1. Computer Security Protection in general purpose Operating Systems
5/18/2019

2. Entity Authentication
Entity Authentication is the process of verifying a
claimed identity
It is based on:
something the entity knows
something the entity holds
something the entity is
something the entity does
where the entity is
5/18/2019

3. Something the entity knows
The user has to know some secret, such as a
password or a personal identification number (PIN).
Threats
Anybody who knows your secret “is you”!
5/18/2019

4. Something the entity holds
The user has to present a physical token (such as key,
an identity tag, a card) to be authenticated.
Threats
The token can be lost or stolen!
5/18/2019

5. Something the entity is
Use biometrics, such as fingerprints, palm prints, iris
patterns, or retina patterns.
With biometrics a stored pattern is compared to an actual
taken measurement.
Problems
False positives (accepting the wrong entity) and false
negatives!
Many users find biometrics unacceptable.
Gruesome threats of the kind used in some Hollywood thrillers!
5/18/2019

6. Something the entity does
People perform some mechanical tasks in a way that is both
repeatable and specific to the individual.
Examples
hand written signatures
on a writing pad
the writing speed/pressure of a hand written signature
on the keyboard
the typing speed and intervals between strokes
Problems
False positives (accepting the wrong entity) and false negatives!
5/18/2019

7. Where the entity is
The system may take into account the location of the
login.
For example, access may only be granted from certain
terminals.
With mobile and distributed computing the precise
geographical location can be established during
authentication by using the services of a global
positioning system (GPS).
5/18/2019

8. Usernames & Passwords The most common authentication mechanism.
Although password protection seems to offer relatively good
security, human practice degrades its quality.
Attacks on passwords
Exhaustive search
Try many probable passwords
Try likely passwords for the user
Search for the system list of passwords.
Ask the user!
5/18/2019

9. Exhaustive search attacks
If passwords are words consisting of the 26 characters A-Z
and have length 8, then we are altogether 268 passwords.
This is roughly 2*1011, which seems enough intractable.
It would take of the order of about 6 years to test all passwords
at the rate of 1 millisecond per password.
If we were to speed up the search to one microsecond per
password, this would come down to approximately 2 days.
5/18/2019

10. Probable passwords People prefer simple passwords.
Our earlier analysis assumes that people choose
passwords such as “vxlagrst”.
Whereas in reality they tend to use names and words
they can remember.
Spelling checkers carry dictionaries of the most common English
words. The typical size of such a dictionary is 80,000 words.
This reduces the search to seconds
5/18/2019

11. Passwords likely for a user
People prefer words which are related to them, such
as the name of a spouse, a child, a relative, a pet,
a street name or something memorable or familiar.
Some people pick a simple password and replace
certain characters such as 0 (zero) by O, 1 for letter L,
3 for letter E, etc
5/18/2019

12. Passwords defenses Password checkers: check password against a
dictionary of weak passwords.
Password generators: users are not allowed to
pick their own passwords.
Password ageing: an expiry date is set for passwords.
Limit login attacks.
Inform user after a successful login of the last
login and the number of failed logins since then.
5/18/2019

13. Spoofing attacks
An entity enters a password and the system verifies the
entities identity.
Does the user know who has received the password?
Defenses
Display number of failed attempts
Use trusted paths (with Windows NT, CTRL+ALT+DEL invokes the OS login screen)
Mutual authentication: the system could be required to identify itself
5/18/2019

14. Protecting the password file
To validate passwords the system compares the password
entered against a value stored in the password file.
Defenses
cryptographic protection (e.g. use a one-way hash function f: instead of listing passwords x, list their values f(x)
–beware of dictionary attacks!)
access control enforced by the OS (e.g. restrict access to files and other resources to users holding the appropriate privileges)
combine both
5/18/2019

15. Cryptographic protection
Use one-way hash function f
Instead of storing the password x in the password list,
the hash is stored.
The password list is organized as a two column table
of user IDs (usernames) and the corresponding hashed
values
When the user logs in and enters the password x is it is
hashed (locally) into f (x). This value is then compared
with the stored value.
5/18/2019

16. Cryptographic protection
The one-way hash function f
crypt(3) for Unix systems
This uses a slightly modified version of the encryption
scheme DES with 25 “rounds” (instead of the 16 rounds)
This encrypts the all zero block using the password x as
a key.
The encryption f (x) of the zero block is the hash value.
5/18/2019

17. Cryptographic protection
Access control mechanisms in the OS
These restrict access to files and other resources to users
holding the appropriate privileges.
Only privileged users can have write access to the password file:
otherwise an attacker could access data of other users by
changing their password file.
If read access is restricted to privileged users then passwords
should be secure, in theory.
In practice an attacker can still use a dictionary attack.
5/18/2019

18. Cryptographic protection
Access control mechanisms in the OS
Dictionary attacks can be prevented by using password
salting.
With salting, additional information (the salt) is appended
to the password x before it is hashed to get f(x).
This implies that even if two users have the same
password their salted hashes will be different.
5/18/2019

19. Multiple passwords
For additional password protection several passwords
may used.
For example, use
the first password for workstation
the second password to get onto the network
the third password to access the server
the fourth to access the database management
system
etc
5/18/2019

20. Passwords –Single sign-on
Remembering many passwords is rather inconvenient.
A single sign-on service solves this problem. You enter
your password once, the system stores it, and then uses
it whenever you have to authenticate yourself again.
However this raises new security concerns.
How do you protect the stored password?
(the password needs to be in cleartext)
5/18/2019