access ‘98 authentication & security george machovec technical director colorado alliance of...

Access ‘98Access ‘98Authentication & SecurityAuthentication & Security

George MachovecGeorge Machovec

Technical DirectorTechnical DirectorColorado Alliance of Research Colorado Alliance of Research

LibrariesLibraries

Authentication & SecurityAuthentication & Security

Authentication: To allow users to Authentication: To allow users to access the appropriate networked access the appropriate networked databases from anywhere at anytime. databases from anywhere at anytime. A user establishes a right to an identity.A user establishes a right to an identity.

Authorization: To allow users to Authorization: To allow users to receive the appropriate suite of receive the appropriate suite of electronic products to which they are electronic products to which they are entitled. Is an “identity” permitted to entitled. Is an “identity” permitted to perform some action...perform some action...


Libraries and consortia offer broad Libraries and consortia offer broad suites of electronic products which suites of electronic products which must be accessed both on-campus must be accessed both on-campus and remotely.and remotely.• Dial-in users through commercial ISPsDial-in users through commercial ISPs• Faculty on SabbaticalFaculty on Sabbatical• Distance education Distance education • Other authorized users not on campus Other authorized users not on campus

for whatever reasonfor whatever reason


Typical kinds of services libraries Typical kinds of services libraries want to distribute:want to distribute:• OCLC FirstSearchOCLC FirstSearch• Ovid or SilverPlatter (local or remote)Ovid or SilverPlatter (local or remote)• Information Access CompanyInformation Access Company• Encyclopedia BrittanicaEncyclopedia Brittanica• GaleNetGaleNet• Hundreds of othersHundreds of others


Authentication StrengthAuthentication Strength• Reasonable security which meets the Reasonable security which meets the

requirements of both the university and requirements of both the university and the supplier of data is important. This the supplier of data is important. This is somewhat subjective and depends on is somewhat subjective and depends on what is being protected, how easily is it what is being protected, how easily is it “hacked,” and what are the chance or “hacked,” and what are the chance or consequences of a breach either on a consequences of a breach either on a single or systematic basis.single or systematic basis.


Granularity of RequirementsGranularity of Requirements• How finely must users be segregated How finely must users be segregated

for access to different resources (e.g. for access to different resources (e.g. faculty, grad students, undergrads, faculty, grad students, undergrads, staff, community borrowers)staff, community borrowers)

• How does granularity affect pricing?How does granularity affect pricing?• What about use statistics?What about use statistics?• Be practical...Be practical...


Privacy IssuesPrivacy Issues• Confidentiality of users with vendors is keyConfidentiality of users with vendors is key• Possible data gathered by vendor should Possible data gathered by vendor should

be protected via contract from resale or be protected via contract from resale or reusereuse

• Many universities are bound by privacy Many universities are bound by privacy laws or legislative constraintslaws or legislative constraints

• Encryption as protection from hackers may Encryption as protection from hackers may offer better privacy but may not always be offer better privacy but may not always be practicalpractical

Authentication & SecurityAuthentication & SecurityTechniquesTechniques

IP Filtering - An IP address (or IP Filtering - An IP address (or range of addresses) is used to filter range of addresses) is used to filter access to a database or service so access to a database or service so that only users with a PC (e.g. that only users with a PC (e.g. browser) within a proper network browser) within a proper network domain may gain access.domain may gain access.

Authentication & SecurityAuthentication & SecurityIP FilteringIP Filtering

BenefitsBenefits• Widely usedWidely used• Well understoodWell understood• No passwords to No passwords to

remember or remember or changechange

• No unauthorized No unauthorized distribution of distribution of passwordspasswords

DrawbacksDrawbacks• Must be at a browser Must be at a browser

within an IP rangewithin an IP range• Bad for remote usersBad for remote users• Many academics are Many academics are

dropping their dropping their modem pools or they modem pools or they are too smallare too small

• Little granularity in Little granularity in use datause data


UserID and Passords - the distribution UserID and Passords - the distribution of logins and passwords for access to of logins and passwords for access to computer systems has historically computer systems has historically been widely used in the computing been widely used in the computing community. Upon reaching an community. Upon reaching an electronic resource the user is asked electronic resource the user is asked to login for access. In more secure to login for access. In more secure systems passwords are periodically systems passwords are periodically changed.changed.

