Subjects and Objects

There are two terms related to access control: subject and object.

1. Subject A subject is the user or entity taking the action or accessing a resource such as a database.
2. Object An object is the item or resource being acted upon. For instance, a user accessing a software application is the subject, and the software application would be the object.

In some cases, items may change relationships (Figure 3.1). In such an event, an object becomes a subject and then reverses roles again. For instance, the user (subject) accesses an application requesting information. The application (object), in an effort to respond to the user (subject), requires information from a database. The application now becomes a (­subject) to the database (object). Once the data is retrieved, the application once again reverts to an (object) role and responds to the user (subject).

Something You Know

Something you know is the most common form of authentication. In most instances, the user enters a password. Passwords can prove to be the weakest type of authentication. The security practitioner may employ a number of techniques that increases the security of user passwords:

1. Never use default passwords. Users, as well as network administrators, should not use the password that came from the factory. Passwords must be changed on all network ­hardware items. Users must never be allowed to use pass or password as a password.
2. Change passwords often. Many organizations establish a password change period within a password policy document. This may be as often as every 30 days but should be no longer than every 90 days. Group Policy Manager is usually used to enforce password change policy.
3. Make passwords sufficiently strong. Passwords should never be common dictionary words of any language, names, personal identification numbers, pet names, or anything that can easily be guessed. Passwords should be a minimum of seven characters in length and consist of upper- and lowercase letters, numbers, and special characters.
4. Never write passwords down. Frequently passwords are found around the user's work area on sticky notes, note pads, diaries, or even books or papers. As a security practitioner, never make a password so complex that it forces the user to write it down and refer to the note.
5. Never tell your password to anyone. One of the most popular social engineering attacks is a call from a tech department requesting the user's password. Frequently, someone is away from the office and calls to ask a friend to access their system using their password. Or, a temporary employee is given the password of the permanent employee they are replacing.
6. Use audit tools to verify password strength. There are many third-party applications as well as operating system tools that allow the security practitioner to scan passwords and verify the strength by checking for special characters, password length, numbers, and ­duration on the system.

In Exercise 3.1, you will see how to check the strength of passwords. You will also read helpful text concerning the construction of strong passwords.

Something you know can also be a secondary authentication question (Figure 3.5). Many financial accounts require a username for identification, a password for initial authentication, and then some personal information not likely known by many others. This additional personal information is usually in the form of several questions the user is asked upon account setup. Such questions might include mother's maiden name, the street where you lived when you were 10 years old, your favorite teacher, the best man, and the city where you were married. The problem with this is that some of this information is readily available knowledge. Users should select questions and answers that are not easily publicly found, such as favorite teacher or best man.

Another form of something you know authentication is the use of CAPTCHA characters (Figure 3.6). CAPTCHA is the acronym for Completely Automated Public Turing test to tell Computers and Humans Apart. This is a challenge-and-response system featuring a set of numbers and letters in various shapes with varying backgrounds. The challenge is for the user to visually recognize the characters and knowingly retype them into a form. This technique is used to determine if the user is a human or a machine. A machine may be able to break a user's password, but it still would not be able to pass this test. The machine would not be able to visually read or recognize the shapes of the CAPTCHA characters.

Something You Have

Many people carry an ATM card, driver's license, student ID, smartphone, credit card, or proximity card. Each of these can be used to establish authentication. For instance, if you are stopped by the police, you may verbally state your name, but a driver's license or other identification issued by an authority such as a state department of motor vehicles or a university, in the case of a student ID, is used by the officer to establish if you are stating the correct name. This is an example of something you have.

Many corporate and federal employees are issued proximity keys or cards to access facilities. Specific data is embedded within the card. Although they are not internally powered, they feature a type of antenna that receives a signal from a nearby receiver (Figure 3.7). This stimulates the card and provides sufficient energy for the card electronics to respond to the card reader and transmit information. This technique is also utilized on many toll roads across the country. A small device typically placed on the windshield responds to a signal transmitted toward the auto and the device responds with identification and authentication information allowing the toll authority to debit the person's account.

