2 AccessControl

Part II: Access Control
Part 2  Access Control 1

Access Control
 Two parts to access control
 Authentication: Are you who you say you are?
o Determine whether access is allowed
o Authenticate human to machine
o Or authenticate machine to machine
 Authorization: Are you allowed to do that?
o Once you have access, what can you do?
o Enforces limits on actions
 Note: “access control” often used as synonym
for authorization
Chapter 7: Authentication
Guard: Halt! Who goes there?
Arthur: It is I, Arthur, son of Uther Pendragon,
from the castle of Camelot. King of the Britons,
defeater of the Saxons, sovereign of all England!
 Monty Python and the Holy Grail
Then said they unto him, Say now Shibboleth:

and he said Sibboleth: for he could not frame to pronounce it right.
Then they took him, and slew him at the passages of Jordan:
and there fell at that time of the Ephraimites forty and two thousand.
 Judges 12:6

Are You Who You Say You Are?
 How to authenticate human to a machine?
 Can be based on…
o Something you know
 For example, a password
o Something you have
 For example, a smartcard
o Something you are
 For example, your fingerprint

Something You Know
 Passwords
 Lots of things act as passwords!
o PIN
o Social security number
o Mother’s maiden name
o Date of birth
o Name of your pet, etc.

Trouble with Passwords
 “Passwords are one of the biggest practical
problems facing security engineers today.”
 “Humans are incapable of securely storing
high-quality cryptographic keys, and they
have unacceptable speed and accuracy when
performing cryptographic operations. (They
are also large, expensive to maintain, difficult
to manage, and they pollute the environment.
It is astonishing that these devices continue
to be manufactured and deployed.)”
Why Passwords?
 Why is “something you know” more
popular than “something you have” and
“something you are”?
 Cost: passwords are free
 Convenience: easier for admin to
reset pwd than to issue a new thumb

Keys vs Passwords
 Crypto keys  Passwords
 Spse key is 64  Spse passwords

bits are 8 characters,
and 256 different
 Then 264 keys
characters
 Choose key at  Then 2568 = 264
random… pwds
 …then attacker  Users do not
must try about 263 select passwords
keys
Part 2  Access Control at random 8
Good and Bad Passwords
 Bad passwords  Good Passwords?
o frank o jfIej,43j-EmmL+y
o Fido o 09864376537263
o password o P0kem0N
o 4444 o FSa7Yago
o Pikachu o 0nceuP0nAt1m8
o 102560
o PokeGCTall150
o AustinStamp

Password Experiment
 Three groups of users  each group
advised to select passwords as follows
o Group A: At least 6 chars, 1 non-letter
winner o Group B: Password based on passphrase
o Group C: 8 random characters
 Results
o Group A: About 30% of pwds easy to crack
o Group B: About 10% cracked
 Passwords easy to remember
o Group C: About 10% cracked
 Passwords hard to remember

Password Experiment
 User compliance hard to achieve
 In each case, 1/3rd did not comply
o And about 1/3rd of those easy to crack!
 Assigned passwords sometimes best
 If passwords not assigned, best advice is…
o Choose passwords based on passphrase
o Use pwd cracking tool to test for weak pwds
 Require periodic password changes?

Attacks on Passwords
 Attacker could…
o Target one particular account
o Target any account on system
o Target any account on any system
o Attempt denial of service (DoS) attack
 Common attack path
o Outsider  normal user  administrator
o May only require one weak password!

Password Retry
 Suppose system locks after 3 bad
passwords. How long should it lock?
o 5 seconds
o 5 minutes
o Until SA restores service
 What are +’s and -’s of each?

Password File?
 Bad idea to store passwords in a file
 But we need to verify passwords
 Cryptographic solution: hash the pwd
o Store y = h(password)
o Can verify entered password by hashing
o If Trudy obtains “password file,” she
does not obtain passwords
 But Trudy can try a forward search
o Guess x and check whether y = h(x)

Dictionary Attack
 Trudy pre-computes h(x) for all x in a
dictionary of common passwords
 Suppose Trudy gets access to password
file containing hashed passwords
o She only needs to compare hashes to her pre-
computed dictionary
o After one-time work, actual attack is trivial
 Can we prevent this attack? Or at least
make attacker’s job more difficult?

Salt
 Hash password with salt
 Choose random salt s and compute
y = h(password, s)
and store (s,y) in the password file
 Note: The salt s is not secret
 Easy to verify salted password
 But Trudy must re-compute dictionary
hashes for each user
o Lots more work for Trudy!

