A mult-factor authentication system. I need feedback

[iamgenius]

I designed an authentication system as a project for a cyber security class. I want you to critique it please. Here is a quick explanation:


Note: Sorry no images but I'll provide links to videos for the create account and login process

Our authentication system consists of four authentication stages with the third stage disabled by default (An explanation will be provided later). Users start by choosing a username and entering their full name. For the first stage, users draw a line pattern by clicking on a grid displayed on the screen at the time of registration. For login into the first stage the same grid is shown but with a character inside each box. Users need to indicate the same line pattern by inputting characters from the set of characters appearing in the grid using a virtual keyboard. Users need to select characters based on their position on the grid so that it matches the pattern drawn at time of account creation. The character set is the ten digits (0 – 9) and the English alphabets (small and capital letters), which makes the total 26 + 26 + 10 = 62 possible entries. Characters appear randomly in the grid boxes, so a person observing the login process will hardly gain any valuable information. Figures 1 & 2 illustrate the first stage.

Figure 1: Pattern creation for 1st stage

Figure 2: Inputting characters in accordance with the pattern

For the second stage, users need to input four characters—using a virtual keyboard—selected from a set of ten characters according to a certain numeric code specified at the time of registration. The order of the ten characters is random and they are provided from the same character set as the first stage (the full alphanumeric set = 62 characters). The numeric code is communicated secretly to the user. Figure 3 shows the second stage at time of registration and login.

Figure 3: Second authentication stage

For the third stage, the system provides users with a seed value they will need to input into their smartphone to generate a passcode and enter it into the system. At time of registration, the authentication system generates a complex mathematical formula and associates it with the user. The mathematical formula is communicated secretly to the user. The user enters the formula in an Excel like program in his smartphone. For login, the user plugs in the randomly generated seed value into the Excel sheet in his smartphone to get the output. Then, the user finally enters the output (the passcode) into the third stage login screen to be authenticated. Figure 4 shows the third stage.

Figure 4: Third authentication stage

For the fourth stage, users will need to answer a security question selected from a set of questions created at the time of registration as shown below in figure 5.

Figure 5: Fourth stage
As you can see, and in order to maximize usability, we chose to use factors mainly from the “something you know” category for our solution to lessen disadvantages. Only one factor (third stage) can be regarded as one from the “something you have” category. The reason we used this one factor was to add some diversity to the system, and the fact that the item needed to be carried is a smartphone. A smartphone is not an extra item to carry because the assumption is that every individual is in possession of a smartphone nowadays, so the disadvantage usually accompanied with factors from the “something you have” category is not really applicable here. However, the third stage is disabled by default, again to maximize usability and minimize user effort. We also added some properties to the system to improve its overall performance. Properties are:
a. A timeout option of 60 seconds for each stage, after which the user will have to start all over again.
b. For the first stage, the minimum number of boxes for pattern creation is 9.
c. The maximum number of login attempts is 10.
d. The system logs the user out if inactive for 5 minutes.
e. Security questions ask about facts about the user. This makes it easier for the user to remember answers for security questions.
We also chose to make the system flexible by allowing the user to enable/disable authentication stages with two as the minimum number of stages as per the discussion above. Our proposed method uses variations of shared secrets, and aims to minimize the user effort, but thwart almost all types of attacks.



http://sendvid.com/p5peuwl8 Create account process

http://sendvid.com/i4d03tb0 Login process

 

[iamgenius]

Sorry i wrote that post quickly. I know that the proposed system is an overkill. Most people will not like it. A good defence will be to say that the system is targeted toward a sensitive application like those found in the military. But the actual goal is to come up with a system that balances security and usability.

I need to make it two stages at most with good security.

 

[John Connor]

Way too complicated. There are security USB tokens that are much easier to use and provide better two-factor authorization. I did like the virtual keyboard though.

Is your assignment to design a two-factor or multi-factor system?

 

[iamgenius]

Way too complicated. There are security USB tokens that are much easier to use and provide better two-factor authorization. I did like the virtual keyboard though.

Is your assignment to design a two-factor or multi-factor system?

Thanks for your reply John. I figured all will say it is too complicated. The assignment was to design a multi-factor (at least three) authentication system.

But, from reading too much on this subject, people will always demand the simplest of systems. That's how just people are. So, I would say two-factor authentication system is the best choice. Three is an overkill and will keep people away, and one of course is not enough. The 2nd factor is needed to complement security. So, what I intend to do is to modify this and make it two stages.

The virtual keyboard is to prevent against keyloggers.

