understanding the role of smart cards for strong ... · password) •off you go ... for example, a...
Post on 10-Aug-2020
0 Views
Preview:
TRANSCRIPT
Understanding the Role of Smart Cards for Strong Authentication in Network Systems
Bryan Ichikawa Deloitte Advisory
• This session will discuss the state of authentication today, identify some of the main vulnerabilities that exist, and introduce options to consider for strengthening authentication. This session will also look at technologies that support multi-factor authentication, talk about FIDO and how this specification brings a change to the world of online authentication, and discuss how smart card technology can be highly effective and how it is already being used in many places today.
Overview
2
• What is authentication? • Vulnerabilities • Strengthening authentication • Identifiers vs. authentication • Multi-factor authentication • FIDO • Smart cards as authenticators • Authentication futures
Agenda
3
In information technology, logical access controls are tools and protocols used for identification, authentication, authorization, and accountability in computer information systems. Electronic authentication (e-authentication) is the process of establishing confidence in user identities electronically presented to an information system.
• I want to define and differentiate between plain old logical access and electronic authentication. Logical access is simply logging into a network, system, or application. E-authentication is YOU logging into a network, system, or application.
• In the physical access world, most systems allow the card to gain access, and allows whatever carbon life form attached to that card to tag along.
• The question is, how do you establish confidence that the carbon life form attached to that access request is the one you think it is?
Authentication – What is it?
4
• More and more transactions in our business and personal lives are being conducted online
• The connected universe is a target rich environment for “bad actors”
• It is the collective responsibility of organizations and individuals alike to protect personal and sensitive data
• Userid/passwords as the primary authentication mechanism is not sufficient
• Many of today’s identifiers provide little or no identity assurance
• Criminal sophistication is increasing at an exponential rate (it is amazing what the devious mind can conjure)
Vulnerabilities – the business drivers
5
A first line of defense is to elevate the security for how we gain access to online resources
• Initial registration / application • (Optional) Identity proofing • Establish an “identity” that the online system can uniquely
recognize (e.g., userid) • Establish a secret that only both parties know (e.g.,
password) • Off you go…. but…
•How do you know you are logging into the right place? •How do they know it is you? •How do you prevent someone else from hijacking your account? •….. ???
How does logical access control work?
6
• Identifiers by themselves simply identify an entity of sorts • There is no identity assurance necessarily associated here
• Authentication is measurable – assurance is the measuring stick
• A level of assurance can be established commensurate with the sensitivity of the information or transaction conducted
Identifiers vs. authentication
7
• In plain English, a token is a secret that comes in a variety of formats. The format of the token has a direct relationship to its strength. For example, a simple password is a very weak token, one that could be easily cracked. A cryptographically protected smart card, on the other hand, is a very strong token.
• The following slides describe the different types of tokens
Tokens – What are they?
8
From NIST Special Publication 800-63-2* Token - Something that the claimant possesses and
controls (typically a cryptographic module or password) that is used to authenticate the claimant’s identity.
* http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-2.pdf
• Tokens contain secrets: • Shared secrets • Public key cryptography
• The classic paradigm for authentication identifies three factors as the fundamentals for authentication: • Something you know • Something you have • Something you are
• But not all factors are secrets. For example: • KBA (something you know) • Biometrics (something you are) • Therefore, not all factors can be considered tokens
What are tokens?
9
• Use of a single factor is referred to as “single factor authentication”
• Combining more than one factor is referred to as “multi-factor authentication”
• But… • Combining multiple single factors (same factor types) is
multiple single factor, NOT multi-factor
Factors
10
• Typically these are User ID / Password combinations • Sometimes only User IDs • Sometimes only PIN/Password • Finger patterns (drawing a “Z” on screen)
Something you know
11
• Hardware Token Device • Phone (smart or not) • PKI Certificates • Smart Cards • Grid Cards
Something you have
12
• OTP – From “One Time Pad”, a cryptographic ciphering technique using pads of paper where the top sheet of keying material was torn off after using it one time
• Today, OTP refers to One Time Password
OTP – One Time Pad (Historic)
13
One Time Pad Example
• Typically hardware (e.g., RSA SecurID or cards) • Token (number) generated on smart phones • Token can be delivered via SMS, email, phone message (IVR)
OTP – One Time Password (today)
14
• User login with User ID / Password (1st factor) • System asks for OTP token • User queries device* and gets token • User enters token into system (2nd factor) • System allows access
OTP protocol as 2nd factor
15
* OTP tokens can be delivered in many ways, including SMS text, emails, voice messages, computer-based applications,
smartphone applications, and hardware devices.
OTP tokens are also called verification codes, security codes, passwords, login codes, multi-factor authentication secrets, etc.
