Security supplement: strong user authentication: solving security's weakest link.

Why strong user authentication (SUA)?

Security isn't complicated, it can be defined very simply as: WHO can be granted access to WHAT. Any security system, whether for a small business or for a large multinational organization, must solve that equation. There is very little doubt about the content or accuracy of the WHAT portion, because this is usually determined by the organisation itself (and thus by the security system in place). The WHO, however, is another matter entirely, and lies at the heart of the effectiveness of any security system. The only means to validate the WHO is through User Authentication. This is why during Logon, the system prompts the User to first get the electronic identity (often called the User ID) of the WHO that will be used during the session, but also tries to verify if the legitimate owner of this identity is really beyond the workstation. This last phase, authentication, is the concern of this article.

The most popular way of performing user authentication is through a static piece of information shared between the user and the security system: the password. There are a few well-known problems associated with these static passwords: Users are often given the opportunity to choose passwords by themselves, thus leading to an easy to guess "secrets." Being static by nature, passwords are reusable, so any network exposure--or mere looking over a user's shoulder--can lead to illegal use of a user's identity. A user may share his/her password with someone else for any good or bad reason, but once shared it cannot be suppressed from the other party's use. Because they are not "user-friendly" and are costly to IT departments in terms of time and effort, strong password management policies are rarely enforced enough to be effective.

Because of these issues, it is widely accepted among security experts that incorrect authentication is the single largest threat to any computer system, and that user-managed passwords are the single largest cause of incorrect authentication. Static passwords are known as an extremely weak form of authentication. This explanation reveals the importance of implementing Strong User Authentication in order to guarantee that only legitimate owners will be able to make use of a User ID. Strong User Authentication naturally strengthens authorization, because access rights will be granted to the right person, and not to someone getting illegal benefit of a weak authentication system Strong User Authentication also eliminates the false sense of security that a sophisticated but password-protected authorization system may provide. Without SUA, how do you really know WHO is accessing your confidential database remotely..?

Authentication factors 

Let's detail how a security system may perform user authentication. The proof of identity that a user will give will be based on one of the following factors: Knowledge: a piece of information shared between the user and the system, typically a PIN or a static password. Ownership: a physical object, like a badge or a key, specifically assigned to the user and that a system peripheral will recognize.

Biometrics: a measurable biological characteristic of the user, previously recorded on the system that the user win present to a specific "biometric" device, such as voice, fingerprint, retina scan, etc.

Each of these three factors taken separately has a unique set of issues and concerns. For example, knowledge is difficult to control, easy to replicate, often easy to guess or to illegally obtain. Users may forget their password, creating help-desk costs. Ownership of the object may be easy to duplicate or can be stolen, and implementation of ownership-based authentication very often leads to static data sent over the network. In addition, maintenance and renewal of the object can be expensive. Biometrics, while seemingly the best authentication method, is very expensive to implement and deploy, and compatibility with existing systems is extremely low. What is more, biometrics creates difficulties with user acceptance: people may not want to present their eye to a scanning device, or put their finger on a reader that is being used by other people

Strong User Authentication methods First, some definitions:

Authentication means verifying that people are who they say they are, before you can trust them with your sensitive data and before they can do harm to that data.

Strong means preventing people from simulating other users identities. In a face-to-face conversation, your speaking partners can see and verify who you are. If they want to strongly identify you they will ask you for your passport or any other positive ID. So, how to obtain truly strong user authentication during verification of an electronic identity.?

You can see that authentication is significantly strengthened by combining at least two of the previously defined authentication factors. This is the system used by banks for their e-wallet smart card or ATM bank card system. By combining a PIN that must be remembered with a card that the authorized user has in his or her possession, the barrier to unauthorized access is much higher, while ease of use is maintained. For remote access security to a corporate network or Internet banking application, for example, token devices or smart cards combine the two factors of Knowledge and Ownership. A user must own a unique token or smart card, and this "intelligent" object requires the knowledge of a PIN to be activated. In addition, these objects contain cryptographic processors that will perform complex functions while communicating with the security system. These functions ensure that an authentication exchange cannot be reused or replayed on the same or another system. Digital Certificates, as used in a PKI-based authentication systems, are logical objects that will bring to the security system the proof that a Certificate Authority has already authenticated the user. The strength of PKI-based authentication relies essentially on the quality and safety of Certificate storage and protection.

CHART: Comparison of common SUA methods:

Comments:

Tokens are the most portable solution for strong user authentication. They work unconnected and may be used across any media. Smart cards have a quite good portability for the smart card itself, but they are limited by the need for a smart card reader and client software residing on a PC. PKI offers poor portability for pure software implementations. It's improved when the certificate is hosted in a removable device like a smart card, but then you get the other limitations associated with smart cards. PKI also requires the use of applications that have been programmed for PKI, while the two others may be used as a replacement of static passwords.

The cost of ownership for tokens depends mostly on hardware reliability, purchase options, and PIN management features. These factors vary dramatically from one manufacturer to another. Smart cards suffer from the cost of smart card readers, and their relative fragility when used intensively for login. PKI costs vary depending on the type of certificates used: using a company's own CA to build certificates has no comparison to buying certificates from a public CA.

Manageability and deployment are the biggest weaknesses of PKI authentication, because it requires the use of PKI infrastructure management software, and PKI enabled applications.

How authentication methods are evolving/converging

A real challenge for any authentication method is user acceptance. This is the key to a successful security implementation because if the authentication method creates too many constraints, or prevent users from working because of a lack of reliability, then it will be rejected. Legitimate users know who they are, and consider that this supposedly "intelligent" workstation should be secure by itself and be smart enough to distinguish hackers from regular users.

The best authentication method should make use of a property that a user considers as an extension of him/herself and would never share or give away. This is what biometries try to achieve, but other methods can provide similar success without the limitations of biometrics.

For instance, VASCO has found that having tokens personalized with user-chosen colors or logos reinforces the feeling of ownership a user may have compared to using a standard neutral model. And by offering users to choose their own PIN that no one else knows, as well as changing it whenever they like, gives users the feeling that the token is theirs and not the same as any other. This also helps to prevent the PIN from being written down, since users are free to use their own general PIN, which people protect much more strongly than passwords.

Another path to explore to gain user acceptance is to adapt the SUA method to the user's environment. Users are now equipped with mobile phones or PDAS, and it's obvious that these intelligent devices are perfect targets to include strong user authentication capabilities.

Some applications of SUA Strong user authentication usage is recommended with any remote access, since users cannot be physically controlled before accessing an information system. Another is any use of a public network, like the Interact, or when open ports exist like with dialup connections. Online banking is one of the most demanding applications for strong authentication, but new and emerging activities like online auction, or online gambling now move to this technology.

Even for internal corporate use, strong authentication is often used to protect usage of "power" accounts, like security officers, decision makers, or systems programmers.

Conclusion

In fact, as soon as an authorisation system exists and an organisation has spent substantial time and money to implement user-based policies, entitlements or delegation, then this organisation should consider using strong user authentication. If not, the risk of improper use of a user' s identity, thus of this user's rights, is very important and would make the entire system useless.

Criteria                Tokens      Smart Cards       PKI
Authority

Portability              high          medium         low
Cost of ownership     low to high       high       low to high

Manageability           medium         medium         low
Scalability             medium          low          mdium

Ease of use and
deployment               high          medium         low

Mr Daniel Mouly is VASCO's Chief Technology Officer.