Authentication & SecurityAuthentication & SecurityUserID and PasswordsUserID and Passwords

BenefitsBenefits• Widely employed Widely employed

and often used in and often used in conjunction with IP conjunction with IP filteringfiltering

• Available on most Available on most servicesservices

• Can be Can be remembered and remembered and used from used from anywhereanywhere

DrawbacksDrawbacks• Files must be Files must be

maintainedmaintained• Encryption of Encryption of

passwords?passwords?• Z39.50 Z39.50

compatibility may compatibility may be a problem esp. be a problem esp. with encryptionwith encryption

• Unauthorized Unauthorized distributiondistribution


Hybrid Solutions with IP Filter + Hybrid Solutions with IP Filter + UserID/Password if filtering fails - UserID/Password if filtering fails - In this scenario a user goes to a In this scenario a user goes to a resource and goes through IP resource and goes through IP source address filtering…if it fails source address filtering…if it fails the user is then prompted for a the user is then prompted for a UserID to establish their identity.UserID to establish their identity.

BenfitsBenfits• Works for local and Works for local and

remote usersremote users• Does not require the Does not require the

“hassle” of a “hassle” of a password when a password when a person is in your person is in your local networklocal network

• Implementation of Implementation of this solution can this solution can range of easy to range of easy to complexcomplex

DrawbacksDrawbacks• Must maintain a Must maintain a

user fileuser file• Unauthorized Unauthorized

UserID distribution UserID distribution a dangera danger

• May work well May work well with some with some situations and not situations and not othersothers

Authentication & SecurityAuthentication & SecurityHybrid IP filtering + UserIDHybrid IP filtering + UserID


Proxy Servers - In this technique a Proxy Servers - In this technique a user must login or pass an IP filter into user must login or pass an IP filter into an intermediate server which is known an intermediate server which is known by the end service as only passing on by the end service as only passing on a legitimate user. This can be used in a legitimate user. This can be used in telnet, z39.50 or http sessions. In Web telnet, z39.50 or http sessions. In Web sessions the proxy may cache pages sessions the proxy may cache pages or return a Java applet to a browser for or return a Java applet to a browser for its identity to the end service.its identity to the end service.

Authentication & SecurityAuthentication & SecurityProxy ServersProxy Servers

BenefitsBenefits• Can be used from Can be used from

anywhereanywhere• Central Central

management and management and controlcontrol

• Well understood Well understood technologytechnology

• Modularize the Modularize the authentication authentication problemproblem

DrawbacksDrawbacks• Single point of Single point of

failurefailure• Extra overheadExtra overhead• Double handling of Double handling of

traffic in a traffic in a “mechanical proxy”“mechanical proxy”

• Still may need to Still may need to maintain a user file maintain a user file with its security with its security issuesissues


Credential Based Approaches - A Credential Based Approaches - A user interacts directly with the end user interacts directly with the end resource over the net. Issues resource over the net. Issues include:include:• What credentials are presented by What credentials are presented by

user?user?• How are credentials secured?How are credentials secured?• How are credentials validated by the How are credentials validated by the

issuing institution? issuing institution?

Authentication & SecurityAuthentication & SecurityCredentials Credentials

Password-based Credentials - the Password-based Credentials - the information resource maintains a information resource maintains a password file of users. This technique password file of users. This technique has many of the drawbacks associated has many of the drawbacks associated with any UserID approach . Other with any UserID approach . Other weaknesses:weaknesses:• Confidentiality/PrivacyConfidentiality/Privacy• How will password file be updatedHow will password file be updated• Must be done on a resource-by-resource Must be done on a resource-by-resource

basisbasis

Authentication & SecurityAuthentication & SecurityCredentialsCredentials

Certificate-based Credentials - X.509 Certificate-based Credentials - X.509 certificate-based approach offers a certificate-based approach offers a machine credentials that support its machine credentials that support its right to the use of an name and allows right to the use of an name and allows this to be verified by a certificate this to be verified by a certificate authority (e.g. run by the institution or authority (e.g. run by the institution or a 3rd party). X.509 can include a 3rd party). X.509 can include expirations, revocation, private keys, expirations, revocation, private keys, demographic data.demographic data.

