380 lines
20 KiB
Plaintext
380 lines
20 KiB
Plaintext
Computer Systems Laboratory Bulletin
|
||
November 1991
|
||
|
||
ADVANCED AUTHENTICATION TECHNOLOGY
|
||
|
||
Introduction
|
||
Computer systems and the information they store and process are
|
||
valuable resources which need to be protected. With the current
|
||
trend toward networking, compromise of one computer on a network
|
||
can often affect a significant number of other machines connected
|
||
to the network.
|
||
|
||
The first step toward securing a computer system is the ability
|
||
to verify the identity of users. The process of verifying a
|
||
user's identity is typically referred to as user authentication.
|
||
Passwords are the method used most often for authenticating
|
||
computer users, but this approach has often proven
|
||
inadequate in preventing unauthorized access to computer
|
||
resources when used as the sole means of authentication. This
|
||
bulletin describes advanced authentication technology which can
|
||
be used to increase the security of computer systems and
|
||
provides guidance in the selection and use of this technology.
|
||
|
||
User Authentication
|
||
Authentication technology provides the basis for access control
|
||
in computer systems. If the identity of a user can be correctly
|
||
verified, legitimate users can be granted access to system
|
||
resources. Conversely, those attempting to gain access without
|
||
proper authorization can be denied. As used in this bulletin,
|
||
authentication is defined as the act of verifying the identity of
|
||
a user. Once a user's identity is verified, access control
|
||
techniques may be used to mediate the user's access to data. A
|
||
variety of methods are available for performing user
|
||
authentication.
|
||
|
||
The traditional method for authenticating users has been to
|
||
provide them with a secret password, which they must use when
|
||
requesting access to a particular system. Password systems can
|
||
be effective if managed properly (Federal Information Processing
|
||
Standard [FIPS] 112), but they seldom are. Authentication which
|
||
relies solely on passwords has often failed to provide adequate
|
||
protection for computer systems for a number of reasons. If
|
||
users are allowed to make up their own passwords, they tend to
|
||
choose ones that are easy to remember and therefore easy to
|
||
guess. If passwords are generated from a random combination of
|
||
characters, users often write them down because they are
|
||
difficult to remember.
|
||
|
||
Where password-only authentication is not adequate for an
|
||
application, a number of alternative methods can be used alone or
|
||
in combination to increase the security of the authentication
|
||
process. The three generally accepted methods for verifying the
|
||
identity of a user are based on something the user knows, such as
|
||
a password; something the user possesses, such as an
|
||
authentication token; and some physical characteristic of the
|
||
user, such as a fingerprint or voice pattern.
|
||
|
||
Token-Based Authentication
|
||
Token-based authentication schemes require the system user to
|
||
produce a physical token which the system can recognize as
|
||
belonging to a legitimate user. These tokens typically contain
|
||
information which is physically, magnetically, or electrically
|
||
coded in a form which can be recognized by a host system. The
|
||
automatic teller machines used by the retail banking industry,
|
||
which require the user to carry a magnetic stripe card, are one
|
||
example of token-based authentication systems. The most
|
||
sophisticated tokens contain one or more integrated circuits
|
||
which can store and, in some cases, process information.
|
||
Tokens which are manufactured in the form of a credit card with
|
||
an onboard microprocessor and memory are commonly referred to as
|
||
"smart" cards.
|
||
|
||
Token-based systems reduce the threat from attackers who attempt
|
||
to guess or steal passwords, because the attacker must either
|
||
fabricate a counterfeit token or steal a valid token from a user
|
||
in addition to knowing the user's password.
|
||
|
||
Biometric Authentication
|
||
Biometric authentication relies on a unique physical
|
||
characteristic to verify the identity of system users. Common
|
||
biometric identifiers include fingerprints, written signatures,
|
||
voice patterns, typing patterns, retinal scans, and hand
|
||
geometry. The unique pattern which identifies a user is formed
|
||
during an enrollment process, producing a template for that user.
|
||
|
||
When a user wishes to authenticate to the system, a physical
|
||
measurement is made to obtain a current biometric pattern for the
|
||
user. This pattern can then be compared against the enrollment
|
||
template in order to verify the user's identity. Biometric
|
||
authentication devices tend to cost more than password or token-
|
||
based systems, because the hardware required to capture and
|
||
analyze biometric patterns is more complicated. However,
|
||
biometrics provide a very high level of security because the
|
||
authentication is directly related to a unique physical
|
||
characteristic of the user which is more difficult to
|
||
counterfeit. Recent technological advances have also helped to
|
||
reduce the cost of biometric authentication systems.
