User Authentication (Knowledge-Based and Possession-Based)
頻出~44 min8 terms18 past questions
Goals of this unit
Tell apart the roles of identification (saying who someone is), authentication (confirming it is really that person), and access rights (what they may use).
Distinguish the knowledge, possession, and biometric types of authentication factor (the kinds of information used to confirm identity), and judge which combinations count as multi-factor authentication and which do not.
Explain what kind of misuse one-time passwords and risk-based authentication each prevent, and how.
Risk-based authentication (リスクベース認証) compares the device, location, and other conditions of a login with the user's usual pattern, and asks for additional authentication only when it judges the risk to be high.
Login request
Compare device and location with usual
Assess the risk
Extra check only if risk is high
If everything looks normal, the login goes through; only in an unfamiliar situation does it also ask for something like a verification code.
4 / 4
Putting every user through a heavy check every time adds effort, so the check is tightened only when something looks suspicious. The extra check might be a verification code sent to a registered smartphone or the answer to a question set up in advance. The point is to keep things easy for legitimate users while making impersonation (なりすまし), where someone pretends to be the user, hard to pull off with a stolen password alone.
AnalogyIt is like building security that waves familiar staff through with just a badge, but questions anyone trying to get in through an unusual door in the middle of the night.
How to rememberRead it literally: the check is based on risk, rather than applied the same way to everyone.
Exam points
Mix-upAutomatic logout (自動ログアウト) and account lockout (アカウントロック) kick in the same way for everyone, based on idle time or the number of failed attempts. Risk-based authentication (リスクベース認証) is different, because it adds a check depending on how risky the situation is.
A login (ログイン) is the action of entering a user ID, password, or similar details, being confirmed as the genuine user, and starting to use a system or service.
Checking what was entered against registered information to confirm the user's identity is called authentication (認証). Deciding whether to allow or refuse use, based on that result and on the access rights (アクセス権) that define who may use what, is called access control (アクセス制御). The action that ends use is logging out (ログアウト), and doing it before leaving your desk keeps others from picking up where you left off.
AnalogyIt is like giving your membership number and PIN at the front desk of a members-only gym and being let in once they match the list.
Exam points
ExamAllowing or refusing use by checking credentials at login (ログイン) is the job of access control (アクセス制御). That is separate from the work of granting each user access rights (アクセス権) in advance.
A user ID (利用者ID) is a name or number assigned so that a system can identify (識別) each user individually.
Each person gets their own ID, and IDs are never shared. That way, the IDs left in the operation logs show afterward who did what and when.
AnalogyIt is like a student number at school: each number marks one student, and attendance is recorded by number.
How to rememberID is short for identification.
Exam points
Mix-upA user ID (利用者ID) is identification (識別) information that says who someone is, while a password (パスワード) or similar confirms it is really them. An ID alone does not prove identity.
A password (パスワード) is a secret string only the user knows, paired with a user ID for knowledge-based authentication.
Situation
Do
Avoid
Creating it
Make it long and mix character types
Easy guesses like names or birthdays
When first issued
Change it to your own at the first login
Keep using the initial password
Using other services
Use a different one for each service
Reuse the same one
If someone may know it
Change it right away
Wait and see
Sharing
Tell no one
Tell coworkers or family
Storing
If you write it down, store it encrypted
Leave it in an unencrypted file or note
The kinds of information used to confirm identity are called authentication factors (認証要素), and there are three: knowledge, possession, and biometrics. A password falls under knowledge, and its weakness is that anyone who knows it is treated as the user. The main threats are eavesdropping (盗聴), which captures data in transit, and the brute-force attack (総当たり攻撃), which tries every possible string one after another.
AnalogyIt is like the password to a secret clubhouse: whoever says it is treated as a member, so it becomes useless the moment it leaks.
How to rememberpass + word: the word that lets you pass.
Exam points
ExamThe countermeasure for eavesdropping (盗聴) is encrypting (暗号化) the communication path, while the countermeasure for a brute-force attack (総当たり攻撃) is capping failed login (ログイン) attempts. The two aim at different threats.
ExamA complex, long enough password (パスワード) helps prevent unauthorized logins (ログイン), but it does nothing to prevent infection by malware (マルウェア), meaning malicious programs.
ExamA password (パスワード) is not told to anyone, administrators included, and the same one is not reused across work and personal accounts.