Password Cracking:
Do the Math
 Assumptions:
 Pwds are 8 chars, 128 choices per character
o Then 1288 = 256 possible passwords
 There is a password file with 210 pwds
 Attacker has dictionary of 220 common pwds
 Probability of 1/4 that a pwd is in dictionary
 Work is measured by number of hashes

Password Cracking: Case I
 Attack 1 password without dictionary
o Must try 256/2 = 255 on average
o Like exhaustive key search
 Does salt help in this case?

Password Cracking: Case II
 Attack 1 password with dictionary
 With salt
o Expected work: 1/4 (219) + 3/4 (255) = 254.6
o In practice, try all pwds in dictionary…
o …then work is at most 220 and probability of
success is 1/4
 What if no salt is used?
o One-time work to compute dictionary: 220
o Expected work still same order as above
o But with precomputed dictionary hashes, the
“in practice” attack is free…
Password Cracking: Case III
 Any of 1024 pwds in file, without dictionary
o Assume all 210 passwords are distinct
o Need 255 comparison rounds before expect to find pwd
 If no salt is used
o Each computed hash yields 210 comparisons
o So expected work (hashes) is 255/210 = 245
 i.e., 1 hash can be compared against all 1024 pwds
 If salt is used
o Expected work is 255
 i.e., 1 hash can be compared against only 1 pwd
o Each comparison requires a hash computation

Password Cracking: Case IV
 Any of 1024 pwds in file, with dictionary
o Prob. one or more pwd in dict.: 1 – (3/4)1024 = 1
o So, we ignore case where no pwd is in dictionary
 If salt is used, expected work less than 222
o See book, or slide notes for details
o Approximate work = (size of dict./probability of success)
ÞTo make it harder on Trudy
1. Increase size of dict.
2. Decrease probability
 What if no salt is used?

o If dictionary hashes not precomputed, work  219/210 = 29

Other Password Issues
 Too many passwords to remember
o Results in password reuse
o Why is this a problem?
 Who suffers from bad password?
o Login password vs ATM PIN
 Failure to change default passwords
 Social engineering
 Error logs may contain “almost” passwords
 Bugs, keystroke logging, spyware, etc.

Passwords
 The bottom line…
 Password cracking is too easy
o One weak password may break security
o Users choose bad passwords
o Social engineering attacks, etc.
 Trudy has (almost) all of the advantages
 All of the math favors bad guys
 Passwords are a BIG security problem
o And will continue to be a big problem

Password Cracking Tools
 Popular password cracking tools
o Password Crackers
o Password Portal
o L0phtCrack and LC4 (Windows)
o John the Ripper (Unix)
 Admins should use these tools to test for
weak passwords since attackers will
 Good articles on password cracking
o Passwords - Conerstone of Computer Security
o Passwords revealed by sweet deal
Biometrics

Something You Are
 Biometric
o “You are your key”  Schneier
 Examples
o Fingerprint
o Handwritten signature Are
o Facial recognition Know Have
o Speech recognition
o Gait (walking) recognition
o “Digital doggie” (odor recognition)
o Many more!

Why Biometrics?
 More secure replacement for passwords
 Cheap and reliable biometrics needed
o Today, an active area of research
 Biometrics are used in security today
o Thumbprint mouse
o Palm print for secure entry
o Fingerprint to unlock car door, etc.
 But biometrics not too popular
o Has not lived up to its promise (yet?)

Ideal Biometric
 Universal  applies to (almost) everyone
o In reality, no biometric applies to everyone
 Distinguishing  distinguish with certainty
o In reality, cannot hope for 100% certainty
 Permanent  physical characteristic being
measured never changes
o In reality, OK if it to remains valid for long time
 Collectable  easy to collect required data
o Depends on whether subjects are cooperative
 Also, safe, user-friendly, etc., etc.
Biometric Modes
 Identification  Who goes there?
o Compare one-to-many
o Example: The FBI fingerprint database
 Authentication  Are you who you say you are?
o Compare one-to-one
o Example: Thumbprint mouse
 Identification problem is more difficult
o More “random” matches since more comparisons
 We are interested in authentication
Enrollment vs Recognition
 Enrollment phase
o Subject’s biometric info put into database
o Must carefully measure the required info
o OK if slow and repeated measurement needed
o Must be very precise
o May be weak point of many biometric
 Recognition phase
o Biometric detection, when used in practice
o Must be quick and simple
o But must be reasonably accurate

