Access Control Models

Access control models are the core that identifies how a user accesses an object. An enterprise determines the best model based on the organization’s structure, the policies within the organization, and the benefits and risk associated with implementation. You’ll read about several models in the next section.

  • Discretionary access control (DAC)—Policy defined by the object owner
  • Mandatory access control (MAC)—Policy defined by the system
  • Role-based access control (RBAC)—Policy defined by the functions the user performs within the organization—for instance, roles can be Human Resources or Finance
  • Attribute-based access control (ABAC)—Policy a function of a subject’s characteristics
  • Rule-based access control (RuBAC)—Policy defined by a set of rules determined by the system administrator
  • Risk-adaptive access control (RAdAC)—Policy changes dynamically based on the risk environment

TIP

Be careful not to confuse the acronyms for rule-based access control (RuBAC) and role-based access control (RBAC). To make things more confusing, some people use the acronym RBAC for both models. For this reason, it is a good idea to simply write out the entire term instead of relying on the acronyms for these two models.

The following sections describe access control models in more detail.

Discretionary Access Control (DAC)

The discretionary access control (DAC) model is the most widely used access control method. It is defined by the Trusted Computer System Evaluation Criteria (TCSEC) as “a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls are discretionary in the sense that a subject with certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject (unless restricted by mandatory access control).”

DAC allows the owner of a resource to manage who can or cannot access the item. Owners maintain this access through ACLs, and they can delegate the ability to modify permissions to others. This removes the need for systems administrators to determine the importance of a document and who should have the necessary control. It puts the responsibility in the hands of the owner of the resource. Other than some highly specialized cases in the defense industry, every modern operating system supports DAC.

FYI

The Trusted Computer System Evaluation Criteria (TCSEC) are a set of requirements used to rate the security of a computer system. The U.S. Department of Defense (DoD) National Computer Security Center established the TCSEC. An entity in the “Rainbow Series,” it is often referred to as the Orange Book because of the color of its cover, but its official listing is DoD 5200.28-STD. The original version was created in 1983 and was updated in 1985. TCSEC was replaced by the Common Criteria for Information Technology Security Evaluation (ISO 15408) in 2005. These days, it is referred to as simply Common Criteria or CC.

Mandatory Access Control (MAC)

Mandatory access control (MAC) allows a systems administrator to maintain the security aspect of an object. It was established by TCSEC and is defined as “a means of restricting access to objects based on the sensitivity (as represented by a label) of the information contained in the objects and the formal authorizations (i.e., clearance) of subjects to access information of such sensitivity.” MAC systems are sometimes used by government agencies to implement the national security classification system. The use of MAC in these cases ensures that one user cannot grant a second user access to information that would exceed the second user’s security clearance. For example, a user with access to a Top Secret document could not delegate that access to a user who possesses only a Confidential security clearance.

The access for an object is based on the sensitivity of the object versus the subject matter. The object’s access is related to the user who is attempting to access it. For example, if an object has a classification of Secret, the subject attempting to access the object must have a clearance of Secret or Top Secret. No ACLs are associated with the object, and neither the object nor the system user can change the sensitivity level. Similarly, a subject with a Top Secret clearance has access to an object that is at or below the clearance level.

MAC is considered one of the most secure access methods because it requires both the object and the subject to have security labels assigned to them. It is often used in a multilevel security (MLS) system. A MLS system allows the computer system to simultaneously process information of different classification levels and ensures a subject with the correct clearance can access only the information at his or her authorization level. In contrast, a multiple single level (MSL) environment does not allow different classification levels to commingle. A separate system would be used for each classification level.

FYI

Most access control systems can also be described as identity-based access control (IBAC) systems. This simply means that the access control decisions made by the system are based on the identity of the user.

Role-Based Access Control (RBAC)

Role-based access control (RBAC) is also known as nondiscretionary access control. It grants access to an object based on the subject’s role within the system. Three aspects are taken under consideration within an RBAC system:

  • Role assignment—A subject can execute a transaction only if the subject has selected or been assigned a role. All active users are required to have an active role. For example, if the user Kevin is assigned to the Human Resources role, he is allowed to perform only the actions that this role allows.
  • Role authorization—A subject’s active role must be authorized for the subject. This ensures that users can only take on roles that they are authorized for.
  • Transaction authorization—A subject can execute a transaction only if the transaction is authorized for the subject’s active role.

