Institutionen För Datavetenskap Department of Computer and Information Science

Institutionen för datavetenskap Department of Computer and Information Science Final thesis Securing Credentials on Untrusted Clients by Johannes Hassmund LIU-IDA/LITH-EX-A--10/003--SE 2010-01-21 Linköpings universitet Linköpings universitet SE-581 83 Linköping, Sweden 581 83 Linköping Linköping University Department of Computer and Information Science Final Thesis Securing Credentials on Untrusted Clients by Johannes Hassmund LIU-IDA/LITH-EX-A--10/003--SE 2010-01-21 Supervisor: Nahid Shahmehri Examiner: Nahid Shahmehri Abstract IT systems rely on correct authentication of their users in order to provide confidentiality and integr‐ ity of data. When accessing systems remotely, for instance over the Internet, no assumptions can be made regarding the level of security on the computer used. Such computers may be exposed to malware, keyloggers and other threats and must therefore generally be considered as untrusted. To increase security when users connect remotely from untrusted clients various authentication mechanisms can be used. Usability must however be considered when deploying new mechanisms. Protection must also be balanced to the load put on users. This thesis gives a presentation of common authentication mechanisms available and enumerates the main attack vectors threatening correct authentication and credentials. Furthermore a ranking method is proposed in order to evaluate authentication mechanisms in relation to each other. Using the outcome of the ranking of existing methods an authentication system called Smokey (Synchronizable Mobile Key) is proposed and implemented. Smokey uses Java capable cell phones as hardware tokens generating short time valid one time passwords. Whereas traditional tokens may cease to work under certain circumstances Smokey provides users the ability to synchronize with the authentication server aiming for high usability. i Acknowledgements I would like to thank my supervisor and examiner Professor Nahid Shahmehri at the Department of Computer and Information Science (IDA) at Linköping University for feedback and support during the work of this thesis and for an interesting and much appreciated time at IDA. I would also like to thank my opponent Christian Vestlund for creative discussions and cherished coffee breaks. Finally I would like to thank my beloved wife Helena for hours of proofreading and constantly bringing light into my life. Linköping, January, 2010 Johannes Hassmund iii Content Chapter 1 Introduction ............................................................................................................. 1 1.1. Background ............................................................................................................................. 1 1.2. Definition of Problem .............................................................................................................. 1 1.3. Method ................................................................................................................................... 2 1.4. Delimitations ........................................................................................................................... 2 1.5. Target Audience ...................................................................................................................... 2 1.6. Outline..................................................................................................................................... 3 Chapter 2 Background .............................................................................................................. 5 2.1. Cryptography Basics ................................................................................................................ 5 2.1.1. Secure Hash Functions .................................................................................................... 5 2.1.2. Message Authentication Codes ...................................................................................... 6 2.1.3. Symmetric vs. Asymmetric Cryptography ....................................................................... 6 2.1.4. Digital Signatures ............................................................................................................ 7 2.1.5. Certification Authorities .................................................................................................. 7 2.2. SSL/TLS .................................................................................................................................... 8 2.2.1. SSL/TLS Handshake Protocol ........................................................................................... 8 2.2.2. SSL/TLS Record Protocol ............................................................................................... 10 2.3. Threats and attack vectors .................................................................................................... 11 2.4. Malicious Software (Viruses, Worms, Trojan Horses and Rootkits) ..................................... 11 2.5. Untrusted Clients vs. Trusted computers ............................................................................. 12 2.5.1. Untrusted Client ............................................................................................................ 12 2.5.2. Trusted Computing ....................................................................................................... 12 2.5.3. What is Secure Authentication? ................................................................................... 12 2.6. Java ME ................................................................................................................................. 13 2.6.1. Java ME API Access Control .......................................................................................... 13 2.6.2. Java ME Security and Trust Services API ....................................................................... 14 v Chapter 3 Attack Vectors ......................................................................................................... 15 3.1. Classification of Attack Vectors ............................................................................................. 15 3.1.1. Active vs. Passive Attacks .............................................................................................. 16 3.1.2. Definition of Attack Vector Classes ............................................................................... 16 3.2. Basic Level Attack Vectors .................................................................................................... 16 3.2.1. Guessing and Dictionary attacks ................................................................................... 17 3.2.2. Brute Force Attacks ....................................................................................................... 17 3.2.3. Shoulder Surfing ............................................................................................................ 17 3.2.4. Password Reuse ............................................................................................................ 17 3.2.5. Hardware Keylogger ...................................................................................................... 18 3.2.6. Software Keylogger ....................................................................................................... 18 3.2.7. Social Engineering ......................................................................................................... 19 3.3. Medium Level Attack Vectors ............................................................................................... 19 3.3.1. Theft of Credentials by Intrusion .................................................................................. 19 3.3.2. Eavesdropping of Network Traffic ................................................................................ 19 3.4. Advanced Level Attack Vectors ............................................................................................. 20 3.4.1. Man in the Middle ......................................................................................................... 21 3.4.2. Man in the Browser ....................................................................................................... 22 3.4.3. Session Hijacking ........................................................................................................... 22 3.5. Other Attack Vectors ............................................................................................................. 23 Chapter 4 Authentication Methods ......................................................................................... 25 4.1. Threat Assessment and Ranking of Methods ....................................................................... 25 4.2. Knowledge Based Authentication ......................................................................................... 26 4.2.1. Passwords ..................................................................................................................... 26 4.2.2. On Screen Mouse Entered Passwords .......................................................................... 26 4.2.3. Threat Assessment ........................................................................................................ 27 4.3. Token Based Authentication; One Time Passwords ............................................................. 28 4.3.1. One Time Pads .............................................................................................................

Load more