Cooperative Subjects?
 Authentication — cooperative subjects
 Identification — uncooperative subjects
 For example, facial recognition
o Used in Las Vegas casinos to detect known
cheaters (terrorists in airports, etc.)
o Often do not have ideal enrollment conditions
o Subject will try to confuse recognition phase
 Cooperative subject makes it much easier
o We are focused on authentication
o So, subjects are generally cooperative

Biometric Errors
 Fraud rate versus insult rate
o Fraud  Trudy mis-authenticated as Alice
o Insult  Alice not authenticated as Alice
 For any biometric, can decrease fraud or
insult, but other one will increase
 For example
o 99% voiceprint match  low fraud, high insult
o 30% voiceprint match  high fraud, low insult
 Equal error rate: rate where fraud == insult
o A way to compare different biometrics

Fingerprint History
 1823  Professor Johannes Evangelist
Purkinje discussed 9 fingerprint patterns
 1856  Sir William Hershel used
fingerprint (in India) on contracts
 1880  Dr. Henry Faulds article in Nature
about fingerprints for ID
 1883  Mark Twain’s Life on the
Mississippi (murderer ID’ed by fingerprint)

Fingerprint History
 1888  Sir Francis Galton developed
classification system
o His system of “minutia” still used today
o Also verified that fingerprints do not change
 Some countries require fixed number of
“points” (minutia) to match in criminal cases
o In Britain, at least 15 points
o In US, no fixed number of points

Fingerprint Comparison
 Examples of loops, whorls, and arches
 Minutia extracted from these features
Loop (double) Whorl Arch

Fingerprint: Enrollment
 Capture image of fingerprint

 Enhance image
 Identify points

Fingerprint: Recognition
 Extracted points are compared with

information stored in a database
 Is it a statistical match?
 Aside: Do identical twins’ fingerprints differ?

Hand Geometry
 A popular biometric
 Measures shape of hand
o Width of hand, fingers
o Length of fingers, etc.
 Human hands not unique
 Hand geometry sufficient
for many situations
 OK for authentication
 Not useful for ID problem

Hand Geometry
 Advantages
o Quick  1 minute for enrollment, 5
seconds for recognition
o Hands are symmetric  so what?
 Disadvantages
o Cannot use on very young or very old
o Relatively high equal error rate

Iris Patterns
 Iris pattern development is “chaotic”

 Little or no genetic influence
 Different even for identical twins
 Pattern is stable through lifetime

Iris Recognition: History
 1936  suggested by Frank Burch
 1980s  James Bond films
 1986  first patent appeared
 1994  John Daugman patented best
current approach
o Patent owned by Iridian Technologies

Iris Scan
 Scanner locates iris
 Take b/w photo
 Use polar coordinates…
 2-D wavelet transform
 Get 256 byte iris code

Measuring Iris Similarity
 Based on Hamming distance
 Define d(x,y) to be
o # of non match bits / # of bits compared
o d(0010,0101) = 3/4 and d(101111,101001) = 1/3
 Compute d(x,y) on 2048-bit iris code
o Perfect match is d(x,y) = 0
o For same iris, expected distance is 0.08
o At random, expect distance of 0.50
o Accept iris scan as match if distance < 0.32

Iris Scan Error Rate
distance Fraud rate
0.29 1 in 1.31010
0.30 1 in 1.5109
0.31 1 in 1.8108
0.32 1 in 2.6107
0.33 1 in 4.0106
0.34 1 in 6.9105
0.35 1 in 1.3105
== equal error rate
Part 2  Access Control distance 44
Attack on Iris Scan
 Good photo of eye can be scanned
o Attacker could use photo of eye
 Afghan woman was authenticated by
iris scan of old photo
o Story is here
 To prevent attack, scanner could use
light to be sure it is a “live” iris

Equal Error Rate Comparison
 Equal error rate (EER): fraud == insult rate
 Fingerprint biometric has EER of about 210-3
 Hand geometry has EER of about 210-3
 In theory, iris scan has EER of about 7.6 10-6
o But in practice, may be hard to achieve
o Enrollment phase must be extremely accurate
 Most biometrics much worse than fingerprint!
 Biometrics useful for authentication…
o …but identification biometrics almost useless today

Biometrics: The Bottom Line
 Biometrics are hard to forge
 But attacker could
o Steal Alice’s thumb
o Photocopy Bob’s fingerprint, eye, etc.
o Subvert software, database, “trusted path” …
 And how to revoke a “broken” biometric?
 Biometrics are not foolproof
 Biometric use is limited today
 That should change in the (near?) future

Something You Have
 Something in your possession
 Examples include following…
o Car key
o Laptop computer (or MAC address)
o Password generator (next)
o ATM card, smartcard, etc.