Regarding the USB token: Yes I know about them, but the requirement is to make the system as scale-able as possible and inexpensive. I don't want to introduce an extra item to carry for the user and have him worry about losing it. That's the catch.

The first stage is my own innovative idea, so I want to keep it but it is in itself little complicated and cumbersome. So, I need to work on that.

I'll come later with more details.

If you know of a better place where I can post this and get nice replies, please suggest it to me.

Any comments are appreciated.

Thanks.

 

[TheRyuu]

Regarding the USB token: Yes I know about them, but the requirement is to make the system as scale-able as possible and inexpensive. I don't want to introduce an extra item to carry for the user and have him worry about losing it. That's the catch.

You can replace USB tokens with certs. This also qualifies as "something you have" if it's uniquely generated for each user then stored locally on their computer. This could be combined with another form of authentication such as TOTP[1] which is used by Google Authenticator on Andriod phones. Combined with something the user knows (a password) this could be considered multi-factor authentication. I don't really see a reason why the user has to enter something every time on their phone, this only has to be a one time setup and can generate codes itself (see TOTP[1] and possibly HOTP[2]).

I'm not sure if that qualifies as a true three factor authentication since this is technically one thing a user knows and two things a user has (and nothing the user "is", e.g. biometric).

[1] https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm
[2] https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm

 

[John Connor]

About Certs. I use the StartSSL service for encryption certs for my website's and when you log into StartSSL you have to provide a password to unlock the Cert in your browser. So that is one method.

About a USB token. Perhaps it could be a piece of software that only interacts with an IP address from a server and does an encrypted hand shake when you input a code given to you from the website. The token software could use a firewall like Peerblock that blocks all (blacklist) except the server IP it uses.

As to other forums, try this one: http://www.wilderssecurity.com/forums/general-topics.5/

 

[iamgenius]

You can replace USB tokens with certs. This also qualifies as "something you have" if it's uniquely generated for each user then stored locally on their computer. This could be combined with another form of authentication such as TOTP[1] which is used by Google Authenticator on Andriod phones. Combined with something the user knows (a password) this could be considered multi-factor authentication. I don't really see a reason why the user has to enter something every time on their phone, this only has to be a one time setup and can generate codes itself (see TOTP[1] and possibly HOTP[2]).

I'm not sure if that qualifies as a true three factor authentication since this is technically one thing a user knows and two things a user has (and nothing the user "is", e.g. biometric).

[1] https://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm
[2] https://en.wikipedia.org/wiki/HMAC-based_One-time_Password_Algorithm

Thanks for your reply. I'm reading the wikipedia pages now. The original assignment was to design a three factor authentication system, but that can change because I think the best choice is two factors. I know the factor types are three:

-Something you know
-Something you have
-Something you are

But for the authentication system you don't have to use one from each category. You can have more than one factor from one category. In fact, it was recommend to only use factors from the "something you know" category because the other two categories will require hardware and things can get expensive.

 

[TheRyuu]

About Certs. I use the StartSSL service for encryption certs for my website's and when you log into StartSSL you have to provide a password to unlock the Cert in your browser. So that is one method.

What we're talking about here isn't really related to certs that browsers use in the sense that we don't really have to concern ourselves with getting one from a CA. Also this is off topic but speaking of CA's Lets Encrypt[1] is a thing now if you want a free and valid ssl certificate.

Perhaps it could be a piece of software that only interacts with an IP address from a server and does an encrypted hand shake when you input a code given to you from the website. The token software could use a firewall like Peerblock that blocks all (blacklist) except the server IP it uses.

IP's can be spoofed. Also this is dependent on the fact that you have a static IP which many people don't have. Verification through a unique certificate would be easier and would actually be a valid form of authentication.

In fact, it was recommend to only use factors from the "something you know" category because the other two categories will require hardware and things can get expensive.

Well as I said "something you have" can also be certificates although this perhaps would be more vulnerable to "stealing" since it's technically not a physical device. But combined with something like Google Authenticator I suppose it could be considered to be more robust. Every little bit helps.

[1] https://letsencrypt.org/

 

[John Connor]

I know about Lets Encrypt. One of my website's uses it. Except in Cpanel they vist your page to issue the Cert and since I block HEAD it fails. Pretty lame they use a HEAD request.

No, the IP can't be spoofed. This would be the actual IP. So the software-based token only sends and receives on one IP, all others are blocked. It's not impossible.

 

[iamgenius]

Well, here is what I thought of. Please criticize it. I'll make it two stages.

The first stage will stay the same, but I will need to simplify its usability. Instead of inputting characters using a virtual keyboard which is cumbersome, I'll just have the user click on the desired square (box), but selecting the box will not change its color so observers from behind can't really gain any valuable information.

