Biometric Authentication in Distributed Computing Environments Vijai Gandikota Karthikeyan Mahadevan Bojan Cukic

Need for Security in Distributed Systems Security Threats –Information Compromise –Integrity Violations –Denial of Service –Repudiation –Malicious misuse Vulnerabilities –Access control bypass –Benign user gaining access to unauthorized information –Eavesdropping –Lack of accountability –Disrupting communication between objects –Lack of user identification –User impersonation and spoofing

Biometrics in Large Scale Information Systems Remote File System(s) Grid Portal CORBA Client Computer Grid Portal BIOMETRIC TEMPLATES FOR AUTHENTICATION PASSPHRASE FILE SYSTEM MOUNT CREDENTIALS DELEGATION CLIENT IDENTITY & ORB AUTHORIZATION TEMPORARY CREDENTIALS Client Credential Repository Biometric Device GRID

Mounting A Remote File System NFS 3 Client NFS 3 Server SFS SERVER SFS CLIENT Client Machine Server Machine User Application Agent NFS 3 TCP Connection with mandatory access controls Authentication Server NFS 3 System Call NFS 3 Key exchange Validation User Authentication Server Authentication User Authentication Biometric Authentication Biometric Device Biometric Device Biometric Authentication

The Role of Biometrics Biometric templates can be used in the place of passwords to retrieve self certifying pathnames securely from a remote server. A Biometric Identification Record(BIR) will be used with the SRP protocol to retrieve self certifying pathnames from server. Allows consistency and integration with the rest of the system.

Remote File System Self certifying file system developed at MIT. Other similar custom file systems can be built using the UFS (user level file system) toolkit. Works over NFS3 protocol. Complete remote file system can be encrypted. Access of multiple remote file systems concurrently through easy authentication.

Key Negotiation Client Server Location, HostID KSKS K C, (k C1,k C2 } KS (k s1,k s2 } Kc Kc - Short lived client public key Ks - Server public key Kc1, Kc2 - Random key halves of client key Ks1, Ks2 - Random key halves of server key *Self Certifying File System Implementation

Mounting Remote File System Mounted upon authentication of the user by agent. Authentication server validates user request and sends user credentials. Self Certifying File Names - contain all information necessary for secure communications with remote server.

CORBA CORBA Security Features Authentication Encryption Access Control Non-repudiation Audit User Credentials User Sponsor User Login Program Principal Authenticator Current Execution Context CORBA credentials are user credentials converted into CORBA Objects SOURCE: OMG

CORBA Integration with BIO-API GSI Framework adheres to GSS API described in IETF RFC 2478 will be the backbone of the implementation Certificate - A central in GSI authentication PKCS #11 - tokens and PKCS #12 personal information exchange syntax will be used extensively to transport the Biometric Certificates CORBA will act as the intermediary

Plan of Development Develop Authentication Mechanisms and protocols that use Biometric templates to retrieve self certifying pathnames from remote server. Develop and Integrate Biometric Authentication Mechanism into the server to validate user requests