Password Generator
1. “I’m Alice”
3. PIN, R
2. R
4. h(K,R)
password
generator 5. h(K,R)
K Alice Bob, K
 Alice receives random “challenge” R from Bob
 Alice enters PIN and R in password generator
 Password generator hashes symmetric key K with R
 Alice sends “response” h(K,R) back to Bob
 Bob verifies response
 Note: Alice has pwd generator and knows PIN
2-factor Authentication
 Requires any 2 out of 3 of
o Something you know
o Something you have
o Something you are
 Examples
o ATM: Card and PIN
o Credit card: Card and signature
o Password generator: Device and PIN
o Smartcard with password/PIN

Single Sign-on
 A hassle to enter password(s) repeatedly
o Alice wants to authenticate only once
o “Credentials” stay with Alice wherever she goes
o Subsequent authentications transparent to Alice
 Kerberos --- example single sign-on protocol
 Single sign-on for the Internet?
o Microsoft: Passport
o Everybody else: Liberty Alliance
 Based on Security Assertion Markup Language (SAML)

Web Cookies
 Cookie is provided by a Website and stored
on user’s machine
 Cookie indexes a database at Website
 Cookies maintain state across sessions
o Web uses a stateless protocol: HTTP
o Cookies also maintain state within a session
 Sorta like a single sign-on for a website
o But, a very, very weak form of authentication
 Cookies also create privacy concerns
Authorization

Chapter 8: Authorization
It is easier to exclude harmful passions than to rule them,
and to deny them admittance
than to control them after they have been admitted.
 Seneca
You can always trust the information given to you

by people who are crazy;
they have an access to truth not available through regular channels.
 Sheila Ballantyne

Authentication vs
Authorization
 Authentication  Are you who you say you are?
o Restrictions on who (or what) can access system
 Authorization  Are you allowed to do that?
o Restrictions on actions of authenticated users
 Authorization is a form of access control
 Classic authorization enforced by
o Access Control Lists (ACLs)
o Capabilities (C-lists)

Lampson’s Access Control Matrix
 Subjects (users) index the rows
 Objects (resources) index the columns
Accounting Accounting Insurance Payroll
OS program data data data
Bob rx rx r --- ---
Alice rx rx r rw rw
Sam rwx rwx r rw rw

Accounting
program rx rx rw rw rw
Are You Allowed to Do That?
 Access control matrix has all relevant info
 Could be 1000’s of users, 1000’s of resources
 Then matrix with 1,000,000’s of entries
 How to manage such a large matrix?
 Need to check this matrix before access to
any resource is allowed
 How to make this efficient?

Access Control Lists (ACLs)
 ACL: store access control matrix by column
 Example: ACL for insurance data is in blue

Bob rx rx r --- ---
Alice rx rx r rw rw
Sam rwx rwx r rw rw

Accounting
Capabilities (or C-Lists)
 Store access control matrix by row
 Example: Capability for Alice is in red

Bob rx rx r --- ---
Alice rx rx r rw rw
Sam rwx rwx r rw rw

Accounting
ACLs vs Capabilities
 ACLs
o Good when users manage their own files
o Protection is data-oriented
o Easy to change rights to a resource
 Capabilities
o Easy to delegate---avoids the confused deputy problem
o Easy to add/delete users
o More difficult to implement

Multilevel Security (MLS)
Models

Classifications and Clearances
 Classificationsapply to objects
 Clearances apply to subjects
 US Department of Defense (DoD)
uses 4 levels:
TOP SECRET
SECRET
CONFIDENTIAL
UNCLASSIFIED

Multilevel Security (MLS)
 MLS needed when subjects/objects at
different levels use/on same system
 MLS is a form of Access Control
 MLS Applications
o Classified government/military systems
o Business example: info restricted to Senior
management only, all management, everyone in
company, or general public
o Network firewall
o Confidential medical info, databases, etc.
Compartments