Bell-LaPadula Model

Confidentiality rules within the U.S. government were established through the Bell-LaPadula Model and are described in the Orange Book. A MLS system is a Bell-LaPadula system. Three security principles are used in this model:

  • Simple security rule—A subject cannot read an object that maintains a higher security level. It is also known as the “no read up” rule. A user with a Secret security clearance cannot read a document with a higher classification such as Top Secret.
  • *- property rule—A subject cannot write to an object that maintains a lower security level. It is also known as the “no write down” rule, or the “star property” rule. A user with a Top Secret clearance cannot write to a document that has a lower classification such as Secret.
  • Strong *- property rule—A subject can read and write to an object only if the object classification and the subject’s clearance match exactly.

Administering access within an RBAC system is considered easier for the administrator because the access is based on roles within the organization and what each role is allowed to do. For example, an administrator may define a Human Resources role for the entire HR organization. If Kevin moves from the HR department to the finance department, he is simply removed from the Human Resources role and placed in the Finance role.

Separation of duties expands the RBAC controls. For example, although Kevin’s role may be Finance, this does not mean that he needs full access to all financial data. Separating each role into the activities users are responsible for provides more granular access control. This ensures that no single user has enough control to compromise the system. This mechanism helps to deter fraud, ensuring that at least two people are required to perform a critical task. Separation of duties is also related to the least-privilege security principle. This principle states that a user should not have any more access than is necessary for the user to do his or her job.

FYI

Some complex access control systems that span multiple organizations may also use organization-based access control (OrBAC), which also applies differing policies based on the user’s organizational membership.

Attribute-Based Access Control (ABAC)

Attribute-based access control (ABAC) systems grant access to the subject based on additional attributes that they must verify. For example, when accessing a system that is available only to residents of a particular town, the subject may have to enter an address within that town. This allows the administrator to have a more granular access control capability to the particular objects.

FYI

A MAC or DAC system uses ACLs for managing the access of information within a system. The RBAC method defines the access specifically on the role that the user has within the organization, and the operations in which that role can participate. A MAC or DAC focuses more on the information, whereas a RBAC system focuses more on the people and the actions they can or cannot do.

Attribute-based access control systems are an example of contextual access controls that use information about the current state of the user, connection, and device to make authorization decisions. Another common example of contextual access control is history-based access control (HBAC), which takes the past and present activity of the user into account when making access control decisions. For example, if a user who never logs on from nonoffice locations suddenly logs on from a foreign country, an HBAC system might deny this connection attempt because it differs from past activity.

TIP

ABAC systems are growing in popularity among security administrators. If you would like to learn more, the definitive reference on this topic is NIST Special Publication 800-162, “Guide to Attribute Based Access Control (ABAC) Definition and Considerations.”

Many organizations today are adopting Bring Your Own Device (BYOD) policies that allow users to access corporate systems and data using personally owned devices. To protect assets, organizations often limit BYOD device access to data. For example, companies might allow BYOD devices to access email and calendaring systems but deny those same devices access to restricted file servers containing extremely sensitive information. This is another example of an attribute-based access control system, where the attribute used in the access decision is an attribute of the device being used, rather than the user’s identity.

Rule-Based Access Control (RuBAC)

Rule-based access control (RuBAC) systems operate in a manner quite similar to MAC systems. The system administrator defines a set of rules for a system, service, or device, and then that set of rules determines future access.

The most common example of rule-based access control is a network firewall. Firewall administrators create a set of rules that describe the types of network traffic that are allowed to pass through the firewall. These rules may be based on source and destination Internet Protocol (IP) address, network protocol, network port, time of day, user identity, and many other attributes of the connection. When the rules used in RuBAC incorporate attributes of the user into those rules, the system may be considered both RuBAC and ABAC.

Risk-Adaptive Access Control (RAdAC)

Risk-adaptive access control (RAdAC) systems take a more sophisticated approach to security decisions by incorporating information about both the security risk of an access control decision and the operational need for action into the risk determination process. Traditional access control systems simply grant or deny access based on the defined access control policies. Risk-adaptive approaches take additional information into account, as shown in FIGURE 5-1.

A diagram explains the risk-adaptive access control system.

FIGURE 5-1 Risk-adaptive access control.

Data from National Institute for Standards and Technology.

Authentication Factors

Authentication, with regard to a subject, is validating the subject’s claim of identity. There are multiple ways in which subjects can prove themselves.