|
||
|
||
Combination Methods
|
||
Passwords, authentication tokens, and biometrics are subject to a
|
||
variety of attacks. Passwords can be guessed, tokens can be
|
||
stolen, and even biometrics are susceptible to certain attacks.
|
||
These threats can be reduced by applying sound design principles
|
||
and system management techniques during the development and
|
||
operation of an authentication system.
|
||
|
||
One method which can substantially increase the security of an
|
||
authentication system is to use a combination of authentication
|
||
techniques. For example, an authentication system might require
|
||
users to present an authentication token and also enter a
|
||
password. By stealing a user's token, an attacker would still be
|
||
unable to gain access to the host system, because the system
|
||
would require the user's password in addition to the token.
|
||
|
||
Implementation Guidelines and Recommendations
|
||
An organization must answer numerous questions when it decides to
|
||
implement an advanced authentication system. The following
|
||
guidelines will assist those responsible for evaluating,
|
||
procuring, and integrating these systems.
|
||
|
||
Risk Analysis - A thorough analysis should be done to
|
||
determine what parts of the system in question are vulnerable to
|
||
attack, and to prioritize these vulnerabilities in terms of
|
||
severity and likelihood.
|
||
|
||
Product Evaluation and Selection - Once the risks associated with
|
||
a host system have been identified, this information can be used
|
||
to select an authentication system which provides adequate
|
||
protection against these risks. In addition, the authentication
|
||
system will have to meet several other requirements in order to
|
||
function effectively in a given environment. The organization
|
||
responsible for selecting the authentication system should decide
|
||
whether sufficient in-house expertise exists to evaluate the
|
||
available options. In some cases, it is more cost-effective to
|
||
hire a consultant who is familiar with the available technology.
|
||
|
||
Whether the evaluation is done in-house or by a consultant, the
|
||
following items should be considered:
|
||
|
||
o Sources of information - A variety of sources should be used
|
||
when evaluating authentication systems. Vendor product
|
||
literature can be very helpful in describing specific
|
||
details of product operation, and in understanding the range
|
||
of products offered. There are several annual conferences
|
||
devoted to computer security, network access control, and
|
||
authentication technology. In addition to the papers
|
||
presented at these conferences, there are usually large
|
||
vendor exhibit halls and product forums. Many
|
||
organizations, particularly those in the government sector,
|
||
have published information on the selection and integration
|
||
of advanced authentication technology. These publications
|
||
are often the result of practical experience gained during
|
||
the implementation of these systems, and so can be
|
||
particularly useful.
|
||
|
||
o Integration into existing environment - This factor is
|
||
discussed further in the next section, but is an important
|
||
consideration when selecting a product. All other features
|
||
of an authentication system may be irrelevant if the product
|
||
cannot be integrated into the customer's computing
|
||
environment.
|
||
|
||
o Custom design - Sometimes an organization's needs cannot be
|
||
met by a commercially available product. In these cases,
|
||
the organization may decide to do a custom design using
|
||
in-house resources. This alternative is most practical for
|
||
large organizations with experienced system design and
|
||
support groups, or for smaller organizations with a high
|
||
level of expertise in computer access control systems.
|
||
Vendors are often willing to work with customers to modify
|
||
existing products or design new products to meet custom
|
||
requirements. An arrangement which often works well is for
|
||
the customer and vendor to work together on the design of
|
||
the system, and for the vendor to then manufacture the
|
||
product.
|
||
|
||
o Cost and performance - The relationship between cost and
|
||
performance can be relatively complex for authentication
|
||
technology. Similar products from different vendors may
|
||
vary widely in cost, depending on the vendor's manufacturing
|
||
and development techniques and marketing philosophies. In
|
||
general, devices with a higher performance level will cost
|
||
more, but individual cases should be evaluated carefully.
|
||
The general approach should be to procure the authentication
|
||
system which provides the required level of security and
|
||
other performance factors at a minimum cost.
|
||
|
||
o Accuracy - The accuracy of an authentication system refers
|
||
to the ability of that system to correctly identify
|
||
authorized system users while rejecting unauthorized users.