And for the 2nd stage, I'll create a new method.

The second stage utilizes the use of graphical passwords and some type of CAPTCHA mechanism. As of now, I only have a preliminary design. At the time of registration, the user will have to pick a preferred appearance from a list of appearances that will be appearing in photos at the time of login. Then, a certain number of photos containing the preferred item will be shown to the user in a specific order. The user will also have to define a click point in the photo square, so that he can select this certain photo. The photos will only be clickable if the user clicks in the pre-defined area plus some margin for human error. At the time of login, a grid with random photos will appear to the user. The user will have to select all photos containing his preferred item according to their priority, which was determined by the system. Assuming that each photo has a number from 1 to 6, the photo with the lower number will have to be selected first. Again, each photo can only be selected if the user clicks in the pre-defined click area using the computer mouse.

What do you think of it as an idea?

There is a problem that I already identified with this. An unintentional failed login attempt will generate new photos. The user preferred item will need to appear again....If an attacker does this several times, he will know the specific user's preferred item. I need to somehow fix that.

 

[iamgenius]

Well, here is what I thought of. Please criticize it. I'll make it two stages.

The first stage will stay the same, but I will need to simplify its usability. Instead of inputting characters using a virtual keyboard which is cumbersome, I'll just have the user click on the desired square (box), but selecting the box will not change its color so observers from behind can't really gain any valuable information.

And for the 2nd stage, I'll create a new method.

The second stage utilizes the use of graphical passwords and some type of CAPTCHA mechanism. As of now, I only have a preliminary design. At the time of registration, the user will have to pick a preferred appearance from a list of appearances that will be appearing in photos at the time of login. Then, a certain number of photos containing the preferred item will be shown to the user in a specific order. The user will also have to define a click point in the photo square, so that he can select this certain photo. The photos will only be clickable if the user clicks in the pre-defined area plus some margin for human error. At the time of login, a grid with random photos will appear to the user. The user will have to select all photos containing his preferred item according to their priority, which was determined by the system. Assuming that each photo has a number from 1 to 6, the photo with the lower number will have to be selected first. Again, each photo can only be selected if the user clicks in the pre-defined click area using the computer mouse.

What do you think of it as an idea?

There is a problem that I already identified with this. An unintentional failed login attempt will generate new photos. The user preferred item will need to appear again....If an attacker does this several times, he will know the specific user's preferred item. I need to somehow fix that.

Do you think utilizing CAPTCHA is any good? The original idea was that CAPTCHA will ensure a human is interacting with the PC and thus automated attacks can't be used. But then I thought that the attacker can use several attack methods. He can use automated attacks for some stages and use himself to get through the CAPTCHA portion. I'm now thinking CAPTCHA is not really providing any security.

Any body?

 

[iamgenius]

There is no easy and direct answer to this authentication problem. There will always be a trade off. That's what I think. Or better stated, I can say that the best we can do is to tailor complex highly secure authentication systems to critical applications and keep less secure and more practical systems for less critical systems. What do you think? I'm not sure really !

 

[sn8ke]

Do you think utilizing CAPTCHA is any good? The original idea was that CAPTCHA will ensure a human is interacting with the PC and thus automated attacks can't be used. But then I thought that the attacker can use several attack methods. He can use automated attacks for some stages and use himself to get through the CAPTCHA portion. I'm now thinking CAPTCHA is not really providing any security.

Any body?

Standard captcha is poor and annoying. The more advanced ones are a bit better and harder to crack, but not by much and at the price of readability/annoyance. That's why bigger companies stopped using them. No CAPTCHA ReCAPTCHA is better but requires using their services (security notes). I'm not sure of any FLOSS clones but something probably exists.

 

[TheRyuu]

Do you think utilizing CAPTCHA is any good? The original idea was that CAPTCHA will ensure a human is interacting with the PC and thus automated attacks can't be used. But then I thought that the attacker can use several attack methods. He can use automated attacks for some stages and use himself to get through the CAPTCHA portion. I'm now thinking CAPTCHA is not really providing any security.

Any body?

No it sounds like a terrible idea designed to annoy people more than anything.

If we're talking about a system which not that many people will be using then just generating unique keys for everybody would be the easiest way to tell who's legit and who's not. Anyone who doesn't have a valid signature can get easily dropped.

If we're talking about something which many people will be using then there are other ways of rate limiting login attempts that won't drive your users mad.

 

[iamgenius]

If we're talking about something which many people will be using then there are other ways of rate limiting login attempts that won't drive your users mad.

Which are what? Exactly?