Authentication with Minimal User Interaction

Size: px

Start display at page:

Download "Authentication with Minimal User Interaction"

Claud Hunt
5 years ago
Views:

1 Authentication with Minimal User Interaction Authentication Authentication - Verification of a user, usually through the use of private credentials. What you know - Username/Password combination What you have - Card Who you are Face, Fingerprint, Voice, etc. 1

resources now more common Challenges of physical access security devices Keys cards Physical Security

2 Physical Security Protecting access to physical resources Locked rooms Physical machines Cars Old methods relied on physical locks Security of standard tumbler lock Digital protection of physical resources now more common Challenges of physical access security devices Keys cards Physical Security 2

Physical Security Physical realms now more commonly secured with digital resources RFID access cards NFC technology Car Key Fobs Most examples rely on wireless technologies.

3 Physical Security Physical realms now more commonly secured with digital resources RFID access cards NFC technology Car Key Fobs Most examples rely on wireless technologies. Problems? Security of wireless? Physical attacks? Zero-Interaction Authentication & Relay Attack Resistance 3

4 Zero-interaction (de)authentication PKES Passive Keyless entry and start Easy-to-use security 7 Zero-interaction (de)authentication Easy-to-use security BlueProximity project in SourceForge Corner and Noble, MobiCom

5 Ghost-and-leech relay attack Leech Kfir and Wool, SecureComm 05 Francillon et al., NDSS 11 Ghost 9 Reader-and-ghost relay attack Drimer and Murdoch, USENIX Security Symposium '

6 Defenses to Relay Attacks Distance Bounding Contextual Co-presence 11 Existing Solution Brands and Chaum, EUROCRYPT 93 Distance bounding *1 light microsecond = 300m Prover Prior security association (e.g., shared key) Verifier minimize Measure RTT 12 6

7 Context Verbal Meaning 13 Contextual Co-Presence Detection (Benign Case) 14 7

8 Contextual Co-Presence Detection (Relay Attack) 15 Environmental Context Examples Acoustic & electromagnetic environment Audio (Au) WiFi (W) Bluetooth (B) GPS Natural physical ambient environment Temperature (T) Humidity (H) Gas Ratio (G) Altitude (Al) T. Halevi et al., ESORICS 2012 J. Krumm and K. Hinckley, UbiComp 2004 A. Varshavsky et al., UbiComp 2007 D. Ma et al., IEEE TDSC

Environmental Context Detection Acoustic and RF environment Sensors already available in current smartphones Physical ambient environment

9 Environmental Context Detection Acoustic and RF environment Sensors already available in current smartphones Physical ambient environment Off-the-shelf ambient sensing device -- Sensordrone 17 Acoustic & RF Context Data Collection Device A Device B Client component Server 18 9

10 Natural Context Data Collection 19 Co-Presence Detection Design Machine learning approach Multiboost algorithm pruned J48 Graft/Random Forest as weak learner algorithm ten-fold cross validation Evaluation metrics False Positive Rate (FPR): measure of security False Negative Rate (FNR): measure of usability Performance FNR, FPR, F-measure, and Matthew s correlation coefficient (MCC) 20 10

validation Time frequency distance Temperature, humidity, gas, altitude Hamming distance 22 Acoustic & RF

11 F-Measure Environmental Context Features WiFi, Bluetooth, GPS Jaccard distance Mean of Hamming distance Euclidian distance Mean of exponential of difference Sum of square of ranks Subset count Audio Max cross validation Time frequency distance Temperature, humidity, gas, altitude Hamming distance 22 Acoustic & RF Context Detection Results 1 For all audio-rf combined s 8s 10s 12s 15s 0.75 Time Budget 23 11

FPR/FNR F-Measure Natural Context Detection Results 1.00 0.80 0.60 0.40 0.20 0.

0530 0.0296 FPR 0.3240 0.3036 0.2981 0.1625 0.0985 0.0683 0.0581 F-Measure 0.

957 24 Discussion How do Physical Ambient Modalities compare with other

12 FPR/FNR F-Measure Natural Context Detection Results T G H Al H-Al H-G-Al T-H-G- Al FNR FPR F-Measure Discussion How do Physical Ambient Modalities compare with other commonly available sensor modalities? Temperature, Humidity, Gas, Pressure/Altitude vs RF Sensors (WIFI, Bluetooth, GPS), Audio 21 12

13 Discussion Availability of sensors 26 Discussion Response Time Sensors for physical parameters are typically faster than common RF sensors 27 13

Discussion Battery Power Consumption Low power

influence on the power consumption than RF sensors

14 Discussion Battery Power Consumption Low power consumption compared to common RF sensors Minimal influence on the power consumption than RF sensors 28 Discussion Adversarial Settings Changing multiple physical ambient modalities simultaneously will be harder increases the likelihood of being noticed 29 14

15 Discussion Privacy (Location) Privacy Modalities keep on changing 30 Discussion Other Sensors? 31 15

16 Conclusion Co-presence detection based on information collected from multiple different physical ambient sensors Approach for preventing relay attacks Improved security, efficiency & privacy 32 Two-Factor Authentication 16