Many businesses provide employees with a personal badge that has a name, ID number, and photo of the employee (Figure 3.8). Many of these badges also contain ­micro-electronics that allow the individual to access various doors within the facility. Most facilities log the entry and exit of individuals throughout the premises.

Another type of card is a smart card; in government organizations this might be referred to as a common access card (CAC). This type of card features circuitry that stores the user's certificate. The certificate contains the user's public key for authentication as well as encryption, although in this case it is primarily used for authentication. The card is usually placed into a card reader to be read. Since the card might be lost or stolen, a second authentication factor is usually required such as a biometric input, PIN, or password.

Something You Are

Something you are is a physical characteristic that is unique to you and your body. Biometrics is the science and technology of recognizing a user based upon their body. For instance, law enforcement can identify individuals by fingerprints, footprints, palm prints, blood samples, and DNA.

In business today, various biometric techniques are used to identify and authenticate individuals:

1. Fingerprints Fingerprints have been used for identification by law enforcement for many decades. A fingerprint is obtained by scanning one or more fingers several times. This digital finger print image is used to generate a finger image identifier record that can be used to compare with future scans. Fingerprint recognition in biometrics is one of the most widely used techniques now being used on laptops, tablets, and personal cell phones. In finger-scan technology, only the features extracted from the fingerprint are stored. This allows one to many rapid fingerprint data searches. In fingerprint technology, entire fingerprints are stored on a system, requiring large amounts of storage.
2. Iris and Retina Scans Iris scans map the colored part of the eye, recording the unique color, patterns, and textures (Figure 3.9). A retina scan has proven to be extremely reliable, more reliable than using fingerprints and other biometric techniques. Retina scans are utilized by the government for access into sensitive locations and systems.

   

3. Facial Recognition Similar to mapping points on a fingerprint, a facial scan records and traces various key points on the human face. Using measurements and placement of various features, a video or photograph of a face may be matched to facial signatures in a database.
4. Weight Although not as popular as other biometrics, weight recognition has been utilized in mantraps to both authenticate an individual and alert authorities in the event of two persons in the mantrap, called “piggybacking.” Weight has also been used as alarm systems to warn if an intruder has placed weight on a room floor or object.
5. Palm Prints and Palm Geometry This biometric method uses the physical palm geometry of the palm and fingers to uniquely verify an individual. In systems known as palm scans, a bright light is used to scan and map blood vessels within the hand to create a unique palm signature.

There are several challenging aspects to the use of biometrics. Any or all of these might be considered when implementing a biometric system:

1. Enrollment Time Every biometric system must initially be set up with every user's unique information. For instance, for a retina scan device, every user must submit to an initial scan.
2. Error Rate Every biometric device is comparing a current reading or capture with a saved signature. In some cases, an error can occur that prohibits passage or allows passage when it should not occur.
3. Acquire Time Each user wanting access must submit to an acquisition of biometric information. This could be as simple as a fingerprint scan or palm scan or as complex as a retina scan or voice scan. Each scan requires an increment of time to acquire the sample information, and in each case the user must be present and wait during the scanning process.
4. Throughput Time Once the biometric sample has been acquired from the user, it must be compared to the stored sample signature in the system database. This requires a period of processing time during which the user remains waiting for access. Should the system ­malfunction or service be denied, access to the facility or resource might be denied.
5. One-to-One Search In this type of database search, the acquired information scan is compared against stored signatures or data samples for a potential match. Only specific data points of the acquired sample information are compared against similar data points stored in the system to speed the sort. Errors may occur when not enough points match.

Every biometric system faces its own challenges processing information and making decisions to allow or deny access to the user. When specifying a biometric authentication system, various terms and considerations are used.