Types of Factors

Ensuring the authenticity of the subject can be determined by three factors. The more factors a subject can provide, the more trust one can put in that subject:

  • Something you know—An item that the subject is aware of or has knowledge of
  • Something you have—An item that the subject has possession of
  • Something you are—A characteristic of the subject
Something You Know

Having specific knowledge that is unique to a subject is one method of authentication. Examples of this factor include a password, a personal identification number (PIN), or a passphrase.

A password is generally combined with a unique identifier such as a username (or user ID), and it provides the additional authentication that the subject is legitimate. A password can have multiple limitations based on length, special characters, complexity, and reuse factor, or it may have no limitations. The more specific or unique a password is, the stronger it is, and; therefore, it has a lower chance of being guessed or cracked.

In the past, security best practice typically stated that users must use highly complex passwords and change those passwords regularly. In 2017, NIST released Special Publication 800-63B, “Digital Identity Guidelines,” which turned conventional wisdom about password policies on its head. Under the new guidelines, NIST recommends the following practices:

  • Do not require password changes unless the account is believed to be compromised. Password expiration policies promote bad habits such as writing down passwords.
  • Require the use of multifactor authentication to strengthen access control security.
  • Require the use of passwords that are at least eight characters long but do not implement any other complexity requirements, as these make passwords more difficult to remember.
  • Implement password filtering that prevents users from adopting a password that:
    • Appears in a password dump list from previous breaches at other organizations
    • Consists only of dictionary words or slight variations of dictionary words
    • Contains repetitive or sequential character sequences, such as 12345678 or abcd1111
    • Contains contextual cues about the user’s identity or the organization

With so many applications and tools that you log on to these days, using best practices and keeping passwords safe is becoming more difficult. Tools such as password managers or password vaults are available for storing your passwords, but these also require a form of authentication to retrieve the information. Tools that allow you to answer questions about yourself are a method that tends to remove passwords altogether or, in some instances, may be used to retrieve your password from an application. For example, Kevin may have forgotten the password for his mobile service online account. After Kevin selects “Forgot password,” the application asks him security questions that were configured previously in his profile. Such questions may be:

  • What is the name of your high school?
  • In what city were you born?
  • What is the name of your favorite childhood pet?
  • What is the title of your favorite book?

Additional tactics could be a passphrase related to the application or the subject. For example, Kevin may be trying to log on to his 401(k) account but cannot remember the password. By creating a passphrase based on the tool he is accessing, Kevin may be able to add complexity and provide something he can easily recall:

Saving money for my future keeps me a happy Kevin = S$4mfkma:)K

Almost everyone is aware of the purpose of passwords, and many people use passwords daily. The problem is that passwords have turned into a risk. Years ago, when passwords were first implemented, they were relatively simple. Knowing how simple they were made it easier for attackers to steal them. Some of the ways that attackers steal passwords are:

  • Dictionary attacks—Matching common words found in a dictionary to a user’s password until a match occurs
  • Brute-force attacks—Using software code to run through various password schemes with numbers, symbols, capital letters, and characters until a match occurs
  • Eavesdropping—Listening in on a network to learn usernames and passwords
  • Social engineering—Convincing users that they are connecting to a secure and well-known website, which is actually a site created by the attacker to obtain usernames and passwords

Weaknesses of knowledge-based methodologies. One of the biggest challenges in using passwords is memorizing them. As previously stated, you should avoid reusing passwords and avoid writing them down. Accessing applications irregularly only adds to the problem with passwords. For example, Kevin accesses his mobile online account once a month to pay the bill. He often forgets the password and the passphrase he created for the account. Today, he makes multiple attempts at logging on, but after his fifth failed password he is locked out. He now needs to call the mobile carrier and speak with a representative, who might ask Kevin for his Social Security number and date of birth. Answering these questions over the phone is a security risk, and one-on-one customer service is an extra expense for the mobile phone carrier. Due to the extra expenses and risk of resetting a password, an organization might not choose the safest mechanism because it may be too expensive to maintain and administer.

NOTE

Malware is malicious software that inadvertently gets downloaded to your computer system without your knowing it. This software can be downloaded when surfing webpages, clicking on webpage items, opening email attachments, or executing an application that has malicious code embedded. Examples of malware are Trojan horses, keystroke logging tools, worms, and viruses.

Third-party participants and tools also create havoc when only knowledge-based access authentication factors are used. You might have downloaded malware, such as a keystroke logger, to your computer without knowing it. These tools are used to steal your password, and your account can then become compromised. This can lead to the loss of money, personal information such as account numbers and Social Security numbers, and additional PII.

