Authentication & Access Control: Principles, Models & Real-World Systems

TAKEAWAYS:

• Authentication proves identity (something you know, have, or are), while access control enforces least privilege—granting only necessary permissions.
• MAC (Mandatory Access Control) uses labels (e.g., military clearance), DAC (Discretionary Access Control) relies on owners (e.g., file permissions), and RBAC/ABAC assign roles or attributes (e.g., "admin" or "age > 18").
• Kerberos uses symmetric keys and tickets to authenticate users in networks (like Ncell’s internal systems), while PGP secures emails via asymmetric encryption (used by journalists or activists).
• Biometrics (fingerprint, iris) are harder to steal than passwords but raise privacy concerns (e.g., Nepal’s eSewa biometric login).
• Access Control Lists (ACLs) map users to permissions (e.g., user:read,write), while Access Control Matrices (ACMs) generalize this as a grid (theory → practice).
• Password aging and token-based auth (e.g., Google Authenticator) balance security and convenience—critical for banks like NMB or Nabil.

1. Authentication: Proving You Are Who You Claim

Authentication verifies identity before granting access. It relies on three factors:

1. Something you know (passwords, PINs).
2. Something you have (smart cards, OTP tokens).
3. Something you are (fingerprints, facial recognition).

1.1 Password-Based Authentication

• Weaknesses:
  • Brute-force attacks (e.g., cracking a 4-digit PIN in seconds).
  • Phishing (tricking users into revealing passwords).
  • Reuse across sites (if one account is hacked, others are too).
• Mitigations:
  • Password aging: Force periodic changes (e.g., every 90 days in corporate systems).
  • Complexity rules: Enforce length (12+ chars) and character types.
  • Salting: Add random data to hashes (e.g., hash(password + salt)) to thwart rainbow tables.

1.2 Biometric Authentication

Biometrics use unique physical traits:

• Fingerprint: Used in smartphones (e.g., Pathao driver verification).
• Facial recognition: Nepal Police’s e-Kanun system for criminal databases.
• Iris/retina scan: High-security areas (e.g., military bases).

Pros/Cons:

Worked Example: Nepal’s eSewa uses fingerprint + OTP for transactions:

1. User places finger on device → system checks against stored template.
2. If matched, an OTP is sent to the registered phone.
3. User enters OTP → transaction proceeds. Why? Combines something you are (biometric) + something you have (phone).

1.3 Token-Based Authentication

Tokens are temporary credentials (e.g., JWT, OAuth).

• How it works:
  1. User logs in → server issues a signed token (e.g., eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...).
  2. Token includes expiry time (e.g., 1 hour).
  3. Client sends token with each request (e.g., API calls to Daraz’s backend).
• Advantages:
  • No password storage on client side (secure for web apps).
  • Short-lived tokens limit damage if stolen.
• Example:
  • Google Authenticator: Generates time-based OTPs for 2FA.
  • WhatsApp Web: Uses a QR code token to link phone ↔ desktop.

Mermaid Diagram: Token Flow

sequenceDiagram
    User->>Server: Login (username/password)
    Server-->>User: JWT Token (expires in 1h)
    User->>API: Request (includes token)
    API->>Auth Service: Verify token signature
    Auth Service-->>API: Valid? Yes
    API-->>User: Grant access

2. Access Control: Who Gets What Permissions?

Access control decides what authenticated users can do. Three core models:

2.1 Mandatory Access Control (MAC)

• Definition: Access is controlled by a central authority (e.g., government, military).
• How it works:
  • Users/objects get security labels (e.g., Top Secret, Confidential).
  • Rules define allowed interactions (e.g., Top Secret can read Secret but not vice versa).
• Example:
  • Nepal Army’s classified documents: Only officers with clearance Level 3+ can access.
• Disadvantages:
  • Inflexible (hard to adapt to new roles).
  • Requires strict enforcement (e.g., SELinux in Linux).

2.2 Discretionary Access Control (DAC)

• Definition: Owners decide who gets access (e.g., file permissions in Windows/Linux).
• How it works:
  • Files/folders have ACLs (e.g., chmod 755 file.txt in Linux).
  • Owner grants/revokes permissions (e.g., user1: read/write, user2: read-only).
• Example:
  • Google Drive: File owner shares a link with "view" or "edit" permissions.
• Weaknesses:
  • Privilege escalation: If an admin shares a file with too many permissions, attackers exploit it.
  • No central policy: Hard to enforce company-wide rules.

2.3 Role-Based Access Control (RBAC)

• Definition: Permissions are tied to roles (e.g., admin, customer, manager).
• How it works:
  1. Define roles (e.g., Cashier, Store Manager in a supermarket).
  2. Assign permissions to roles (e.g., Cashier can process sales but not void transactions).
  3. Assign users to roles.
• Example:
  • Nepal Rastra Bank’s internal system:
    • Auditor role: Can view all transactions but not modify.
    • Teller role: Can deposit/withdraw but not approve loans.
• Advantages:
  • Scalable: Add a new employee → assign a role.
  • Audit-friendly: Track actions by role (e.g., "Loan approved by LoanOfficer").

