Presentation on theme: "Draft – 10/28/2008 14:00PM. Problem Summary SSN must be removed as a basis for identity verification for: Account Activation Password Change Password."— Presentation transcript:
Draft – 10/28/ :00PM
Problem Summary SSN must be removed as a basis for identity verification for: Account Activation Password Change Password Recovery SSN is currently the only near universal shared secret that can be used for identity verification.
Challenges Remote identity verification by shared secret requires: Secret that is accessible and usable by both individual and us Secret that is known only to the individual and us Private communications channel to share the secret Most alternatives to SSN currently fail one or both of the first two requirements. SSN almost always provides a reliable fallback of last resort. Alternative solutions require a compromise between positive identification and convenience.
Proposed Solution Summary Primary Verification Secret Question/Answer ( SQA ) generates temporary password sent through private communications channel ( PCC ) consisting of external e- mail, cellmail, and/or cell SMS communications. Secondary or Fallback Verification PCC or SQA only Helpdesk physical visit Supervisor voice verification Role based business/academic questions Webcam visual identification (raise two fingers) Voiceprint Fax picture identity card Postal mail Non-positive identification
Secret Question/Answer ( SQA ) The answers effectively form a password. A password that violates most best practices for passwords: Dictionary presence Public, personal, or guessable information Complexity rules Password change and history rules Answers may not be any more memorable than a password
Private Communications Channel (PCC) To add assurance to the poor SQA password, additional identity verification is carried out using a private communication channel. The PCC requires an additional, university independent user password and/or physical possession of an object. The “Private” in PCC is relative.
Private Communications Channel (PCC) External ( e.g. gmail, live ) Cellmail to Requires collection and storage of network information. Recently stopped. Not sure if all networks provide this service but most do. SMS Blackboard Connect? Campus SMS Gateway? Outsourced SMS Gateway? Voice? Blackboard Connect? Any cell option is well worth pursuing for benefits down the road in “two- factor” authentication and other uses. Inclusion in the solution at its outset is strongly recommended.
Accounts.university.edu Home Page Activate account for new users Change password for existing users Recover from forgotten password
Use Case – Activate Account – Primary Method Student or employee receives or postal mail upon acceptance with account name and URL: Accounts.university.edu/activate-step-1. Person visits accounts.university.edu/activate-step-1 with browser. Answers SQA ( filled in previously from student application or as yet unknown new employee/affiliate process ) Temporary password sent via PCC on record from student application or as yet unknown new employee/affiliate process. Contains URL accounts.university.edu/activate-step-2 Accounts.university.edu/activate-step-2 Enters ID and temporary password Chance to change SQA Security Awareness Change password PCC information verification ( correction leads to SA or HR self service pages )
Use Case –Change Password – Primary Method Accounts.university.edu/change Login Chance to review SQA questions and change Security Awareness Change password PCC information verification ( correction leads to SA or HR self service pages )
Use Case –Recover Password – Primary Method Accounts.university.edu/recover Enter ID SQA Temporary password sent via PCC on record from student application or as yet unknown new employee/affiliate process. Contains URL accounts.university.edu/recover-step-2 Accounts.university.edu/recover-step-2 Enters ID and temporary password Chance to change SQA Security Awareness Change password PCC information verification ( correction leads to SA or HR self service )
Basic Tradeoffs – Primary Methods More convenience Require only one of SQA or PCC Allow PCC More positive identification and security Require both SQA and PCC Require cell PCC
Tradeoffs – Recommendations for Primary Methods At roll-out: On-campus request Allow recovery with either SQA or PCC ( or cell ) individually for all parties Off-campus request: Allow recovery with or cell PCC by itself if student. Allow recovery with cell PCC by itself if employee. After stable: On-campus request Allow recovery with either SQA or PCC ( 0r cell ) individually if requested on-campus by all parties. Off-campus request Require both SQA and PCC. Cell PCC for employees. Cell or PCC for students.
