Access Control - Computer and Network Security - Lecture Slides, Slides of Computer Science

Download Access Control - Computer and Network Security - Lecture Slides and more Slides Computer Science in PDF only on Docsity!

Part 2  Access Control 1

Access Control

Part 2  Access Control 2

Access Control

 Two parts to access control

 Authentication: Who goes there?

o Determine whether access is allowed

o Authenticate human to machine

o Authenticate machine to machine

 Authorization: Are you allowed to do that?

o Once you have access, what can you do?

o Enforces limits on actions

 Note: Access control often used as synonym for

authorization

Part 2  Access Control 4

Who Goes There?

 

Part 2  Access Control 5

Who Goes There?

 How to authenticate a human to a machine?



Part 2  Access Control 7

Who Goes There?

 How to authenticate a human to a machine?

 Can be based on…

o Something you know

 For example, a password

Part 2  Access Control 8

Who Goes There?

 How to authenticate a human to a machine?

 Can be based on…

o Something you know

 For example, a password

o Something you have

 For example, a smartcard

Part 2  Access Control 10

Something You Know

 

Part 2  Access Control 11

Something You Know

 Passwords



Part 2  Access Control 13

Something You Know

 Passwords

 Lots of things act as passwords!

o PIN

Part 2  Access Control 14

Something You Know

 Passwords

 Lots of things act as passwords!

o PIN

o Social security number

Part 2  Access Control 16

Something You Know

 Passwords

 Lots of things act as passwords!

o PIN

o Social security number

o Mother’s maiden name

o Date of birth

Part 2  Access Control 17

Something You Know

 Passwords

 Lots of things act as passwords!

o PIN

o Social security number

o Mother’s maiden name

o Date of birth

o Name of your pet, etc.

Part 2  Access Control 19

Trouble with Passwords

 “Passwords are one of the biggest practical

problems facing security engineers today.”

Part 2  Access Control 20

Trouble with Passwords

 “Passwords are one of the biggest practical

problems facing security engineers today.”

 “Humans are incapable of securely storing high-

quality cryptographic keys, and they have

unacceptable speed and accuracy when performing

cryptographic operations. (They are also large,

expensive to maintain, difficult to manage, and they

pollute the environment. It is astonishing that these

devices continue to be manufactured and deployed.)”