Trojan horse malware, which is also referred to as a Trojan, is another tool often used by attackers to pull password information from a user. When the Trojan is installed on a computer system, the attacker has complete access to the system. The subject may never know that it is there. Some of the malicious activities carried out by Trojans include:

  • Viewing the screen of the computer system
  • Keystroke logging
  • Stealing passwords and PII
  • Changing, deleting, and installing files

WARNING

Removing a Trojan can be difficult because you don’t know what damage it has inflicted on your system. Antivirus software can assist in blocking Trojans. It’s highly important to keep antivirus software up to date; however, there is no fail-safe method for keeping a computer system secure.

In addition to malware used on computer systems to gather information about the user, additional tactics have been implemented with changes and additions to technology:

  • Man-in-the-middle attacks—The entire conversation between two parties is controlled by an attacker. The attacker can read and, at times, change the communication.
  • Phishing—Used to steal credentials of subjects by sending them an email and asking them to log on to a site, answer questions, and provide information that compromises their account. This is a form of social engineering.
  • Spear phishing—A form of phishing that targets specific individuals. The phishing communication may be sent to a large group of people, hoping that specific information for several of the individuals will be returned. When all the data is consolidated, a broader understanding of the organization and various credentials will allow the attacker access.
  • SMShing—A form of phishing that is sent directly to the subject’s phone. This is done through a Short Message Service (SMS) message.

Distribution of Passwords and PINs

So how exactly does a subject get an initial or saved password or PIN? How does authentication ensure that the subject is valid if the initial authentication failed? Should you allow the subject to reset his or her own password, or should you provide a temporary password?

Several options for password and PIN distribution are the postal mail, SMS messages, email, and the phone system. For instance, when Kevin is unable to log on to his online banking portal, the bank may choose to send him a temporary PIN. One option is to send this PIN to the cell phone he has registered with the bank. The bank sends Kevin an SMS message and asks him to enter the PIN into the portal within a preset amount of time, such as 60 seconds. The bank has identified this cell phone as Kevin’s because he provided it during his initial enrollment process. The SMS message is the fastest and one of the safest ways to get the temporary PIN to Kevin. The bank may also choose to send a follow-up email to Kevin to inform him that the text was sent with a temporary PIN. If Kevin did not receive the SMS message, he should inform the bank as a precaution.

Another tactic for gaining information is called shoulder surfing. For instance, Kevin likes to work on his computer at his local coffee shop, but people around him may be able to see what he is doing, including entering passwords for his accounts. Although a password may be blocked out on the screen, the username is still available, and people can watch Kevin type his password on the keyboard and memorize the keystrokes.

The passwords used for various systems are also kept internally, on a workstation or server. How do enterprises secure them? How are passwords stored when you check a Remember Me checkbox on a website? The passwords maintained through a third-party application or through another tool should be encrypted so if hackers access them, the passwords cannot be read and used to gain access to your accounts.

Something You Have

In addition to something you know, something you have can help identify you and/or prove your claim of identity. This identifier can be an automated teller machine (ATM) card, a token, a driver’s license, or a passport—anything that supports your identity claim simply because you have it. These forms of authentication do not require you to remember a password, but they are something you must have in your possession to authenticate. Consider an example where you visit a bank and request the withdrawal of funds. You can’t simply walk up to the teller and say “I’m Bob, please give me $500.” (Wouldn’t that be nice?) The teller will certainly ask you to prove your claim of identity. You’d most likely satisfy this request by showing her your driver’s license. The license contains your name and picture, and the teller uses it to authenticate you before giving you cash.

A token is a physical or software device that can be used instead of a password or in conjunction with a password or PIN. Tokens come in many forms, such as a card with a screen and/or a keypad. There are two varieties of token devices:

  • Synchronous tokens—Use time or a counter as a means of authentication
  • Asynchronous tokens—Use a challenge and response as a means of authentication

Smart card. A smart card is a card that is the same size as a credit card and has a computer chip embedded in it. The computer chip holds data pertaining to the owner of the card and is used in various transactions through a smart card reader. Smart cards are also referred to as integrated circuit cards (ICCs). Smart cards are considered reliable because the information stored within the card cannot be easily accessed if the card is lost or stolen, but it can be used by other subjects if additional forms of verification are not required.

There are two primary types of smart cards:

  • Contact smart card—This type of card must be inserted into a smart card reader to gain authentication or access for the subject.
  • Contactless smart card—This type of card is often used for access into facilities. Instead of having to insert the card into a reader, the subject waves the card in front of the reader to verify his or her access credentials. The subject receives access or is denied access to the location. Contactless cards are also known as proximity cards or “prox” cards.