Operational Overview – Fallback Verification Assumption: SQA and PCC unsuccessful/unavailable PCC or SQA only Helpdesk physical visit Supervisor voice verification Role based business/academic questions Webcam visual identification (hold up two fingers) Voiceprint Fax picture identity card Postal mail Non-positive identification
Use Case – Activate Account – Fallback Methods Postal mail to address of record with temporary password Physical helpdesk visit for employees Emergency vouch for identity and unregistered PCC on case by case basis Physical visit or academic questions for students Enrolled classes Grades Application information
Use Case – Recover Password – Fallback Methods Physical helpdesk visit Supervisor voice verification Helpdesk call Supervisor physical helpdesk visit Role based business/academic questions Helpdesk call Forwarded to student/employee/affiliate business analyst Classes, grades, HR info, ??? Postal Mail to Address on record
Basic Tradeoffs – Fallback Methods More convenience Allow third party vouch More security Require positive identification by physical visit
Tradeoffs – Recommendations for Fallback Methods Physical visit or supervisor vouch for employees or affiliates Physical visit or academic questions for students Enrolled classes Grades Residence hall Last resort (No physical access to university. No university vouch unavailable). Consideration must be given to sensitivity of account. Postal mail to address on record. Trust in third party vouch ( e.g. distance learning physical ID check, validated remote higher ed personnel physical ID check ) Webcam visual identification (raise two fingers) Fax picture identity card
Physical Helpdesk Visit Dedicated, locked down machine(s) Helpdesk checks ID Helpdesk logs into computer and enters user’s ID User goes through standard account activation process: SQA set Security Awareness Change password Verify PCC information ( change leads to SA or HR self service pages )
Helpdesk Computers Computer Security Controls Screensaver timeout Session timeout Kiosk style configuration lockdown No ability to backtrack through screens
Supervisor Vouch Helpdesk receives call, claimed identity, supervisor name, unregistered PCC. Helpdesk verifies supervisor and contact information. Confirms with supervisor over phone by helpdesk initiated call. Helpdesk logs in and initiates password recovery for claimed identity and unregistered PCC or Supervisor must physically visit helpdesk and do same Portal sends temporary password through unregistered PCC.
Architecture and Implementation New functions New data Policy vs programming Futures Migration Costs
New Portal Functions Ask/Verify/Set SQA Verify , cell phone, cell network. Redirect to SA or HR self service pages for change. Generate temporary password Generate /cellmail/SMS according to user preference and policy Receive temp password SQA set Security Awareness Change password Verify /SMS. Redirect to SA or HR self service pages for change.
New LDAP Data Cell number ( from peoplesoft ) Cell network ( from peoplesoft ) External address ( from peoplesoft ) PCC User Preference ( /cellmail/SMS ) SQA ( from collegenet/portal activation ) Temporary password and expiration date ( generated by portal ) Random salt for default password ( generated by managed- accounts ) Default Password - REDACTED ( generated by managed- accounts )
New Managed Accounts Functions CollegeNet -> JCC ( SQA, , cell, cell network ) Random default password salt -> LDAP for new accounts Default password -> LDAP for new accounts SQA, , cell -> LDAP for new accounts
Data Storage and Flow - SQA User selects questions and provides answers Collegenet application ( new students ) Hire process ( new employees ) Affiliate process ( new affiliates ) Portal ( existing population ) SQA for new students, employees, and affiliates loaded into LDAP LDAP becomes SOA All changes & administration done in portal
Data Storage and Flow - PCC User provides , cell#, cell network Collegenet application ( new students ) Hire process ( new employees ) Affiliate process ( new affiliates ) Portal ( existing population ) PCC data for new students, employees, and affiliates loaded into LDAP Peoplesoft remains SOA Portal uses LDAP for look-ups Portal directs user to SA or HR self service pages for changes
Data Storage and Flow – Default PW Managed accounts generates random salt for new accounts and stores in LDAP Managed accounts generates default password unique to individual using reproducible algorithm making use of random salt. Sets as password for new accounts. Accounts portal administrative console changes password of “disabled” accounts to default password.