Compartments
 Multilevel Security (MLS) enforces access
control up and down
 Simple hierarchy of security labels is
generally not flexible enough
 Compartments enforces restrictions across
 Suppose TOP SECRET divided into TOP
SECRET {CAT} and TOP SECRET {DOG}
 Both are TOP SECRET but information flow
restricted across the TOP SECRET level
Compartments
 Why compartments?
o Why not create a new classification level?
 May not want either of
o TOP SECRET {CAT}  TOP SECRET {DOG}
o TOP SECRET {DOG}  TOP SECRET {CAT}
 Compartments designed to enforce the need
to know principle
o Regardless of clearance, you only have access to
info that you need to know to do your job

Compartments
 Arrows indicate “” relationship
TOP SECRET {CAT, DOG}
TOP SECRET {CAT} TOP SECRET {DOG}
TOP SECRET
SECRET {CAT, DOG}
SECRET {CAT} SECRET {DOG}
SECRET
 Not all classifications are comparable, e.g.,
TOP SECRET {CAT} vs SECRET {CAT, DOG}
MLS vs Compartments
 MLS can be used without compartments
o And vice-versa
 But, MLS almost always uses compartments
 Example
o MLS mandated for protecting medical records of
British Medical Association (BMA)
o AIDS was TOP SECRET, prescriptions SECRET
o What is the classification of an AIDS drug?
o Everything tends toward TOP SECRET
o Defeats the purpose of the system!
 Compartments-only approach used instead
Covert Channel

Covert Channel
 MLS designed to restrict legitimate
channels of communication
 May be other ways for information to flow
 For example, resources shared at
different levels could be used to “signal”
information
 Covert channel: a communication path not
intended as such by system’s designers

Covert Channel Example
 Alice has TOP SECRET clearance, Bob has
CONFIDENTIAL clearance
 Suppose the file space shared by all users
 Alice creates file FileXYzW to signal “1” to
Bob, and removes file to signal “0”
 Once per minute Bob lists the files
o If file FileXYzW does not exist, Alice sent 0
o If file FileXYzW exists, Alice sent 1
 Alice can leak TOP SECRET info to Bob!
Alice: Create file Delete file Create file Delete file
Bob: Check file Check file Check file Check file Check file
Data: 1 0 1 1 0
Time:

Covert Channel
 Other possible covert channels?
o Print queue
o ACK messages
o Network traffic, etc.
 When does covert channel exist?
1. Sender and receiver have a shared resource
2. Sender able to vary some property of resource
that receiver can observe
3. “Communication” between sender and receiver
can be synchronized
Covert Channel
 So, covert channels are everywhere
 “Easy” to eliminate covert channels:
o Eliminate all shared resources…
o …and all communication
 Virtually impossible to eliminate covert
channels in any useful system
o DoD guidelines: reduce covert channel capacity
to no more than 1 bit/second
o Implication? DoD has given up on eliminating
covert channels!

 Consider 100MB TOP SECRET file
o Plaintext stored in TOP SECRET location
o Ciphertext (encrypted with AES using 256-bit
key) stored in UNCLASSIFIED location
 Suppose we reduce covert channel capacity
to 1 bit per second
 It would take more than 25 years to leak
entire document thru a covert channel
 But it would take less than 5 minutes to
leak 256-bit AES key thru covert channel!
Real-World Covert Channel
 Hide data in TCP header “reserved” field

 Or use covert_TCP, tool to hide data in
o Sequence number
o ACK number

Real-World Covert Channel
 Hide data in TCP sequence numbers
 Tool: covert_TCP
 Sequence number X contains covert info
ACK (or RST)

SYN Source: B
Spoofed source: C Destination: C
Destination: B ACK: X
SEQ: X B. Innocent
server
A. Covert_TCP C. Covert_TCP
sender receiver
Inference Control

Inference Control Example
 Suppose we query a database
o Question: What is average salary of female CS
professors at SJSU?
o Answer: $95,000
o Question: How many female CS professors at
SJSU?
o Answer: 1
 Specific information has leaked from
responses to general questions!

Inference Control and
Research
 For example, medical records are
private but valuable for research
 How to make info available for
research and protect privacy?
 How to allow access to such data
without leaking specific information?

Naïve Inference Control
 Remove names from medical records?
 Stillmay be easy to get specific info
from such “anonymous” data
 Removing names is not enough
o As seen in previous example
 What more can be done?