Time-variable token. A time-variable token is a synchronous token in the form of a one-time password. It is a dynamic password in that it can be used only once. After a single use, it is no longer valid. A time-variable token is valid for a specific period of time, such as 60 seconds. When authentication is based on time, the token (hardware or software) time must be synchronized with an authentication server. The time and the seed record are the main components. The seed record is the symmetric encryption key, which is shared between the token and the authentication server. This seed record encrypts the clock time; the result is a one-time password. The same seed record is used for both the token and the authentication server. Because the authentication server knows that this token is the only other device with that seed record, it knows that the token code entered comes from the person holding this particular token.

FYI

A Common Access Card (CAC) was implemented under Homeland Security Presidential Directive 12 (HSPD-12). It is used by the DoD for authentication and access to federal facilities and computer systems. This card holds information regarding the user such as his or her identity, clearance level, and physical and logical access capabilities. In 1987, the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) implemented ISO/IEC 7816 for ICC with contacts, such as smart cards.

Challenge-response device. A challenge-response device is an asynchronous token. Authentication occurs via communication with the token device, the authentication server, and the user. A request is sent to the authentication server and a challenge (a random set of numbers) is returned. The user enters this challenge into the token, the token encrypts it, and another value is returned. The user then uses this end value as the password. Once the authentication server receives this end value, it decrypts it. If the end value matches the challenge, the user is authenticated. This exchange between the user, authentication server, and token device is shown in FIGURE 5-2.

An illustrated diagram elaborates A C L permissions.

FIGURE 5-2 ACL permissions.

The most significant weakness in “something you have” authentication is that a possession-based authentication factor may be lost or stolen.

Something You Are

Something you are authentication is based on characteristics about a specific person. The characteristics can be voice, facial features, retinal patterns, handwriting, and repetitive actions. These characteristics are called biometrics. This section provides only a brief summary of biometrics.

NOTE

Enrollment in a biometric system brings an extra level of security to the authentication system because the person must be physically present during the process. It is also an advantage for individuals because they will not need to remember a password to gain access.

The technology behind biometrics involves scanning and analyzing the unique characteristics of a user and matching them against information that was collected during enrollment. The information about individuals can be used for either identification or verification. Biometric access control systems may be physiologically based or behavior-based.

Physiologically based biometrics. Physiologically based biometric authentication uses attributes of the user that are unique. Such attributes include fingerprints, facial features, and retinal patterns. A scanning device scans for biometrics, and the subject must enroll his or her information before access is granted. When a user accesses a scanner, multiple points of reference are scanned, analyzed, and compared with the data stored in the database. If enough points match between the user and the database, access can be granted or denied.

The number of devices that use biometrics for authentication is increasing. Multiple universal serial bus (USB) and laptop manufacturers are incorporating this technology into their systems. Many companies now sell portable external fingerprint biometric scanners.

Behavior-based biometrics. Behavior-based biometric authentication creates a characteristic about users based on their patterns. These patterns can be generated from aspects such as their typing rhythm, which can be unique—different people type at a different pace and rhythm. Organizations can use biometric software to analyze users’ typing rhythms. The software records the time that each key is depressed, as well as the length of time between keystrokes. A unique profile is created for each user. If an attacker tries to impersonate a user but types the user’s password too slowly or too quickly, the attacker won’t be authenticated.

Financial institutions use pattern matching for online web access. They may create a profile of a user based on the times he or she logs onto the system. If a user rarely logs onto the system at 3:00 a.m. on a Saturday, for example, the financial institution’s website might prompt the user to enter additional information for verification purposes.

An individual’s handwriting can also be used as an authentication method. This requires additional hardware when used with computer systems. Many stores already use handwriting authentication devices when accepting credit card purchases. Your signature is compared with the signature on your credit card.

The major weakness with biometric authentication is that users often find these techniques intrusive and inconvenient.

Factor Usage Criteria

Now that you understand the various methods of authentication, it is important to understand how they can work together to create a more secure environment and thwart identity theft. Understanding what the user is trying to access and the risk associated with a loss of the data determines what methods or combination of methods should be used.