1. False Rejection Rate (FRR) FRR is referred to as a Type I error. This is the percentage of time a biometric system rejects a known good user, thus not allowing access.
2. False Acceptance Rate (FAR) FAR is referred to as a Type II error. This is the percentage of time a biometric system falsely identifies as good an unknown user, thus allowing access.
3. Crossover Error Rate (CER) The CER is where the false rejection rate (FRR) and false acceptance rate (FAR) cross over (Figure 3.10). A lower CER indicates a better biometric authentication system.

   

Something You Do

Something you do is a trait that you have developed over the years. This trait is unique to you and has developed either through training, your upbringing, environment, or perhaps something unique to your body construction. Unique biometric scanning devices have been constructed to measure a variety of personal traits to be able to authenticate an individual. These traits are as follows:

1. Signature Dynamics This recognizes how the subject creates letters and words. The subject is requested to sign their name or to write out a specific group of words. Items tested may include pen pressure, direction of strokes, and points where the pen was lifted from the page. The scanning system then examines the result and matches specific test points with those saved in memory. Signature dynamics is the biometric factor of handwriting analysis.
2. Voice Pattern Recognition This acquisition system requires the individual to speak a phrase into a recording device. This is the same phrase that was originally recorded and stored in memory. The system examines features such as inflection points, volume, speaking speed, and pauses. The stored voice phrase in the biometric system is referred to as a voiceprint.
3. Keystroke Dynamics Keystroke dynamics, also known as keyboard pattern recognition, recognizes how an individual types on the keyboard. Various biometric systems measure flight time and dwell time to generate a typing signature. The signature generally captures flight time, or the time a user takes between key depressions, and dwell time, which is the length of time a key is depressed. The results of using keystroke dynamics as a biometric recognition system are inconsistent because users' typing methods change depending upon mood or environment.
4. Heart/Pulse Pattern Researchers have identified that each person's heart beats in the unique pattern. This pattern may be detected with recognition software and used as a ­biometric authentication system. Typically this is achieved by the user wearing a wristband that monitors their heartbeat and its unique pattern and uses it to unlock phones, computers, and other nearby devices that belong to the user. This technique is somewhat similar to health and fitness trackers, with the current measurement of the user being compared to a stored signature for authentication purposes. Heart/pulse pattern recognition is a biometric authentication technique.

Somewhere You Are

Geolocation and geotagging are now used by many systems to identify where the user actually is located. Many software applications, retail stores, social media sites, and other systems ask for the user to allow themselves to be geolocated. Users may be identified and authenticated by their location. For instance, several major department stores are pushing ads out to cell phones as you walk through the store. You may receive a coupon on your phone as you drive past a coffee shop or another location. Major credit cards such as American Express will act on location anomalies when a charge is made in a foreign country if the user has no history of traveling to that country.

Bell-LaPadula Model

The Bell-LaPadula model enforces information confidentiality. It does this by enforcing security through two rules called no read up and no write down.

With the Bell-LaPadula model, an individual with a secret security clearance cannot read top secret information and cannot write secret information down to a security level below secret, such as unclassified.

1. Simple Security Property Rule (No Read Up) Subjects cannot read information classified at a higher level than theirs. For example, a person with a unclassified security clearance cannot read a document classified as secret.
2. The Star Property Rule (No Write Down) Subjects with access to information at a certain security level cannot write that information to a lower security level. For example, a person accessing documents classified as secret cannot reduce the classification level by writing the information to a lower level. Usually an asterisk (*) is used as a star, as in the * property rule.
3. The Strong Star Rule This rule states that if you have read and write capabilities, you are restricted to read and write your data at your level of secrecy, but you cannot read and write to levels of higher or lower secrecy. This is sometimes referred to as the constrained or tranquility property.

As expected, the Bell-LaPadula model is used extensively in the federal government and U.S. military where confidentiality of information is the primary concern.

Biba Model

The Biba information model is primarily concerned with information integrity. The rules are reversed from the Bell-LaPadula model. In the Bell-LaPadula model, we do not want to reduce the security classification of sensitive information. The Biba model seeks to not increase the integrity of information at a lower level.