|
||
Since this is the primary function of an authentication
|
||
system, accuracy is directly related to the level of
|
||
security provided by the system. Vendors may not be
|
||
objective about producing and interpreting the results of
|
||
tests which quantify the accuracy of the authentication
|
||
process with regard to the vendor's particular products.
|
||
For these reasons, an organization may wish to run
|
||
independent tests to determine the accuracy of an
|
||
authentication system in terms which are relevant to the
|
||
environment in which the system will be used.
|
||
|
||
o Reliability - An authentication system should be capable of
|
||
operating in its intended environment for a reasonable
|
||
period of time. During this time, the system is expected to
|
||
perform at or above a level which ensures an appropriate
|
||
amount of protection for the host system. If the
|
||
authentication system fails, the chances for unauthorized
|
||
access during the failure should be minimized.
|
||
|
||
o Maintainability - All hardware and software systems require
|
||
some form of maintenance. The components of an
|
||
authentication system should be evaluated to determine the
|
||
level of maintenance which the system will require. One
|
||
goal in the design of an authentication system should be to
|
||
minimize the maintenance requirements within the constraints
|
||
of system cost, performance, and available technology.
|
||
|
||
o Commercial availability - Large-scale networking of computer
|
||
systems and distributed computing are relatively recent
|
||
developments, and are the driving forces behind the need for
|
||
more effective methods for authenticating system users.
|
||
Unfortunately, the market for advanced authentication
|
||
technology is not fully developed and is somewhat unstable.
|
||
Many commercially available authentication systems have not
|
||
yet been sold in quantity. An organization that is
|
||
considering the use of this technology should evaluate the
|
||
vendor's ability to produce systems that meet specific
|
||
quality control standards and in sufficient quantity to meet
|
||
the user's requirements. Contracts written to procure
|
||
authentication systems should provide some form of
|
||
protection for the customer in the event that the vendor is
|
||
unable to produce systems in the quantities required.
|
||
|
||
o Upgradeability - Because the technology of advanced
|
||
authentication systems is continually developing, any
|
||
authentication system should be able to accommodate the
|
||
replacement of outdated components with new ones. A modular
|
||
approach to the design of an authentication system, with
|
||
clearly defined interfaces between the system components,
|
||
facilitates the process of upgrading to new technology.
|
||
|
||
o Interoperability - A wide variety of computing platforms and
|
||
security architectures are in use today. Any authentication
|
||
system should be designed to work with as many of these
|
||
diverse platforms as possible, or at least to require a
|
||
minimum of modifications to work in different environments.
|
||
|
||
o Reputation of manufacturer - Obtaining satisfactory service
|
||
during the selection, installation, and long-term operation
|
||
of an authentication system can be difficult if the
|
||
manufacturer is uncooperative. Customers can request a list
|
||
of references from prospective vendors for products and
|
||
services which have been provided to other customers in the
|
||
past. In addition, the resumes of key individuals working
|
||
on the vendor's staff can sometimes be examined to determine
|
||
whether an adequate level of expertise is available.
|
||
|
||
o Training programs - Some form of training is usually
|
||
necessary for the people who will be using and maintaining
|
||
an authentication system. An effective training program is
|
||
of critical importance to the success of any new system.
|
||
Vendors should offer training appropriate for everyday users
|
||
of the system, and also for the system administrators who
|
||
will be responsible for managing the system.
|
||
|
||
System Integration - The integration of an authentication
|
||
system into an existing computer environment can be very
|
||
difficult. Most operating systems do not contain well-defined
|
||
entry points for replacing the default authentication mechanism
|
||
supplied with the operating system. This is partly because there
|
||
is no widely accepted standard for the interface between an
|
||
operating system and an authentication device. Until such a
|
||
standard becomes available, there are three general options:
|
||
|
||
o In some cases, the vendor who provides the authentication
|
||
system may have already integrated it into certain operating
|
||
systems. If the authentication system meets the
|
||
requirements of the customer and the customer is using the
|
||
specified operating system, then the system integration has
|
||
already been accomplished.
|
||
|
||
o Operating system vendors may select certain security
|
||
architectures for incorporation into their systems. If
|
||
these architectures include an authentication technology
|
||
which the customer finds acceptable, then the operating
|
||
system may be purchased with the appropriate authentication
|
||
mechanism as part of the package.