Single-Factor Authentication

A single-factor authentication uses only one of the authentication factors (something you have, something you are, or something you know). This type of authentication tends to be associated with a password, and it’s the least secure because of the simplistic nature of passwords. Because passwords have been around for a while, attackers have created tools and methods to get past them. Using symbols, special characters, and additional controls when creating passwords can help strengthen them. Some additional examples of a single-factor authentication are a driver’s license and a house key.

Multifactor Authentication

Multifactor authentication approaches are the current standard for securing access to sensitive systems. In a multifactor authentication approach, individuals are asked to authenticate using at least two different techniques that fit into different factor categories. For example, a user might be asked to combine something they know (a password) with something they have (a mobile phone). Two of the most common forms of multifactor authentication are two-factor authentication and three-factor authentication.

Two-factor authentication requires a user to provide two independent authentication mechanisms from different categories in order to authenticate. Two-factor authentication is also referred to as strong authentication. It generally combines something you have and something you know or something you have and something you are. For example, Kevin’s organization has implemented two-factor authentication, which requires him to enter a PIN (something you know) and a token password (something you have). In order for an attacker to be able to access the same resource, he or she would need to know Kevin’s PIN and have the token in hand. Another example of two-factor authentication is an ATM card (something you have) and the PIN (something you know). When Kevin wants to access the money in his banking account through an ATM machine, he needs to provide the debit card and the PIN in order to start the transaction.

NOTE

Is a debit or credit card a single-factor or a two-factor authentication method? Recently, some vendors have chosen not to require a PIN or signature when using a debit or credit card if the purchase is below a certain amount. Does this now make the credit card a single-factor authenticator? If the cashier does not compare the signature on the credit card with the signature on the slip, is the credit card a single-factor or two-factor authenticator?

Another form of two-factor authentication is something you are and something you have. For example, security managers of a government facility want to implement two-factor authentication for access to a secure area, but they do not want to use smart cards because the cards can be lost or stolen. To ensure that only authorized people can access the secure area, the managers may choose a two-factor authentication that requires a retinal scan followed by a PIN.

Three-factor authentication, also a form of strong authentication, includes all authentication factors of something you know, something you are, and something you have. For example, obtaining access to a highly classified room may require a badge, a PIN, and a retinal scan. Because the room is restricted to only a few people, authentication of those who enter is extremely important to ensure that the classified information inside the room does not get into the wrong hands.

Sidebar: Four or Five Factors?

Most security professionals recognize these three factors (something you have, something you know, and something you are) as the three standard authentication categories. You may also see lists of authentication factors that refer to four or five factors.

The first of these, somewhere you are, uses location-based authentication. This approach uses the physical location of the user as an authentication factor, assuming that someone in a restricted area is authenticated to some degree. It is arguable whether this is actually an authentication factor, as the person may have gained access to that facility using some other authentication approach, making location simply a proxy for those other techniques. Location is also not directly tied to an individual, because many people could have authorized access to the same physical location. While location-based controls are commonly used, they are not actually a means of authenticating an individual.

The second commonly cited factor, something you do, is known as behavior-based authentication. These techniques look at characteristic patterns of the user’s behavior, such as their rate and patterns of typing, time of access, and similar characteristics. These approaches are not commonly accepted as reliably confirming a user’s identity on their own, so they cannot be considered an authentication factor.

Kerberos

Kerberos is a network security protocol that provides authentication and authorization services on a network. Communication on an unsecure network allows attackers to listen in on the network to steal your credentials. Kerberos uses strong cryptography in order for the client to prove its identity to the server. Once the identity is proven, the communication is encrypted. Credentials obtained are used to verify the identity of the user and ensure the integrity of messages between the client and the system it’s authenticating to. Some of the benefits associated with implementing a Kerberos system are:

  • It prevents plaintext passwords from being sent over the network.
  • It centralizes username and password credentials, making them easy to maintain and manage within any infrastructure size.
  • It removes the vulnerability associated with storing passwords local to the computer system.

Kerberos is based on three systems: the Kerberos-trusted Key Distribution Center (KDC), the Kerberos Ticket-Granting Service (TGS), and the Kerberos Authentication Service. Kerberos provides the ability for systems to communicate in a secure manner over an unsecure network. Kerberos is also an example of a single sign-on system, providing enterprises with scalability and flexibility. Kerberos provides:

  • Transparency—The user does not need to know that the Kerberos system exists. He or she simply knows that his or her credentials work across systems.
  • Security—An attacker should not be able to obtain users’ credentials. It provides confidentiality and authentication.
  • Scalability—Administrators can use Kerberos to manage authentication in small to large-scale environments.