Access management (アクセス管理) means deciding access rights (アクセス権), that is, who may use which information and functions and how far, and making sure use stays within those limits.
Access rights state which operations, such as reading, changing, or running, a given user may perform on given data or functions. Access management covers both deciding and granting these rights and access control (アクセス制御), which allows or refuses use according to them. Rights are reviewed whenever users are added, transferred, or removed, so that no unneeded rights are left behind.
AnalogyIt is like a hotel key card: even once you are confirmed as a guest, it opens only your room and the gym, not the staff-only areas.
How to remember"Access" means getting in, so access management is about drawing the line on how far each person may go.
Exam points
ExamTo vary which data each user can see, grant access rights (アクセス権) for each pairing of user and data.
Mix-upAuthentication (認証) confirms whether someone is who they claim to be. Access management (アクセス管理) comes after that, deciding what they may use and how far and enforcing it.
An IC card (ICカード) has a built-in IC chip that can store and process information, and is used for possession-based authentication, where holding the card is the proof of identity.
Because the chip can carry out cryptographic processing itself, its contents are harder to read or copy than those of a card that stores data only on a magnetic stripe. IC cards are often used as employee badges or building passes, and a lost or stolen card must be disabled right away.
AnalogyIt is like a house key: whoever holds it is treated as a resident, so if you lose it, the lock has to be changed.
How to rememberIC stands for integrated circuit, meaning there is a tiny computer inside the card.
Exam points
ExamManaging entry to and exit from rooms (入退室管理) with IC cards (ICカード) is a physical security measure (物理的セキュリティ対策), since it restricts people's movement into buildings and rooms.
A one-time password (ワンタイムパスワード) is a single-use password valid for one authentication only, and a new value is issued every time.
Generate a new value
Log in with it
Used value expires
A different value next time
At the next login, another value is created.
4 / 4
The value is generated, for example, by a small dedicated device called a token (トークン) or by a smartphone app, or it is sent by SMS. Two other methods follow the same idea, because the value entered changes with each authentication: typing the digits at positions, different each time, specified on a pre-issued random number table (乱数表), and matrix authentication (マトリクス認証), where different digits appear each time in a grid at positions and in an order the user has memorized.
AnalogyIt is like the numbered ticket you take at a bank counter: once your number is called, it is done, and on your next visit you get a different one.
How to remember"One-time" means good for one use only, the opposite of an ordinary password that you can use again and again.
Exam points
ExamA one-time password (ワンタイムパスワード) stops intrusions that reuse a leaked (漏えい) value later, but it cannot stop eavesdropping (盗聴) on the communication itself.
ExamRandom number tables (乱数表) and matrix authentication (マトリクス認証) also work well against impersonation (なりすまし) with an eavesdropped value.
Mix-upThe mechanism that lets one login (ログイン) open several permitted systems is single sign-on (シングルサインオン), which is not the same as a one-time password (ワンタイムパスワード).
Multi-factor authentication (多要素認証) confirms identity by combining two or more authentication factors (認証要素) of different types.
Authentication factor
Knowledge (something you know)
Password
Answer to a secret question
Possession (something you have)
IC card
Mobile phone that receives SMS
Biometrics (traits of your body or behavior)
Fingerprint, vein pattern
Signature handwriting and pen pressure
The possession factor is also called an owned item (所有物); the biometric factor covers behavioral traits like handwriting as well as physical ones like fingerprints and veins, and it also goes by the loanword biometrics (バイオメトリクス). Using two factors of different types and granting access only after both checks pass is called two-factor authentication (二要素認証). If one factor is broken, the other still stands, which makes the defense stronger.
AnalogyIt is like opening a bank safe-deposit box, where you must give a PIN at the counter and also turn your own key. Someone who learns the PIN still cannot open it without the key.
How to rememberMFA stands for multi-factor authentication, and a factor is one type of proof.
Exam points
ExamAuthentication factors (認証要素) fall into three types: knowledge (知識), possession (所持), and biometrics (生体). Fingerprints and similar data are also personal information, but the category is called biometrics.
ExamStacking factors of the same type does not make it multi-factor (多要素). It becomes two-factor (二要素) when a possession or biometric factor is added to knowledge-based authentication.
Mix-upEven two-step verification (二段階認証), which checks twice, is not two-factor authentication (二要素認証) if both checks use knowledge. The number of steps and the number of factor types are counted separately.