• Biometrics: • Fingerprint • Face • Voice • Iris
• Other biometrics modalities are out there, but the above four are the predominant types in use today
Something you are
16
• Memorized Secret Token (Password) • Pre-registered Knowledge Token (Favorite Color) • Look-up Secret Token (Grid Card) • Out of Band Token (SMS OTP) • Single Factor One-time Password Device (OTP Device) • Single Factor Cryptographic Device (Transport Layer Security
Hardware) • Multi-factor Software Cryptographic Token (Soft Cert) • Multi-factor One-time Password Device (Multi-factor OTP) • Multi-factor Cryptographic Device (Smart Card)
Token types
17
• Memorized Secret Token: • A secret shared between the Subscriber and the CSP. Memorized Secret
Tokens are typically character strings (e.g., passwords and passphrases) or numerical strings (e.g., PINs.) Memorized secret tokens are something you know.
• Pre-registered Knowledge Token: • A series of responses to a set of prompts or challenges. These
responses may be thought of as a set of shared secrets. The set of prompts and responses are established by the Subscriber and CSP during the registration process. Pre-registered Knowledge Tokens are something you know.
• Look-up Secret Token: • A physical or electronic token that stores a set of secrets shared
between the claimant and the CSP. The claimant uses the token to look up the appropriate secret(s) needed to respond to a prompt from the verifier (the token input). For example, a specific subset of the numeric or character strings printed on a card in table format. Look-up secret tokens are something you have.
Token types
18
• Out of Band Token: • A physical token that is uniquely addressable and can receive a verifier-
selected secret for one-time use. The device is possessed and controlled by the claimant and supports private communication over a channel that is separate from the primary channel for e-authentication. Out of Band Tokens are something you have.
• Single Factor One-time Password Device: • A hardware device that supports the spontaneous generation of one-
time passwords. This device has an embedded secret that is used as the seed for generation of one-time passwords and does not require activation through a second factor. Single Factor OTP devices are something you have.
• Single Factor Cryptographic Device: • A hardware device that performs cryptographic operations on input
provided to the device. This device does not require activation through a second factor of authentication. This device uses embedded symmetric or asymmetric cryptographic keys. Single Factor Cryptographic Devices are something you have.
Token types
19
• Multi-factor Software Cryptographic Token: • A cryptographic key is stored on disk or some other “soft” media and
requires activation through a second factor of authentication. The token authenticator is highly dependent on the specific cryptographic protocol, but it is generally some type of signed message. The multi-factor software cryptographic token is something you have (plus something you know/are).
• Multi-factor One-time Password Device: • A hardware device that generates one-time passwords for use in
authentication and which requires activation through a second factor of authentication. The second factor of authentication may be achieved through some kind of integral entry pad, biometric reader or a direct computer interface (e.g., USB port). The multi-factor OTP device is something you have (plus something you know/are).
• Multi-factor Cryptographic Device: • A hardware device that contains a protected cryptographic key that
requires activation through a second authentication factor. The multi-factor Cryptographic device is something you have (plus something you know/are).
Token types
20
• OOBA – Out Of Band Authentication: • The use of two separate networks to perform authentication • Can be OTP, smartphone app that confirms query, biometrics, but
typical OOBA apps do not cross over attributes or artifacts*
• Step-up Authentication:
• System asks for an additional factor when a security threshold has been crossed
Other authentication methods
21
* OOBA – Typically, a user tries to login on a computer and the OOBA app on the smart phone asks the user if the login
attempt is authorized. The user says yes, and the login takes place on the computer. The authentication protocol on the phone does not interact with the computer login attempt.
• Credentials are tokens that are bound to an identity • Identity proofing becomes an integral element of credential
issuance • Credentials are issued and maintained by Credential Service
Providers (CSP) • Credentials are associated with a Level of Assurance (LOA);
therefore all credentials are not created equal!
Credentials and Credential Service Providers (CSP)
22
• Relying parties are those organizations that “consume” credentials.
• Some relying parties issue their own credentials, others simply trust credentials issue by other CSPs.
Relying parties
23
If a relying party wants to trust a credential issued by a CSP other than themselves, how do they know
how trustworthy that credential is?
• Identity Proofing – proving you are who you claim to be
• In-person Proofing: • Present one or two forms of government issued id • Usually has a picture on it, plus relevant personal information (DOB,
address, etc.) • Perform address or telephone verification
• Remote Proofing:
• Submit valid government ID • Submit financial or utility account numbers
Registration and assurance
24
Identity proofing is the activity that binds an identity to a token to create a credential. There are 4 defined levels of assurance.
• NIST Special Publication 800-63-2:
• Electronic Authentication Guideline • Released August 2013 • 800-63-2 supplements OMB guidance, E-Authentication Guidance for
Federal Agencies [OMB M-04-04*]: Specifically, provides guidelines for implementing step 3 of e-
authentication process (next slide)
NIST SP 800-63-2
25
800-63-2 provides technical guidelines to agencies to allow an individual to remotely authenticate their identity to a Federal IT
system. These guidelines address traditional methods for remote authentication based on secrets.