Authentication & SecurityAuthentication & SecurityCertificate-BasedCertificate-Based

BenefitsBenefits• Well defined Well defined

protocol/process protocol/process for validationfor validation

• X.509 uses lower-X.509 uses lower-level protocol-level protocol-integrated methodintegrated method

• Works well in httpWorks well in http• Flexible /much Flexible /much

work in this areawork in this area

DrawbacksDrawbacks• Difficult to distributeDifficult to distribute• Complicated for users Complicated for users

to install (esp. if a user to install (esp. if a user has several PCs)has several PCs)

• Backup, maintenance Backup, maintenance and recoveryand recovery

• Problematic on shared Problematic on shared PCs (e.g. reference)PCs (e.g. reference)

• Must be supported by Must be supported by end resource too...end resource too...

Authentication & SecurityAuthentication & SecurityExamples - Colorado Examples - Colorado

AllianceAlliance

Colorado Alliance of Research Libraries Colorado Alliance of Research Libraries - Uses a hybrid IP filtering + UserID - Uses a hybrid IP filtering + UserID scheme. If a user fails the IP filtering scheme. If a user fails the IP filtering they are prompted for a library card ID they are prompted for a library card ID and name which is embedded in an and name which is embedded in an SQL database. The file is harvested SQL database. The file is harvested from local III and CARL library OPACs. from local III and CARL library OPACs. This will then launch a cgi which logs This will then launch a cgi which logs into the local or remote resource.into the local or remote resource.

Authentication & SecurityAuthentication & SecurityExamples - VIVA (Virginia)Examples - VIVA (Virginia)

VIVA has 39 libraries and runs a central proxy VIVA has 39 libraries and runs a central proxy server. A weekly extraction is made from server. A weekly extraction is made from OPACs of library card numbers and loaded into OPACs of library card numbers and loaded into a central file. The system downloads a Java a central file. The system downloads a Java Applet to a local browser so it can take on Applet to a local browser so it can take on proper identity in going to the remote service. proper identity in going to the remote service. Once users logins to proxy, the proxy goes to Once users logins to proxy, the proxy goes to remote system for IP filter test. Proxy is only remote system for IP filter test. Proxy is only involved once...involved once...

Netscape Proxy Server 2.5Netscape Proxy Server 2.5 Http://timesync.gmu.edu/proxy.htmlHttp://timesync.gmu.edu/proxy.html

Authentication & SecurityAuthentication & SecurityExamples - IAC Examples - IAC

IAC Remote Patron Authentication IAC Remote Patron Authentication Service - Does an IP filter check and if Service - Does an IP filter check and if it fails it consults a flat ASCII patron it fails it consults a flat ASCII patron file maintained by the local file maintained by the local institution. institution. • Only works with IAC Searchbank Only works with IAC Searchbank

productsproducts• Extra charge for this product from IACExtra charge for this product from IAC• Must still maintain your own patron fileMust still maintain your own patron file

Authentication & SecurityAuthentication & SecurityExamples - Innovative Examples - Innovative

InterfacesInterfaces

III Web Access Management - In Release III Web Access Management - In Release 12 this is a true proxy server module 12 this is a true proxy server module which automatically checks a patron file which automatically checks a patron file on local III system. Can support patron on local III system. Can support patron type limits Problems include:type limits Problems include:• Limited to 50 targets (25 in release 11)Limited to 50 targets (25 in release 11)• Uses-up III concurrent users (very Uses-up III concurrent users (very

expensive)expensive)• Requires set-up on each browser to address Requires set-up on each browser to address

this proxy serverthis proxy server

Authentication & SecurityAuthentication & SecurityExamples - Athens (U.K.)Examples - Athens (U.K.)

Central (but mirrored) authentication system Central (but mirrored) authentication system for all of higher education in UK including for all of higher education in UK including >2million students and faculty>2million students and faculty

Built around Sybase on multiple servers. Built around Sybase on multiple servers. UserID & password based for all resourcesUserID & password based for all resources

Local institutions must upload patron records Local institutions must upload patron records according to prescribed formataccording to prescribed format

Supports all types of resources (several Supports all types of resources (several thousand)…including Web and Telnet targets. thousand)…including Web and Telnet targets. http://www.athens.ac.uk/info/authentication.htmlhttp://www.athens.ac.uk/info/authentication.html

access ‘98 authentication & security george machovec technical director colorado alliance of...

Documents

keyconfidentiality of

practical slide

reasonother authorized

b authorization

reason slide

privacy laws

better privacy

supplier of data