Technology Directions for Client Authentication and Identity

Transcription

1 Technology Directions for Client Authentication and Identity Dr. Michael Condry CTO, Global Ecosystem Development

2 Legal Notices and Disclaimers INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER, AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. INTEL PRODUCTS ARE NOT INTENDED FOR USE IN MEDICAL, LIFE SAVING, OR LIFE SUSTAINING APPLICATIONS. Intel may make changes to specifications and product descriptions at any time, without notice. All products, dates, and figures specified are preliminary based on current expectations, and are subject to change without notice. Intel, processors, chipsets, and desktop boards may contain design defects or errors known as errata, which may cause the product to deviate from published specifications. Current characterized errata are available on request. Intel, Core i7, Core i5, Core i3, Ultrabook, and the Intel logo are trademarks of Intel Corporation in the United States and other countries. * Other names and brands may be claimed as the property of others. Copyright 2013 Intel Corporation.

3 Agenda Establish Concepts Use of user/password today: for authentication, and identity Weakness of passwords in practical usage Example breaking techniques Biometrics offers better potential for identity, stronger methods are then available for authentication Transitioning the Ecosystem Future directions

4 Key Terms Authentication is the act of confirming that a user of an attribute of a datum or entity has the right for this control or access both within or across system and cloud Identity in a system is a process that certifies that a user does represent the expected individual Today there tends to be a converge on client (or endpoint) devices and their access to cloud services into one concept: user id and passwords

5 Client (or Endpoint) Devices Devices utilized directly by the user to access the application, device control, management system, etc. Provides or enables access between cloud and cloud services Desktops Laptops Ultrabook Tablets Smartphones Smart TVs Intelligent Devices

6 Clients Identification and Authentication Today we typically use userid + passwords to identify and authenticate System log-in Online banking Digital and social media sites E-commerce Travel Control Systems Almost everything requires a password! Few people use unique and/or complex passwords 1, remembering them is a real problem

7 The Ease of Password Guessing Studies show that users tend to concoct passwords that are simple and easy to remember; even with password policies users trend to confine themselves to 8- characters based on a simple root 2 Attackers utilize multiple technologies for breaking passwords with an increasing success rate, often over 90% A recent study demonstrated how 17%-24% of passwords have been recovered using dictionary attacks 3 More sophisticated means (e.g., Markov strategies) have greater success rates, knowing the base root one can recover the password within a few trials 4 Many sites allow frequent guessing of passwords and thus can be used to recover the user s root term Thus, these facts with practical usage allows most passwords to be broken even with policy restrictions

8 Why Dictionary Systems Work? 4.7% of users have the password password 8.5% have the passwords password or ; 9.8% have the passwords password, or ; 14% have a password from the top 10 passwords 40% have a password from the top 100 passwords 79% have a password from the top 500 passwords 91% have a password from the top 1000 passwords Source:

9 Example of Password Breaking The trouble is that most of us use a simple password or two over and over again which is a recipe for a security disaster Password reuse may cause an adversary to gain access to higher security online services thru sites that employ less security measures Determining the root term by gleaning some background material on the subject via social engineering simplifies a dictionary attack

10 Case Study: Hack into Account 1. Searching around the internet it was discovered the person had a Gmail account on an old CV posted in his blog 2. Some fishing around allowed selecting a limited number of bank the person used, using their name I clicked the I forgot my password option and was told a password reset link was sent to his account 3. Since Gmail does not employ a limit on the amount of authentication trials I used a commonly available database of frequent user passwords and performed a Dictionary Attack which in a few hours gave me the recovered password 4. Now with access to the user s account I clicked on the password reset link which presented me with a security question 5. Burrowing thru the Department of Motor Vehicles I found an old traffic ticket with the person s birth date on it 6. Voila! I now had access to user s bank account

11 A Second Approach: More Complex but Multiple User Steal the password file from a major vendor (Facebook, Google, Adobe, LinkedIn, IEEE many examples) - a bit tougher Break the encryption on the password file (one has all the time and trials they wish) Test key Check if enough userid s read well, if not repeat with new key Else, test a couple that looks good for correctness, if one works you probably have the key, else repeat with new key Voilà!

12 Towards Alternate Mechanisms of Authentication Biometrics provided an alternative to determine identity of the user. Although accuracy varies by type, facial recognition seems to be trending to the least failure rates, particularly with evolving technologies (3d, iris, motion). Multiple factors can be employed if there with sufficient uncertainty or need for assurance Authentication then can be managed by a subsystem using strong passwords (that the user does not need to remember) or enhanced technologies for cloud (OTP, etc.)

13 Transitioning the Ecosystem Focus on biometrics to determine identity of the user Add multiple factors and/or appropriate re-checks to assure the user identity has not changed Subsystem manages the authentications of the identified user, operating with the Operating System and Cloud Password managers handles existing password requirements with sophisticated and hard-to-break restrictions Evolve to more sophisticated even hardware enhanced security protocols for cloud based services Authentication process can be managed locally or as a cloud service, depending on the application

14 Future Directions Biometrics sound good but so did 6 character passwords (a long time ago) Data shows that user controlled complex passwords will fail Overly onerous methodologies will always be simplified by the end user Advancing technologies requires Non obtrusive user requirements, like biometrics for identity Technology, possibly heuristic, where identity can be managed without obtrusiveness Sophisticated authentication managed locally or in the cloud independently of end user selection, evolving from passwords to stronger methods.

15 Conclusion Text-based passwords have been the predominant mechanism for authenticating users for the past few decades Practically speaking passwords as they are used today do not afford security Attempts at perfecting password policies do not have a veritable impact on changing users practices Biometrics plus smart identity techniques offer the path to Enhanced security Reduction of user frustration Ease of use

16

17 References 1. Password Security: A Case History - Robert Morris and Ken Thompson Bell Laboratories, Guess Again (and Again and Again): Measuring Password Strength by Simulating Password-Cracking Algorithms - Carnegie Mellon University, Password Strength: An Empirical Analysis - Matteo Dell Amico, Pietro Michiardi and Yves Roudier, The science of guessing: analyzing an anonymized corpus of 70 million passwords - University of Cambridge,

18