NOTE

The name “Kerberos” comes from Greek mythology, the three-headed dog that guarded the entrance to Hades. It is an authentication and authorization method that is currently being used in Windows operating systems.

FYI

Kerberos was developed in the late 1980s at the Massachusetts Institute of Technology (MIT) under the Athena program. It is based on Needham and Schroeder’s trusted third-party authentication protocol. Kerberos is freely available through MIT but is implemented in many commercial off-the-shelf (COTS) products. The mechanisms for Kerberos are validated in Request for Comments (RFC) 4120. You can view RFC 4120 on the Internet Engineering Task Force website at http://www.ietf.org/rfc/rfc4120.txt.

How Does Kerberos Authentication Work?

The process for Kerberos authentication involves three primary steps: client authentication, client service authorization, and client service requests. It is important to understand the entire process because Kerberos authentication proves an identity across an unsecure network connection.

The following steps are performed during client authentication:

  1. The user enters a user ID and password into the client.
  2. The client performs a hash on the password, creating a secret key for itself and for the user.
  3. The client sends a message of the user ID to the authentication server (AS) and requests services. This message is sent as cleartext—unencrypted. The AS performs a hash on the password of the user ID in its database. This creates a secret key.
  4. The AS responds with two messages if the user is successfully authenticated. The two messages are:
    • A Ticket-Granting Ticket (TGT) for the server that has been encrypted using the secret key of the Ticket Granting Service (TGS)
    • A client/TGS session key, which is a temporary key encrypted using the secret key of the client/user
  5. The client receives the two messages. After decrypting the client/TGS session key, the client uses the session key when communicating with the TGS in the future.

NOTE

An authenticator is a message that consists of the client ID and the timestamp.

The following steps are performed during client service authorization:

  1. The client sends two messages to the TGS when requesting services:
    • The TGT and the ID of the requesting service
    • An authenticator encrypted by the client/TGS session key
  2. When the two messages are received, the TGS decrypts the TGT with the TGS secret key. This results in the client/TGS session key. The TGS decrypts the authenticator and sends two messages to the client:
    • A client-to-server ticket, which is encrypted with the service’s secret key. The client-to-server ticket includes the client ID, client network address, validity period, and client/server session key.
    • A client/server session key, which is encrypted with the client/TGS session key.

When a client requests a service, the following steps are taken:

  1. The client connects to the service server and sends the following two messages:
    • A client-to-server ticket encrypted using the service’s secret key
    • A new authenticator encrypted using the client/server session key; the new authenticator has the client ID and timestamp
  2. The service server decrypts the ticket with its own secret key to retrieve the client/server session key. With the session keys, the service server decrypts the authenticator and sends a message to the client to confirm its identity and willingness to serve the client. The message includes the timestamp from the client’s authenticator, which is encrypted using the client/server session key.
  3. The client decrypts the confirmation message using the client/server session key and checks to see if the timestamp is updated correctly. If so, the client can trust the server and starts issuing service requests to the server.
  4. The service server provides services to the client.

The Kerberos authentication, authorization, and service request processes are shown in FIGURE 5-3.

An illustration with three parts gives Kerberos for authentication, authorization and service request.

FIGURE 5-3 Kerberos for authentication, authorization, and service request.

Use of Symmetric Key and Trusted Third Parties for Authentication

Kerberos performs authentication as a trusted third-party authentication service via a shared secret key (symmetric key). When a client wants to obtain authentication credentials for a server that it does not have credentials for, the exchange between the authentication server and the client is initiated by the client. The client’s secret key is used for encryption and decryption. This exchange obtains credentials for a TGS, which will also be used for obtaining subsequent credentials.

One of the primary reasons for implementing Kerberos is that without it, the principals do not trust one another. Principals can be applications, users, or network services. The principals trust only the Key Distribution Center (KDC), which is why the KDC creates tickets for the communication among the principals. Communication among principals is vouched for by the KDC, and the KDC ensures that it is acceptable for the principals to talk to one another.

Key Distribution Center (KDC)

The KDC acts as a trusted third party. The purpose of a KDC is to provide a secure environment for distributing keys. It provides tickets and temporary session keys for both initial tickets and ticket-granting requests and acts as both an authentication service and a ticket-granting service.

Because Kerberos is formed on symmetric encryption and shared secret keys, the database for all of the secret keys for the principals on the network is maintained by the KDC. As an authentication server, it authenticates a principal via a pre-exchanged secret key. After the authentication occurs, the KDC acts as a TGS. As a TGS, it provides a ticket to a principal establishing a trusted relationship among other principals. The principals trust the integrity of the KDC, which is an essential part of Kerberos security.