Introduction Password only systems Two Factor Authentication

dictionary attack Many real-world instances Password re-use

17 Introduction Password only systems Two Factor Authentication TFA (Password + onetime code) Online guessing attack Offline dictionary attack Many real-world instances Password re-use More than 200,000 of these passwords have reportedly been cracked so far. 36 Current State D = 2^d = Size of a password dictionary t = z = bandwidth of Device to Client channel x = time 37 17

18 Adoption Small user adoption (if TFA optional) Only 25% of Americans use TFA Only 6% of 100k Gmail accounts have TFA enabled So Let s Minimize user-phone interaction QR/Blutooth/Wifi (Shirvanian et al., NDSS 14) USB/NFC Dongles (U2F FIDO Universal 2nd Factor) Sense the environment (Karapanos et al., Usenix 15) 38 LBD/MBD/FBD TFA (Shirvanian et al., NDSS 14) 39 18

19 Main Idea Server stores a hash of the password and a secret s, h=h(p,s) Device stores the secret s Authentication decision based on whether user provides the correct password and owns the device which stores s 40 Protocols Time-based TFA protocol Applicable to all device types (Low, Mid, High Bandwidth) Rely on a clock synchronized with the server Challenge-Response TFA Protocols Symmetric-key and public-key TFA protocols Applicable for devices that receive a challenge and show PIN 41 19

20 Time-Based TFA Protocol 42 Symmetric-Key TFA Protocol 43 20

21 Public-Key TFA Protocol 44 LBD Authentication Phase 45 21

22 MBD Authentication Phase 46 FBD Authentication Phase 47 22

23 Discussion and Conclusion Security: All mechanism provide improved resilience to offline dictionary attacks and online attacks. Challenge-Response protocols are secure against a lunch-time attacker. FBD mechanisms are more secure against online attacks. Usability: There is no time synchronization requirement in Challenge Response mechanisms. In high bandwidth channels user does not need to manually transfer the PIN. Deployability: Traditional and LBD work with a plain browser and no special hardware. 48 U2F FIDO Universal 2nd Factor 49 23

created by Google and Yubico, with contribution from NXP, and is today hosted by

24 About U2F U2F is an open authentication standard that enables internet users to securely access any number of online services, with one single device U2F was created by Google and Yubico, with contribution from NXP, and is today hosted by FIDO Alliance Main Idea The YubiKey requires nothing more than a simple tap or touch: 24

25 The Protocol Protocol Details Challenge-response challenge-response authentication flow, based on public-key cryptography The key pair is generated in the device s tamper-resistant execution environment Phishing and MitM protection the client compiles what it knows about the current HTTP connection this information is then signed by the U2F device and sent to the server Device cloning detection A counter, sent from the device to the server 25

26 Sound Proof (Karapanos et al., Usenix 15) 54 Main Idea Leverage the proximity between user s phone and computer as the second factor Proximity can be verified by: Using local communication channels (phone-computer communication) Sense ambient audio to verify proximity Usable: No user-phone interaction Deployable: Compatible with smartphones and major browsers without plugins Sound-Proof works in a variety of environments, even if the phone is in a pocket or purse 55 26

27 Architecture overview 4. Record 4. Record 5. Calculate Similarity Score s 56 The protocol 57 27

28 Remote Attacker Silence can help the attacker. Silent samples are rejected Attacker wins if samples are similar 58 Co-locator Attacker Similar samples! Attack succeeds Attack trivial if no user-phone interaction 59 28

Evaluations Environment: office, office-music, home-tv, lecture room, train station, café Laptop: MacBook Pro Mid 2012, Dell E6510 (using Google Chrome) Phone: iphone 5, Google Nexus 4 Phone

29 Evaluations Environment: office, office-music, home-tv, lecture room, train station, café Laptop: MacBook Pro Mid 2012, Dell E6510 (using Google Chrome) Phone: iphone 5, Google Nexus 4 Phone position: outside, in pocket, in purse User activity: being silent, talking, coughing, whistling 60 Performance Total time: User clicks login > browser refresh to log the user in Recording time: 3 seconds 61 29

Internet/cable providers DC-DP stands for different cities and different Internet/cable providers.

30 Results False Acceptance Rate when the adversary and the victim devices record the same broadcast media. SC-SP stands for same city and same Internet/cable provider, SCDP stands for same city but different Internet/cable providers DC-DP stands for different cities and different Internet/cable providers. A dash in the table means that the TV channel was not available at the victim s location. 62 Discussion 63 30

31 Thank you! Questions? 64 31

epass FIDO -NFC PRODUCT MANUAL

epass FIDO -NFC PRODUCT MANUAL V1.3 2017-03 FEITIAN Technologies Co., Ltd. Website: www.ftsafe.com Overview Feitian epass FIDO -NFC is a FIDO alliance certified U2F authentication key. Unlike the traditional