Less-naïve Inference
Control
 Query set size control
o Don’t return an answer if set size is too small
 N-respondent, k% dominance rule
o Do not release statistic if k% or more
contributed by N or fewer
o Example: Avg salary in Bill Gates’ neighborhood
o This approach used by US Census Bureau
 Randomization
o Add small amount of random noise to data
 Many other methods  none satisfactory
Inference Control
 Robust inference control may be impossible
 Is weak inference control better than nothing?
o Yes: Reduces amount of information that leaks
 Is weak covert channel protection better than
nothing?
o Yes: Reduces amount of information that leaks
 Is weak crypto better than no crypto?
o Probably not: Encryption indicates important data
o May be easier to filter encrypted data

CAPTCHA

Turing Test
 Proposed by Alan Turing in 1950
 Human asks questions to another human
and a computer, without seeing either
 If questioner cannot distinguish human
from computer, computer passes the test
 The gold standard in artificial intelligence
 No computer can pass this today
o But some claim to be close to passing

CAPTCHA
 CAPTCHA
o Completely Automated Public Turing test to tell
Computers and Humans Apart
 Automated  test is generated and scored
by a computer program
 Public  program and data are public
 Turing test to tell…  humans can pass the
test, but machines cannot pass
o Also known as HIP == Human Interactive Proof
 Like an inverse Turing test (well, sort of…)
CAPTCHA Paradox?
 “…CAPTCHA is a program that can generate
and grade tests that it itself cannot pass…”
o “…much like some professors…”
 Paradox  computer creates and scores
test that it cannot pass!
 CAPTCHA used so that only humans can get
access (i.e., no bots/computers)
 CAPTCHA is for access control

CAPTCHA Uses?
 Original motivation: automated bots stuffed
ballot box in vote for best CS grad school
o MIT vs Carnegie-Mellon
 Free email services  spammers like to use
bots to sign up for 1000’s of email accounts
o CAPTCHA employed so only humans get accounts
 Sites that do not want to be automatically
indexed by search engines
o CAPTCHA would force human intervention

CAPTCHA: Rules of the Game
 Easy for most humans to pass
 Difficult or impossible for machines to pass
o Even with access to CAPTCHA software
 From Trudy’s perspective, the only unknown
is a random number
o Analogous to Kerckhoffs’ Principle
 Desirable to have different CAPTCHAs in
case some person cannot pass one type
o Blind person could not pass visual test, etc.

Do CAPTCHAs Exist?
 Test: Find 2 words in the following
 Easy for most humans

 A (difficult?) OCR problem for computer
o OCR == Optical Character Recognition
CAPTCHAs
 Current types of CAPTCHAs
o Visual  like previous example
o Audio  distorted words or music
 No text-based CAPTCHAs
o Maybe this is impossible…

CAPTCHA’s and AI
 OCR is a challenging AI problem
o Hard part is the segmentation problem
o Humans good at solving this problem
 Distorted sound makes good CAPTCHA
o Humans also good at solving this
 Hackers who break CAPTCHA have solved a
hard AI problem
o So, putting hacker’s effort to good use!
o Google accidentally cracks CAPTCHA verification w
ith Maps algorithm
Firewalls

Firewalls
Internal
Internet Firewall network
 Firewall decides what to let in to internal

network and/or what to let out
 Access control for the network

Firewall as Secretary
 A firewall is like a secretary
 To meet with an executive
o First contact the secretary
o Secretary decides if meeting is important
o So, secretary filters out many requests
 You want to meet chair of CS department?
o Secretary does some filtering
 You want to meet the POTUS?
o Secretary does lots of filtering

Firewall Terminology
 No standard firewall terminology
 Types of firewalls
o Packet filter  works at network layer
o Stateful packet filter  transport layer
o Application proxy  application layer
 Other terms often used
o E.g., “deep packet inspection”

Packet Filter
 Operates at network layer
application
 Can filter based on…
o Source IP address transport
o Destination IP address
o network
Source Port
o Destination Port link
o Flag bits (SYN, ACK, etc.)
o Egress or ingress physical

Packet Filter
 Advantages? application
o Speed
transport
 Disadvantages?
o No concept of state network
o Cannot see TCP connections link
o Blind to application data
physical