The goal is that an individual at a certain security level may not read information at a lower level and the individual may not create (write) information at a higher level than their security level.

1. Simple Integrity Axiom (No Read Down) Subjects granted access to any security level may not read objects at a lower security level. For example, a business manager may not read or accept actionable orders from an assembly line worker, but the president of the company may issue actionable orders to the manager.
2. The Star Integrity Axiom (No Write Up) Subjects at a certain security level may not write to a higher level. Continuing our example, the assembly line worker cannot write actionable orders for the manager and the manager cannot write actionable orders for the president. (Usually an asterisk [*] is used as a star, as in the * integrity axiom.)
3. The Invocation Property The invocation property prevents a user at one level from using or invoking the powers or privileges of the user at a higher level.

The Biba model is used primarily in the business environment where data and object integrity is of primary concern. In this model, individuals at a lower level may not create or modify data at a higher level.

Clark-Wilson Model

The goal of the Clark-Wilson model is to enforce separation of duties through integrity rules. This model places a mechanism such as a software program between the subject and object. The software program separates the subject and object. This model enforces data integrity by checking, screening, or formatting data prior to it being placed in the object, such as a database. The Clark-Wilson model enforces what is called “well-formed transactions.” This model also enforces such integrity policies as authorized users may not take unauthorized actions and unauthorized users will not be allowed access.

Brewer-Nash Model (Chinese Wall)

The Brewer-Nash model is used in many business organizations to prevent conflict of interest situations within the same business. Objects are classified in a manner that indicates conflicts of interest. For example, if a business is providing different services for the same client, each branch or department is isolated from the other with no knowledge of the other departments' activities. This eliminates the possibility of a conflict of interest. This is also referred to as providing a Chinese wall between the two groups. Each group's information (objects) is classified so that it may not be accessed by the other.

Dual Control

Dual control refers to an access mechanism whereby two individuals must work together to gain access. In some cases it is referred to as split knowledge as well as separation of duties. Dual control may be specifically utilized for access to encryption keys when two or more individuals maintain partial knowledge. When their knowledge is combined access is granted to the item, such as access to an encryption key or encrypted message authentication codebook or physical access. Dual-control access mechanisms are highly relied upon in the U.S. military where total responsibility for access by one individual must be avoided.

Device Authentication, Certificate-Based Authentication

In many security situations it is desirable to authenticate not only the individual but also the machine or device they are using. Certificate-based authentication requires that a valid digital certificate be maintained on a machine or device from which the user authenticates. Authentication relies upon the certificate information and encrypted user password. This combination authenticates not only the user but the device that they are using. In device-to-device authentication, a similar scenario is used during the authentication process; valid certificate information is used to authenticate devices to each other. Certificate-based authentication may be accomplished through a commercial certificate issued by certificate authorities (CAs) such as VeriSign or through internal corporate CAs managed by the organization.

A very lightweight version of device authentication may be accomplished through the use of cookies. Cookies can be installed on various devices to identify them. Although not significantly utilized for communication encryption, devices may be initially authenticated by banks, financial institutions, and e-commerce sites as having been previously used by the user requesting initial authentication into their system.

Reverse Authentication

With reverse authentication and mutual authentication, not only does the user authenticate to the system when requesting access, they also have knowledge that the system they are contacting is in fact a genuine site. Various techniques have been used, from complex mutual handshake technology to visual cues.

Banks and financial institutions have utilized visual identification cues that only the logging-in user would recognize. It consists of a simple picture they selected upon account initialization. The user is then presented with the picture during login.

The unfortunate downside of this technique is that the end user may not realize that this is an authentication technique or cannot remember that this was a picture that they selected, and other than terminating the session, they have no method of communication or validation other than contacting the institution's customer service department. A more successful method of reverse authentication is actually through the use of personal security questions. Personal security questions have been primarily intended as an initial factor of authentication of the user by the institution. But, a spoofing website will not have access to the correct answers to the user's questions. Thereby, even if the spoofing website is capable of obtaining login and password information, access to the real website will still be denied.