|
||
|
||
o It may be necessary to customize the authentication system
|
||
and perhaps modify the host operating system so that the two
|
||
can communicate. This will involve cooperation between the
|
||
operating system vendor, the authentication system vendor,
|
||
and the customer, unless the customer has sufficient
|
||
expertise to perform the integration in-house. A
|
||
prototyping approach is strongly recommended, due to the
|
||
complexity of this type of project. Implementing such a
|
||
system on a small scale first can be very helpful in
|
||
determining what problems will be encountered in a
|
||
full-scale implementation.
|
||
|
||
System Maintenance - After an authentication system has
|
||
been selected and installed, it must be maintained. Maintenance
|
||
costs can easily exceed the initial acquisition cost if the
|
||
system is to be in operation for a reasonable length of time. It
|
||
is therefore important that long-term plans for system
|
||
maintenance be developed by the customer or provided by the
|
||
vendor in the initial stages of the procurement cycle.
|
||
Provisions must be made for assigning responsibilities for system
|
||
administration so that new users can be enrolled, inactive
|
||
accounts deleted, and system malfunctions identified and
|
||
corrected.
|
||
|
||
The majority of network authentication systems employ some form
|
||
of cryptography, which means that some form of cryptographic key
|
||
management system will be necessary. The key management
|
||
component may be provided by the authentication system vendor,
|
||
but the process of maintaining and distributing keys usually
|
||
requires active participation by the host system. Since the
|
||
security of a cryptographic system is directly related to the
|
||
level of protection provided for the cryptographic keys, it is
|
||
essential for the vendor or customer to develop a system for
|
||
managing these keys effectively. Also, the host computer system
|
||
will probably evolve over time through the addition of new
|
||
software and hardware, and these changes may require
|
||
corresponding modifications or upgrades to the authentication
|
||
system to maintain compatibility.
|
||
|
||
Summary
|
||
Password-based authentication is the most widely used method for
|
||
verifying the identity of persons requesting access to computer
|
||
resources. However, authentication based only on passwords often
|
||
does not provide adequate protection. The use of authentication
|
||
tokens, biometrics, and other alternative methods for verifying
|
||
the identity of system users can substantially increase the
|
||
security of an authentication system. The proliferation of
|
||
networked computer systems and the corresponding increase in the
|
||
potential for security violations makes it even more critical
|
||
those who design and operate computer systems to understand and
|
||
implement effective authentication schemes.
|
||
|
||
References
|
||
|
||
Guideline on User Authentication Techniques for Computer
|
||
Network Access Control, National Institute of Standards and
|
||
Technology (U.S.), Federal Information Processing Standards
|
||
Publication 83, National Technical Information Service,
|
||
Springfield, VA, September 1980.
|
||
|
||
Computer Data Authentication, National Institute of Standards
|
||
and Technology (U.S.), Federal Information Processing
|
||
Standards Publication 113, National Technical Information
|
||
Service, Springfield, VA, May 1985.
|
||
|
||
Biometric Access Control Device Evaluation Criteria (Draft
|
||
Report), DCI Intelligence Information Handling Committee,
|
||
Access Control Subcommittee, Community Headquarters Building,
|
||
Washington, DC 20505, February 1991.
|
||
|
||
Smart Card Technology: New Methods for Computer Access
|
||
Control, National Institute of Standards and Technology
|
||
(U.S.), NIST Special Publication 500-157, September 1988.
|
||
|
||
Financial Institution Sign-On Authentication for Wholesale
|
||
Financial Transactions, American National Standard X9.26,
|
||
American National Standards Committee X9, American Bankers
|
||
Association, May 1990.
|
||
|
||
Password Usage, National Institute of Standards and
|
||
Technology (U.S.), Federal Information Processing Standards
|
||
Publication 112, National Technical Information Service,
|
||
Springfield, VA, May 1985.
|
||
|
||
For More Information
|
||
For further information on NIST's ongoing work in advanced
|
||
authentication technology, contact Jim Dray, Computer Security
|
||
Division, Room A216, Technology Building, National Institute of
|
||
Standards and Technology, Gaithersburg, MD 20899, (301) 975-
|
||
3356.
|
||
Downloaded From P-80 International Information Systems 304-744-2253
|