* https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy04/m04-04.pdf
• OMB M-04-04: • Defines 4 levels of assurance (Levels 1 to 4) • Outlines 5-step process:
Conduct a risk assessment of the government system Map identified risks to the appropriate assurance level Select technology based on e-authentication technical guidance Validate that the implemented system has met the required
assurance level Periodically reassess the information system to determine technology
refresh requirements
OMB M-04-04
26
Level 1 Level 2 Level 3 Level 4
Little or no
confidence in
the asserted
identity
Some
confidence in
asserted
identity
High confidence
in the asserted
identity
Very high
confidence in
the asserted
identity
•Self-assertion
•Minimum
records
•Online, instant
qualification
•Out-of-band
follow-up
•Remote proofing
•Online with out-
of-band
verification or
qualification
•Cryptographic
solution
•In-person
proofing
•Recording of a
biometric
•Cryptographic
solution
•Hardware
token
Authentication levels
27
OMB M04-04 Levels of Assurance
• Fast IDentity Online – An alliance whose mission is to change
the nature of online identification.
• UAF and U2F • UAF = Universal Authentication Framework (password-less experience) • U2F = Universal Second Factor (two factor experience)
FIDO Alliance*
28 * https://fidoalliance.org/
• Alibaba Group • ARM • Bank of America • CrucialTec • Discover • Egis Technology • Google • IdentityX • ING • Intel • Lenovo • MasterCard • Microsoft
FIDO Alliance – Board level
29
• Nok Nok Labs • NTT DOCOMO • NXP • Oberthur Technologies • PayPal • Qualcomm • RSA • Samsung • Synaptics • USAA • Visa Inc. • Yubico
• Aetna
• Ally
• Authasas
• Authentify
• BKM
• Blackberry
• CA Technologies
• UK Cabinet Office
• Certivox
• Chase
• Cherry
• Costco
• Crossmatch
• Cypress
• DDS
• Dell
• Duo
• E-Trade
• Early Warning
• Entersekt
• ETRI
• eyeLock
• FacialNetwork
FIDO Alliance – Sponsor level
30
• Feitian
• FingerQ
• Forgerock
• Gemalto
• G&D
• Goldman Sachs
• Goodix
• Happlink
• Hoyos Labs
• IDEX
• Infineon
• Infoguard
• Intercede
• Intuit
• ISR
• KICA
• LG Electronics
• MedImpact
• Safran
• Netflix
• NXTID
• Netflix
• NIST
• NXTID
• nymi
• OSD
• Ping Identity
• Plantronics
• Rambus
• Redsys
• Samsung SDS
• SecureKey
• SecureAuth
• SK Telecom
• Sonavation
• ST
• Tendyron
• Usher
• Vanguard
• Vasco
• Visa
• Watchdata
• Wells Fargo
• WoSign
• Yahoo! Japan
• 126 Additional organizations (as of 9/17/2015) • Specification 1.0 is final and available for UAF and U2F • https://fidoalliance.org
FIDO Alliance – Associate level
31
The business drivers among various industry sectors are very different
• Public sector and critical infrastructure are driven by policy
and standards: • FIPS 201
• Commercial industry is driven by profitability: • And slowly…by security
• The general public is driven by convenience and reward: • And slowly…by increasing concern
• Everyone is slowly being driven by education…
Authentication business drivers
32
• Banking, Payment and Investments
• Many financial businesses now offer multi-factor authentication as an additional security measure
• Email • Most leading email providers support stronger authentication
• Gaming
• The gaming industry is becoming a leader in end-user security
Other industries
Visit www.twofactorauth.org for a comprehensive list of organizations that support stronger levels of
authentication
33
• Mobility: • Today’s smart phones contain a “smart card”
• FIDO: • U2F devices are smart card-based
• Financial: • EMV cards are smart cards
• Transit: • Transit cards are moving to smart card technology
Smart cards playing a role for strong authentication
• The US federal government has defined standards and specifications for electronic authentication
• There is no consistency or standardization outside of the federal government
• Commercial and consumer requirements are much different • Separation of token and identity assurance is a notion that is
not defined by federal standards (this is where FIDO fits) • But…passwords alone are being recognized as insufficient for
the future of online authentication • Smart card technology already exists in many places – use it!
Authentication futures
As more and more transactions are conducted online, federal and even state governments can require the binding of identities to
tokens, but many commercial and consumer enterprises, for the most part, do not require strong identity proofing
35
Bryan Ichikawa Deloitte Advisory bichikawa@deloitte.com
This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business,
financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice
or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking
any action that may affect your business, you should consult a qualified professional advisor.
Deloitte shall not be responsible for any loss sustained by any person who relies on this presentation.
As used in this document, “Deloitte Advisory” means Deloitte & Touche LLP, which provides audit and enterprise risk services; Deloitte
Financial Advisory Services LLP, which provides forensic, dispute, and other consulting services; and its affiliate, Deloitte Transactions
and Business Analytics LLP, which provides a wide range of advisory and analytics services. Deloitte Transactions and Business
Analytics LLP is not a certified public accounting firm. These entities are separate subsidiaries of Deloitte LLP. Please see
www.deloitte.com/us/about for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be
available to attest clients under the rules and regulations of public accounting.
top related