NOTE

A secret key has a long lifetime and is shared between the KDC and the client or server. It may be used for subsequent needs such as password changes. A session key is destroyed after the session is complete and is generated only when needed. The session key is shared between the client and the server.

Principals are preregistered with a secret key in the KDS through a system registration process. A set of these principals is called a “realm,” and the realm is used to administer logical group resources and users. When added to the Kerberos realm, the principal is given a realm key used for initial trusted communications. Once a principal becomes a member of a Kerberos realm, the principal can then be authenticated by the authentication server.

Authentication Tickets

Tickets are generated by the KDC and provided to the principal when authentication is needed. For example, when Kevin needs to access a specific file share, a request is made to the KDC. The KDC, in return, provides the TGT and client/TGS session key. Kevin will use the TGT for authorization to the file share.

Potential Weaknesses

As a whole, Kerberos is a very secure protocol. However, all protocols have weaknesses. It is important to note that any weaknesses with Kerberos are based on the concepts within the protocol and not the underlying cryptography.

Like any authentication system, Kerberos can have weaknesses if improperly implemented. Security administrators should be aware of these potential weaknesses, which include:

  • Brute-force attacks—The system is susceptible to brute-force attacks. Brute-force attackers simply repeatedly guess an account’s password until they are successful. They typically start with a list of dictionary words and move on to try combinations and variations of dictionary words. If a user has a weak password, especially one that consists of dictionary words, it may be easily discovered.
  • Key storage—All keys must be stored securely for the user and server. If this is not done correctly and an attacker gains access to the keys, the entire system could be compromised.
  • Kerberos tickets are cached on a user’s computer system—If an attacker were to obtain access to these tickets, he or she could impersonate that user on the network.
  • Clocks must be synchronized to complete authentication—There is a time availability period, and if the times are more than 5 minutes apart, authentication will not occur.
  • Central server continuous availability requirement—Authorization on a network is an occurrence that happens multiple times for principals. Loss of time can be costly to enterprises. Organizations must design networks so that the Kerberos components are always available to users and authentication is never compromised.
  • Requirement for host synchronization—Ensuring that servers are available at all times requires the servers to have the same information. Synchronizing information between multiple servers and sites will minimize any downtime that occurs when a server or site goes offline.
  • Potential single point of failure—The KDC is a single point of failure in the communication line. If the KDC were to go down, users would no longer be able to authenticate to any systems on the network. Loss of the KDC has a critical impact to the enterprise, and a business continuity plan needs to be designed around it. Part of this plan should include multiple KDC systems sharing information so that end-user access and productivity is never diminished.

Kerberos in a Business Environment

Many organizations use Kerberos daily for employee authentication and access to resources. Consider this example of appropriate use of Kerberos in the business environment, featuring Kevin.

Kevin logs on daily to the corporate network with his computer system. He provides a username and password. When Kevin logs on, his user ID is sent to the authentication server on the KDC. A TGT is provided to Kevin, and it is encrypted with Kevin’s password (secret key). If it is the correct password, the TGT will be decrypted and access is granted to the computer system. The secret key will reside temporarily on the computer system.

Later in the day, Kevin needs to print some documents for his meeting. Kevin’s system sends the TGT to the TGS on the KDC. The TGS creates a client/server session key and provides it to Kevin’s system, which he uses to authenticate to the print server. This second ticket contains the session key that is encrypted by Kevin’s secret key and another session key that is encrypted by the print server’s secret key. This second ticket also contains a timestamp and the computer system’s IP address. These components added to the second ticket are the authenticator.

Kevin’s system receives the second ticket, decrypts it with his secret key, and removes the session key. Kevin’s system also adds a second authenticator and sends the ticket to the print server. The print server receives the second ticket and decrypts it with its secret key and removes the session key and the two authenticators. If the print server is able to decrypt the session key, it knows to trust Kevin’s system because it knows the KDC created the ticket.

Remember that only the KDC has the key to encrypt the session key. Also, if the authenticators from the KDC and Kevin’s computer system match, it knows the request was sent for the correct principal.

The beauty of Kerberos is that Kevin does not even need to be aware that any of this is taking place. It is the responsibility of Kerberos and the operating system to handle all of these ticket requests. Kevin merely needs to provide the correct username and password for his account.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.135.197.201