Data Storage and Flow – Temp PW – PCC delivery Generated by portal on the fly Account activation User Password recovery Administrative recovery ( helpdesk, vouch, etc. ) Random, fourteen character string made up of easily read characters ( e.g. no ‘o’s, ‘0’s, ‘1’s, or ‘l’s ) Good for twenty-four hours Hashed, then stored in LDAP along with expiration date/time Sent via PCC Password accepted by portal in recovery/activation process part 2 Hashed and compared to LDAP value Check expiration date
Data Storage and Flow – Temp PW – Postal Delivery Generated by portal administrative interface Random, fourteen character string made up of easily read characters ( e.g. no ‘o’s, ‘0’s, ‘1’s, or ‘l’s ) Good for 10 days Hashed, then stored in LDAP along with expiration date/time Portal generates letter. Puts in queue. Daily process prints generated letters. Need envelope stuffing and mailing process. Send via Postal Mail Password accepted by portal in recovery/activation process part 2 Hashed and compared to LDAP value Check expiration date
SQA Recommendations Provide user with list of eight questions from which they must choose three to answer. Opinion rather than truth questions to deter public information attacks and avoid storing personal information. Remove case and white space from answers to ease repeatability and parsing. Require a minimum length (3?) answer for each question Add additional identity verification using the PCC for activation/recovery requests originating off-campus.
PCC Recommendations In some situations, the private communication channel can be used as a fallback mechanism by itself if SQA answers are forgotten or not available. LDAP stores PCC user preference but portal can limit user choice and choose method of transmission on the fly according to policy.
Policy Design It is strongly recommended that the following policies be configurable, rather than hard coded, so they can be changed to meet changing environmental and business needs. Enable/Require SQA, PCC, or both for what population. Enable/Require , cellmail, and/or SMS PCC for what population Temporary password characteristics – length, expiration time Number of secret questions required Consideration should be given to storing configuration data in a directory, not in the application.
Miscellaneous Design Issues Use of generic classes to allow for future expansion. For example: ID-Verification (e.g. SQA, PKI-Certificate, RemotePictureID, OpenID, RemoteShibboleth, SecureID, LaptopFingerprint, VoiceID) PCC (e.g. , cellmail, SMS, WiFi, IM) LDAP Directory (e.g. eDirectory, OID, ActiveDirectory, OVD) Administrative functions should be moved off the home page to decrease clutter and end user confusion. ( e.g. accounts.university.edu/admin )
Administrative Functions Helpdesk ‘user present’ password recovery. Helpdesk ‘user not present’ password recovery ( sends temporary password to provided unregistered PCC ). Helpdesk ‘disable account’ ( sets account password to default and disables LDAP account )
Administrative Functions Account status query: Active Disabled Waiting for activation phase 1 Waiting for activation phase 2 ( SQA answered, temp password send to PCC ( list ) Awaiting recovery phase 2. ( SQA answered, temp password sent to PCC ( list ) Logging SQA failed/answered from IP address Phase 2 activation/recovery failed/succeeded from IP address Change password failed/succeeded from IP address PCC send failed
Migration Current students, faculty, staff, affiliates, and graduates Collect SQA and PCC information during normal password change cycle explaining the change online as well as through out of channel communications. New Students Implement CollegeNet application process already discussed. New Employees Need to come up with point in business process where identity can be verified and SQA/PCC information collected. ( I9 form fill out time?) New Affiliates Need to come up with point in business process where identity can be verified and SQA/PCC information collected. Vendor vouch?
Cost Summary Extensive changes to accounts portal Business process re-engineering for account activation prerequisites in student acceptance and employee hiring. Convenience and complexity impact on end user Increased frequency of fallback scenarios. Increased support complexity and sensitive user interaction required in fallback scenarios. Increased outright failures of identity verification process in certain remote situations requiring acceptance of risk associated with poor verification or significant end user impact on accessibility. New LDAP attributes Changes to ID generation script Requires registration of external and/or cell phone information for off- campus account activation and password recovery Requires SMS gateway if that option chosen over or in addition to .