Authentication

Authentication is part of the core of security. An entity claims something, a property or an identity, authentication is about verifying or rejecting any such claim. We will discuss three aspects of authentication: user-to-machine (and user-to-user), machine-to-user, machine-to-machine. For user authentication we will start with the traditional something you know, something you have and something you are and then look beyond.

Videos

You'll watch the videos through FeedbackFruits. This way you can ask questions and start discussions during the videos. You’ll post anonymously (which is kind of ironic considering the topic is authentication). [Sonja adds: you should be able to log into FeedbackFruits using your KTH credentials, by Sign by clicking on "inloggningsaltervativ" and then type in kth.se when asked for the organization's domain, then you can just log in with your regular ug.kth.se account. selecting Microsoft Teams as the login option. Then you don't have to create an extra account. Soon there should be an integration between FBF and Canvas at KTH, but probably not in time for this course.]

The slides are available here.

Links to the videos:

Intro to authentication: FeedbackFruits
Bootstrapping authentication: FeedbackFruits
User-to-machine authentication: FeedbackFruits
“Something you know”: FeedbackFruits
“Something you have”: FeedbackFruits
Machine-to-user authentication: FeedbackFruits

Reading

Chapter 2 in Anderson (2008) (FeedbackFruits) (note 2nd edition).
Chapter 15 in Anderson (2008) (FeedbackFruits) (biometrics).
Electronic Identities Need Private Credentials

Additional reading

References

Anderson, Ross J. 2008. Security Engineering: A Guide to Building Dependable Distributed Systems. 2nd ed. Indianapolis, IN: Wiley. http://www.cl.cam.ac.uk/~rja14/book.html.

Gollmann, Dieter. 2011. Computer Security. 3rd ed. Chichester, West Sussex, U.K.: Wiley.

Access control

Once you have authenticated users you can support access control — and this is also one of the main reasons to authenticate them in the first place. Access control aims at controlling who may access what and how they may access it. There are different models and ways to implement access control. Here we will give an overview of the possibilities.