Packet Filter
 Configured via Access Control Lists (ACLs)
o Different meaning than at start of Chapter 8
Source Dest Source Dest Flag
Action IP IP Port Port Protocol Bits
Allow Inside Outside Any 80 HTTP Any
Allow Outside Inside 80 > 1023 HTTP ACK
Deny All All All All All All
 Q: Intention?
 A: Restrict traffic to only Web browsing

TCP ACK Scan
 Attacker scans for open ports thru firewall
o Port scanning is first step in many attacks
 Attacker sends packet with ACK bit set,
without prior 3-way handshake
o Violates TCP/IP protocol
o ACK packet pass thru packet filter firewall
o Appears to be part of an ongoing connection
o RST sent by recipient of such packet

TCP ACK Scan
ACK dest port 1207
ACK dest port 1208
ACK dest port 1209
Trudy RST Internal

Packet
Network
Filter
 Attacker knows port 1209 open thru firewall
 A stateful packet filter can prevent this
o Since scans not part of established connections
Stateful Packet Filter
 Adds state to packet filter application
 Operates at transport layer transport
 Remembers TCP connections,
network
flag bits, etc.
 Can link
even remember UDP
packets (e.g., DNS requests) physical

Stateful Packet Filter
 Advantages? application
o Can do everything a packet filter
can do plus... transport
o Keep track of ongoing connections
network
(i.e., prevents TCP ACK scan)
 Disadvantages? link
o Cannot see application data
physical
o Slower than packet filtering

Application Proxy
 A proxy is something that
application
acts on your behalf
 Application proxy looks at transport
incoming application data network

 Verifies that data is safe link
before letting it in
physical

Application Proxy
 Advantages?
application
o Complete view of connections
and applications data transport
o Filter bad data at application
layer (viruses, Word macros) network
 Disadvantages? link
o Speed
physical

Application Proxy
 Creates a new packet before sending it
thru to internal network
 Attacker must talk to proxy and convince
it to forward message
 Proxy has complete view of connection
 Prevents some scans stateful packet filter
cannot  next slides

Firewalk
 Tool to scan for open ports thru firewall
 Attacker knows IP address of firewall and
IP address of one system inside firewall
o Set TTL to 1 more than number of hops to
firewall, and set destination port to N
 If firewall allows data on port N thru
firewall, get time exceeded error message
o Otherwise, no response

Firewalk and Proxy Firewall
Packet
filter
Trudy Router Router Router
Dest port 12343, TTL=4

Time exceeded
 This will not work thru an application proxy (why?)

 The proxy creates a new packet, destroys old TTL

Deep Packet Inspection
 Many buzzwords used for firewalls
o One example: deep packet inspection
 What could this mean?
 Look into packets, but don’t really
“process” the packets
o Like an application proxy, but faster

Firewalls and Defense in Depth
 Typical network security architecture
DMZ
FTP server
Web server
DNS server
Intranet with
Packet Application additional
Internet Filter Proxy defense

Intrusion Detection Systems

Intrusion Prevention
 Want to keep bad guys out
 Intrusion prevention is a traditional
focus of computer security
o Authentication is to prevent intrusions
o Firewalls a form of intrusion prevention
o Virus defenses aimed at intrusion
prevention
o Like locking the door on your car

Intrusion Detection
 In spite of intrusion prevention, bad guys
will sometime get in
 Intrusion detection systems (IDS)
o Detect attacks in progress (or soon after)
o Look for unusual or suspicious activity
 IDS evolved from log file analysis
 IDS is still a hot research topic
 How to respond when intrusion detected?
o We don’t deal with this topic here…

Intrusion Detection Systems
 Who is likely intruder?
o May be outsider who got thru firewall
o May be evil insider
 What do intruders do?
o Launch well-known attacks
o Launch variations on well-known attacks
o Launch new/little-known attacks
o “Borrow” system resources
o Use compromised system to attack others. etc.

IDS
 Intrusion detection approaches
o Signature-based IDS
o Anomaly-based IDS
 Intrusion detection architectures
o Host-based IDS
o Network-based IDS
 Any IDS can be classified as above
o In spite of marketing claims to the contrary!

