5.2 User Authentication and Authorization

User authentication and authorization are critical components of operating system security. These processes ensure that only legitimate users can access system resources and perform authorized actions. From passwords to biometrics, various methods are employed to verify user identities and control access.

Effective authentication strategies combine multiple factors and leverage protocols like LDAP and Kerberos. Password management policies, user account controls, and single sign-on systems further enhance security while balancing usability. Understanding these concepts is crucial for implementing robust access control in modern operating systems.

Authentication Methods

Types of Authentication Factors

Top images from around the web for Types of Authentication Factors

• 

  The Architecture of Identity Systems View original

  Is this image relevant?

• 

  Information Security Principles View original

  Is this image relevant?

• 

  The Application of Epidemiology for Categorising DNS Cyber Risk Factors View original

  Is this image relevant?

• 

  The Architecture of Identity Systems View original

  Is this image relevant?

• 

  Information Security Principles View original

  Is this image relevant?

1 of 3

Top images from around the web for Types of Authentication Factors

• 

  The Architecture of Identity Systems View original

  Is this image relevant?

• 

  Information Security Principles View original

  Is this image relevant?

• 

  The Application of Epidemiology for Categorising DNS Cyber Risk Factors View original

  Is this image relevant?

• 

  The Architecture of Identity Systems View original

  Is this image relevant?

• 

  Information Security Principles View original

  Is this image relevant?

1 of 3

• Knowledge factors require users to provide information only they know (passwords, PINs, security questions)
• Possession factors involve physical items users have (smart cards, security tokens, mobile devices)
• Inherence factors use unique biological characteristics of users (fingerprints, retinal scans, voice recognition)
• Location factors verify user's physical location (GPS coordinates, IP address)
• Time factors restrict access to specific time periods or durations (office hours, time-limited sessions)

Multi-Factor Authentication Systems

• Combines two or more authentication factors to enhance security
• Typically uses a combination of something you know, have, and are
• Significantly reduces the risk of unauthorized access even if one factor compromised
• Common implementations include password + SMS code, biometric + PIN, or security token + password
• Adaptive MFA adjusts authentication requirements based on risk factors (unusual login location, device, or time)

Biometric Authentication Technologies

• Fingerprint recognition analyzes unique patterns in fingertip ridges and valleys
• Facial recognition measures facial features and geometry for identification
• Iris scanning captures detailed patterns in the colored part of the eye
• Voice recognition analyzes vocal characteristics and speech patterns
• Behavioral biometrics examine unique patterns in user actions (typing rhythm, mouse movements)
• Advantages include convenience and difficulty of replication
• Challenges involve privacy concerns and potential for false positives/negatives

Single Sign-On (SSO) Implementation

• Allows users to access multiple applications with one set of credentials
• Reduces password fatigue and improves user experience
• Utilizes centralized authentication servers to manage user sessions
• Implements protocols like SAML, OAuth, or OpenID Connect for secure token exchange
• Benefits include simplified user management and enhanced security through reduced password use
• Potential drawbacks involve single point of failure if SSO system compromised

Password Management

Effective Password Policy Development

• Minimum length requirements ensure passwords have sufficient complexity (typically 12+ characters)
• Complexity rules mandate use of uppercase, lowercase, numbers, and special characters
• Password expiration policies force regular updates (controversial due to potential for weaker passwords)
• Account lockout procedures protect against brute force attacks (temporary lockouts after failed attempts)
• Prohibit password reuse to prevent recycling of compromised credentials
• Implement password strength meters to guide users in creating robust passwords
• Encourage use of passphrases for improved memorability and security

User Account Management Strategies

• Implement principle of least privilege to limit user access rights
• Regular account audits identify and remove unused or unnecessary accounts
• Role-based access control (RBAC) assigns permissions based on job functions
• Just-in-time (JIT) access provides temporary elevated privileges when needed
• Automated provisioning and deprovisioning streamlines account lifecycle management
• Password reset procedures balance security with user convenience (self-service options, identity verification)
• Account activity monitoring detects suspicious behavior or potential compromises

Authentication Protocols

LDAP (Lightweight Directory Access Protocol)

• Directory service protocol for accessing and maintaining distributed directory information
• Organizes data in a hierarchical tree structure called the Directory Information Tree (DIT)
• Supports authentication by binding client connections to directory entries
• Uses simple bind operations for basic username/password authentication
• Enables more secure SASL (Simple Authentication and Security Layer) binds for advanced mechanisms
• Commonly used in enterprise environments for centralized user management
• Vulnerabilities include potential for information disclosure if not properly secured

Kerberos Authentication System

• Network authentication protocol developed by MIT for secure client/server authentication
• Uses symmetric key cryptography and trusted third-party authentication service
• Provides mutual authentication between clients and servers
• Issues time-limited tickets to grant access to network services
• Consists of Key Distribution Center (KDC) with Authentication Server (AS) and Ticket Granting Server (TGS)
• Protects against eavesdropping and replay attacks through encrypted timestamps
• Widely used in Windows domains and some Unix/Linux environments
• Challenges include clock synchronization requirements and potential for ticket theft

OAuth (Open Authorization) Framework

• Industry-standard protocol for authorization of web, mobile, and desktop applications
• Allows third-party applications to access user resources without sharing credentials
• Utilizes access tokens to grant limited-scope, time-bound permissions
• Supports various grant types for different use cases (Authorization Code, Implicit, Client Credentials)
• Implements roles: Resource Owner, Client, Authorization Server, and Resource Server
• Often used in conjunction with OpenID Connect for authentication purposes
• Enhances security by eliminating need for password sharing between services
• Potential vulnerabilities include token theft or misuse if not properly implemented