2.4 Attribute-Based Access Control (ABAC)

• Definition: Permissions depend on attributes (e.g., location, time, device).
• How it works:
  • Rules like: IF (user.department == "Finance" AND time > 9am AND device = "corporate-laptop") THEN allow.
• Example:
  • NTC’s network access:
    • Employees in Kathmandu get VPN access during 9am–5pm.
    • Contractors only get access via guest Wi-Fi.
• Advantages:
  • Fine-grained: More precise than RBAC.
• Disadvantages:
  • Complex to manage: Rules can become unwieldy.

Comparison Table: Access Control Models

3. Trust Frameworks: Secure Authentication in Networks

Trust frameworks enable secure communication between entities (users, servers, services).

3.1 Kerberos Authentication

• Problem: How does a user prove identity to a server without sending passwords over the network?
• Solution: Uses symmetric encryption and tickets.
• How it works (for Ncell’s internal systems):
  1. User logs into their machine → sends credentials to Authentication Server (AS).
  2. AS issues a Ticket Granting Ticket (TGT) encrypted with the Key Distribution Center (KDC)’s key.
  3. User requests a service (e.g., email server) → sends TGT to Ticket Granting Service (TGS).
  4. TGS issues a service ticket (e.g., for email access).
  5. User sends ticket to email server → server verifies it with KDC.

Mermaid Diagram: Kerberos Flow

sequenceDiagram
    User->>AS: Request TGT (username/password)
    AS-->>User: TGT (encrypted with KDC key)
    User->>TGS: Request service ticket (e.g., email)
    TGS-->>User: Service ticket (encrypted with email server key)
    User->>Email Server: Service ticket + authenticator
    Email Server->>KDC: Verify ticket
    KDC-->>Email Server: Valid?
    Email Server-->>User: Grant access

Why Kerberos?

• Used in Microsoft Active Directory (corporate networks).
• Prevents replay attacks (tickets expire quickly).

3.2 Pretty Good Privacy (PGP)

• Problem: How to securely send emails (e.g., journalists communicating with sources)?
• Solution: Combines asymmetric encryption (RSA) + hashing (SHA-256).
• How it works:
  1. Alice generates a key pair: public (shared) + private (secret).
  2. Alice sends her public key to Bob (via a key server or email).
  3. Bob encrypts the email with Alice’s public key.
  4. Alice decrypts with her private key.
• PGP Services:
  • Confidentiality: Only Alice can read the message.
  • Integrity: Hash ensures message isn’t tampered with.
  • Authentication: Digital signature proves sender is Alice.
  • Non-repudiation: Alice can’t deny sending the message.

Example:

• Nepali journalists use PGP to leak stories to foreign media (e.g., via ProtonMail or Thunderbird + Enigmail).

4. Real-World Applications

4.1 eSewa: Biometrics + OTP

• Authentication:
  • Biometric (fingerprint) + OTP (sent to registered phone).
• Access Control:
  • RBAC: Users have roles like Customer, Merchant, Admin.
  • ABAC: Transactions allowed only during 9am–6pm (banking hours).

4.2 Ncell’s Internal Systems: Kerberos

• Problem: Employees access multiple servers (billing, customer data, CRM).
• Solution: Kerberos tickets reduce password exposure.
• Example:
  • A customer service agent logs in once → gets a TGT → accesses CRM without re-entering passwords.

4.3 Daraz’s Order Fulfillment: ACLs

• Access Control:
  • Warehouse staff: Can scan/ship orders (ACL: scan_order, update_status).
  • Managers: Can approve refunds (ACL: approve_refund).
• Authentication:
  • Token-based: Employees log in via Daraz’s internal portal → receive a JWT for API access.

4.4 Nepal Rastra Bank: MAC for Financial Data

• Sensitive data (e.g., loan records) is labeled:
  • Level 1: Public (e.g., interest rates).
  • Level 3: Restricted (e.g., individual borrower data).
• Only auditors with Level 3+ clearance can access.

5. Exam Tips

1. Define vs. Explain:
   • Define: Short (1–2 sentences). Example: "Access right: A permission granted to a user/role to perform a specific action (e.g., read, write, execute) on a resource."
   • Explain: Use examples + diagrams. Example for Kerberos:
     • Draw the sequence diagram (as above).
     • Mention TGT, TGS, and service ticket.
2. Compare ACL vs. ACM:
   • ACL: List of permissions per object (e.g., file.txt: user1=read, user2=write).
   • ACM: Matrix where rows = subjects, columns = objects, cells = permissions.
   • Exam trick: ACL is practical (used in filesystems), ACM is theoretical (used in models).
3. Trust Framework Core Components:
   • Kerberos: AS, TGS, KDC, TGT, service ticket.
   • PGP: Public/private keys, digital signatures, key servers.
4. Worked Examples:
   • For password aging, calculate: "If a password must change every 90 days, and an attacker tries 1000 guesses/sec, how long to crack a 10-char alphanumeric password?" (Answer: Centuries—but emphasize salting and hashing.)
   • For RBAC, design a table for a university system:

     Role	Permissions
     Student	View grades, submit assignments
     Professor	Grade assignments, view student data
     Admin	Add/delete users, reset passwords

5. Common Pitfalls:
   • MAC vs. DAC: Don’t confuse central authority (MAC) with owner discretion (DAC).
   • Biometrics: Remember false acceptance/rejection rates (e.g., fingerprint scanners can fail in dirty conditions).
   • Kerberos: Always mention symmetric keys (not asymmetric like PGP).