Privileged Accounts

Privileged users are typically super-users or administrators who have an elevated level of rights, privileges, and access capability to applications and data. Throughout the IT security organization, privileged account users present special access control concerns. Possessing the ability to bypass many access control methodologies, they may be capable of modifying many normal system controls. Privileged users should always be required to log on to two accounts: their privileged user account and their normal user account which allows access to email and regular daily applications. All privileged accounts should be closely monitored and audited regularly for privilege escalation or de-escalation as the situation requires.

The following are guidelines for privileged accounts:

1. Account Creation Assign privileged accounts only as required. Screen, background check, and document users assigned to privileged accounts.
2. Policies and Procedures Privileged account holders transcend everyday users and even ­corporate executives with their access capability. Consider requiring more stringent authorized use policies, nondisclosure agreements, noncompete agreements, and confidentiality agreements for these individuals.
3. Account Provisioning Using the “least privilege” concept gives a privileged account only the minimum rights and capabilities required for the role. For example, do not give a database administrator the same rights as a server administrator or system administrator.
4. Account Monitoring Always monitor and log all privileged account accesses and actions. Store these logs on a remote server to which the privileged account holder does not have access (separation of duties). Assign an individual to monitor and report on the logs regularly.
5. Dual Accounts Always provide the privileged account holder with a regular personal account for email and daily routine access. Never log into a privileged account to perform personal business.
6. Separate Machines Ideally, establish a virtual machine to log into the privileged account. This eliminates the possibility of any malware migration onto the privileged machine or the servers and applications being administered.
7. Escrow Passwords Passwords, encryption keys, and other account login information may be placed in blind escrow in the event of incapacity or termination.
8. Account Deprovisioning Establish a deprovisioning plan to use in the event of incapacity or termination for privileged accounts. The plan should restrict access and change passwords but securely retain information for future access if required.

User Accounts

All corporate employees fall under the user accounts umbrella. Identity management refers to the management of all of the accounts within the corporate domain. Each account has an account life cycle that must be managed by the IT department. This management of user accounts during the account life cycle is called identity management. A general account policy should be established with standards and procedures to be followed during the account life cycle. Finally, a person or department should be specified to carry out the account life cycle tasks. The following events or activities are included as account maintenance during the account life cycle:

1. Provisioning During the provisioning phase, accounts are created, and the appropriate application licenses, system rights, and privileges are assigned to the account. User entitlement refers to the rights and privileges provided to a user. An important consideration when establishing a new user account is naming and identifying standards established by the policies. This maintains a consistency of account names, email addresses, and private folder names. To speed this provisioning process, many IT departments have established a number of user groups of like roles or privileges and assigned the individual to the appropriate group. These groups might be the accounting department, sales department, senior executives, marketing department, and so on.

   This grouping of roles also involves assigning various security privileges, which in this case is role-based access control (RBAC). Some organizations use an automated provisioning application where the HR department enters various new-hire information, including an assigned group or role, and the software application provisions the account using this department-supplied information.