Host-Based IDS
 Monitor activities on hosts for
o Known attacks
o Suspicious behavior
 Designed to detect attacks such as
o Buffer overflow
o Escalation of privilege, …
 Little or no view of network activities

Network-Based IDS
 Monitor activity on the network for…
o Known attacks
o Suspicious network activity
 Designed to detect attacks such as
o Denial of service
o Network probes
o Malformed packets, etc.
 Some overlap with firewall
 Little or no view of host-base attacks
 Can have both host and network IDS

Signature Detection
 Advantages of signature detection
o Simple
o Detect known attacks
o Know which attack at time of detection
o Efficient (if reasonable number of signatures)
 Disadvantages of signature detection
o Signature files must be kept up to date
o Number of signatures may become large
o Can only detect known attacks
o Variation on known attack may not be detected

Anomaly Detection
 Anomaly detection systems look for unusual
or abnormal behavior
 There are (at least) two challenges
o What is normal for this system?
o How “far” from normal is abnormal?
 No avoiding statistics here!
o mean defines normal
o variance gives distance from normal to abnormal

Anomaly Detection Issues
 Systems constantly evolve and so must IDS
o Static system would place huge burden on admin
o But evolving IDS makes it possible for attacker to
(slowly) convince IDS that an attack is normal
o Attacker may win simply by “going slow”
 What does “abnormal” really mean?
o Indicates there may be an attack
o Might not be any specific info about “attack”
o How to respond to such vague information?
o In contrast, signature detection is very specific

Anomaly Detection
 Advantages?
o Chance of detecting unknown attacks
 Disadvantages?
o Cannot use anomaly detection alone…
o …must be used with signature detection
o Reliability is unclear
o May be subject to attack
o Anomaly detection indicates “something unusual”,
but lacks specific info on possible attack

Anomaly Detection: The
Bottom Line
 Anomaly-based IDS is active research topic
 Many security experts have high hopes for its
ultimate success
 Often cited as key future security technology
 Hackers are not convinced!
o Title of a talk at Defcon: “Why Anomaly-based
IDS is an Attacker’s Best Friend”
 Anomaly detection is difficult and tricky
 As hard as AI?

Access Control Summary
 Authentication and authorization
o Authentication  who goes there?
 Passwords  something you know
 Biometrics  something you are (you
are your key)
 Something you have

Access Control Summary
 Authorization  are you allowed to do that?
o Access control matrix/ACLs/Capabilities
o MLS/Multilateral security
o Covert channel
o Inference control
o CAPTCHA
o Firewalls
o IDS

Coming Attractions…
 Security protocols
o Generic authentication protocols
o SSH
o SSL
o IPSec
o Kerberos
o WEP
o GSM
 We’ll see lots of crypto applications in the
protocol chapters

2 AccessControl

Uploaded by

Copyright:

Available Formats

2 AccessControl

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

2 AccessControl

Uploaded by

Copyright:

Available Formats

Part II: Access Control

Part 2  Access Control 1

Then said they unto him, Say now Shibboleth:

Part 2  Access Control 3

Part 2  Access Control 4

Part 2  Access Control 5

Part 2  Access Control 7

 Crypto keys  Passwords

 Spse key is 64  Spse passwords

Part 2  Access Control 9

Part 2  Access Control 10

Part 2  Access Control 11

Part 2  Access Control 12

Part 2  Access Control 13

Part 2  Access Control 14

Part 2  Access Control 15

Part 2  Access Control 16

Part 2  Access Control 17

Part 2  Access Control 18

Part 2  Access Control 20

 What if no salt is used?

Part 2  Access Control 21

Part 2  Access Control 22

Part 2  Access Control 23

Part 2  Access Control 25

Part 2  Access Control 26

Part 2  Access Control 27

Part 2  Access Control 30

Part 2  Access Control 31

Part 2  Access Control 32

Part 2  Access Control 33

Part 2  Access Control 34

Loop (double) Whorl Arch

Part 2  Access Control 35

 Capture image of fingerprint

Part 2  Access Control 36

 Extracted points are compared with

 Aside: Do identical twins’ fingerprints differ?

Part 2  Access Control 38

Part 2  Access Control 39

 Iris pattern development is “chaotic”

Part 2  Access Control 40

Part 2  Access Control 41

Part 2  Access Control 42

Part 2  Access Control 43

Part 2  Access Control 45

Part 2  Access Control 46

Part 2  Access Control 47

Part 2  Access Control 48

Part 2  Access Control 50

Part 2  Access Control 51

Part 2  Access Control 53

You can always trust the information given to you

Part 2  Access Control 54

Part 2  Access Control 55

Bob rx rx r --- ---

Sam rwx rwx r rw rw

Part 2  Access Control 57

Accounting Accounting Insurance Payroll