Don’t write it down Don’t tell anyone else – beware of Social Engineering

One-Time Passwords Password that changes every time Also known as a challenge-response systems F(x)=x+1 - use of a function F(x)=r(x) – Seed to a random number generator F(a b c d e f g) = b d e g f a c – transformation of a character string F(E(x))=E( D (E (x)) + 1 ) – Encrypt value must be decrypted and run through a function

The Authentication Process Slow response from system Limited number of attempts Access limitations Fixing Flaws with a second level of protection Challenge-Response Impersonation of Login

Biometrics Biometrics are biological authenticators Problems with Biometrics Still a relatively new concept Can be costly Establishing a threshold Single point of failure False positives Speed can limit accuracy Forgeries are possible