2. Password Maintenance This is generally a corporate policy that is usually enforced by a Windows Server Group Policy manager. Passwords should conform to the length and ­complexity, expiration date, minimum password age, password history, and other provisions within the corporate password policy.
3. Account Audit Accounts should be audited on a schedule as specified in a corporate account policy to determine if the current account access rights and privileges match the current role and requirements of the existing position. This prevents privilege escalation with job rotation or reassignment.
4. Account Proofing The term account proofing has various meanings in different circles. Microsoft has used it to mean requiring an authentication validation, such as a phone ­number, address, or zip code. In other scenarios, the term refers to verifying that the account belongs to the stated individual through the use of various authentication tests and audit techniques.
5. Account Privilege Change A change management process should be established to service the requirements of assigning additional rights and privileges to an individual account.
6. Account Entitlement Account entitlement refers to the access enabled or available for any user account. Various government and financial institution regulations require regular annual audits be performed on user accounts that access sensitive applications and data.
7. Account Deactivation This is a procedure undertaken immediately upon resignation or termination of an account owner. A corporate policy or service-level agreement (SLA) should be established that triggers account deactivation immediately upon a separation event. All managers and HR individuals must be aware of the policy and how to take immediate action to protect the company assets. Account deactivation removes only the password and user access. All underlying folders and information remain intact.
8. Account Deprovisioning This is an organized disassembling of rights and privileges of the user account as well as archiving any folders, data, applications, user history, logs, or other user-specific information as required by policy. Ultimately, hardware is recycled, disposed of, or destroyed as required by policy.

Account Lockout Policy

The account lockout policy may generally fall under the account password policy. It features an ability to prohibit resource access after a preset number of attempts to log in. This policy directly addresses brute-force password hacking attempts. There are several provisions of this type of policy:

1. Request to Reset This is a procedure the user must follow in an effort to reset a password. The help desk or other IT contact verifies the user information and, upon authentication, issues either a replacement or temporary password to the user. In many cases, an automated system may be accessed by the user to access a forgotten password or reset a password.
2. Threshold of Entry Attempts This is the number of times an incorrect password may be attempted before the user account is locked out. The lockout may be resolved through a help desk contact procedure or through a wait period.
3. Wait Period This is the time duration after the threshold of entry attempts has been reached. In many cases, this period is 30 minutes, after which the user may attempt to enter their password.
4. Reset Interval This is the time required that must elapse between password resets. It is typically set at two days. This prohibits the user from resetting their password several times in the same day.

Last Login Notification

The last login notification is a security check. Upon login, the returning user is greeted with a message such as “Your last login was Sunday, May 21, 2014.” This may alert the user that there has been a violation on that machine if they did not log in on that day. This technique is popular in high-security environments and the banking industry.

Violation Warning Screen

Some companies enforce user policies by flashing a warning screen on the user machine (Figure 3.13). This may be in response to an attempt to access secure information or a blacklisted website or even inserting a USB drive into the machine.

Account Callback

This process originally began as a telephone callback when a remote user called in for modem access to a computer system. The system would terminate the call and call the user back to verify their location. Today, many banks and financial and other important institutions will email or text the user with a passcode that must be entered into the account logon screen to further the authentication process.

Guest Account

Many companies establish a guest login on a separate VLAN for guest-level Wi-Fi services within the premises. The guest account may be general in nature and only allow the user to connect with the Internet via a temporary account

This type of account may be assigned to a temporary worker or someone who might be replacing an employee on medical or maternity leave. Based upon the principle of least privileges, this account is usually short term and is allowed access to only the tasks of the person they are replacing but not to items such as the user's email, personal information file, storage locations, or nontask applications.

Contractor Account

A contractor account is a temporary account established for a contractor of a business. A contractor might be a temporary team of individuals, a programmer, or another person who is not a full-time employee of the business. A contractor account may be hosted on a VLAN. These accounts are based upon the principle of least privilege and are usually tracked with logs. Some contractor accounts may have a duration of several years.

Authorized Use Policy (AUP)

The authorized use policy (AUP) is a screen that is displayed to an account at login notifying the user of various requirements or policies they must agree to prior to and during the use of the company resources.

Role-Based Access Control

Role-based access control (RBAC) is similar to and can be enforced by Group Policy manager (Figure 3.14). Typically, users with very similar or identical roles are identified and placed in a group. Access control is granted to all individuals in the group based upon their membership in the group. This type of administration is ideal for large groups such as call center employees, bank tellers, store clerks, and stock traders or with groups in which numerous adds and drops occur frequently. Once a user is assigned to the group, they receive all the rights and privileges anyone in the group has received.

Rule-Based Access Control

Rule-based access control (RBAC or RAC) is based upon explicit rules that have been established to control the activities of subjects. Various rules may be created to allow or restrict access to objects. One such rule is the time of day restriction. This rule establishes when a resource or object may be accessed. For example, if the user is never required to access a database on a Saturday or Sunday from either within the building or a remote location, a rule may be established restricting access. It is important to note that role-based access control and rule-based access control may both be referred to as RBAC.

Centralized Authentication

Centralized authentication is a method by which users can log onto a network one time using identification and authentication techniques. Centralized refers to the technique of having one central authentication server providing user lookup services and allowing or disallowing access to the data and resources. One centralized system may be used by ­thousands or tens of thousands of users to access organizational resources.

Decentralized Authentication

With decentralized authentication, every server or application is required to verify the identification and authentication of the user requesting access. As you may imagine, this may be a huge task to maintain adequate access control lists on each and every application and resource within an organization. Decentralized authentication may be applied in very specific and vertical instances where a limited number of users have been given rights and privileges to the resource. As the number of users grows, the more arduous the task of administering user rights becomes.

Single Sign-On

Single sign-on (SSO) is an identification authentication technique whereby the user signs on one time and has access to multiple applications. The user authenticates one time, and the system passes this authentication to applications and other entities. This is known as single sign-on authentication. It increases password security by reducing the number of passwords a user must remember. The risk in this process is that an attacker has access to multiple applications if the user password is discovered. Several single sign-on authentication mechanisms exist. One of the most popular is Kerberos.

Kerberos

Kerberos a computer network authentication protocol is named after a three-headed Greek god named Cerberus, known as the hound of Hades. It was originally programmed for Unix by a group from the Massachusetts Institute of Technology (MIT) in the late 1980s. All Microsoft Windows implementations after Windows 2000 use Kerberos as the default authentication protocol.

The current gross model is based on a transitive trust system. In such a system, if A trusts B and C trusts B, then A trusts C. In this example, B is represented by a Kerberos server and A, desiring to access C, would be authenticated by the Kerberos server. All of this is performed through the use of tickets.

The use of this system would be to achieve the following scenario:

1. Scenario The user requests authentication by the Kerberos system and requires access to any or all of four applications they have permissions to access.
2. Process
   1. Authentication request.

      The user sends an authentication request to the Kerberos authentication server.

   2. Authentication reply.

      The Kerberos server responds with a secret symmetric key and a ticket-granting ticket (TGT), which is time stamped.

   3. Application access request.

      When the user desires access to a specific application, the user sends the request to a Kerberos ticket-granting server.

   4. Session ticket reply.

      Upon receiving the ticket granting ticket, the ticket-granting server responds with a ticket for use with the target application. This ticket contains the symmetric key of the ticket granting server.

   5. Presentation of ticket.

      The user presents the time-stamped session ticket to the application.

   6. Ticket verification.

      The application server verifies the session ticket by comparing the symmetric key contained in the ticket with the pre-shared key it has stored. If they match the application server, it has authenticated the user and authentication of the ticket.

In the preceding scenario, the user is authenticated by a server one time. The server issues a ticket granting ticket to the user that can be used to request session tickets or access to servers. When the user wishes to access another server resource, the user issues the ticket-granting ticket and specifies the resource. A resource-specific session ticket is issued to the user. The user presents this ticket to the requested application server. Through the use of pre-shared symmetric encryption keys, the application server verifies the authentication of the user and ticket.

Federated Access

Federated access allows users to be identified and authenticated to multiple networks or systems. Where single sign-on allows users to access servers and applications within a single network system, federated access is an agreement between different companies or networks to allow the identified and authenticated user on one network to access another network.

An example of federated access is evident during the use of popular flight and hotel room booking websites. Once you log on and make your flight or room reservation, you might be asked if you would like to rent a car. When you select a car rental company, your identification and authentication information is passed by means of the federated database to the federated partner. That auto rental company will then allow you to book a rental car using your original sign-on information.