Image analysis – Applications – Personnel identification
Reexamination Certificate
1997-11-12
2001-02-06
Mehta, Bhavesh (Department: 2721)
Image analysis
Applications
Personnel identification
C382S125000, C382S100000, C713S186000
Reexamination Certificate
active
06185316
ABSTRACT:
FIELD OF THE INVENTION
The invention herein relates to a verification system and, in particular, to an apparatus and method for providing self-authentication of an image, and a computer program therefor.
BACKGROUND OF THE INVENTION
As the trend toward computer networking continues, the ability to verify the identity of system users with a high degree of accuracy becomes more important. Adequately secure systems deter, prevent, or detect unauthorized disclosure, modification, or use of information. Systems which cannot differentiate between requests for service by legitimate users and unauthorized access attempts are vulnerable to a variety of attacks.
In the past, it was relatively easy to protect computer systems because they were typically installed in a centralized computing facility. Because the terminals used to access the computer usually were in the same building, only those persons having physical access to the building would be able to use the terminals. However, as networked IT systems proliferate, this level of physical access control becoming much less feasible. The design of open computing systems permits access to more systems, thereby allowing access to legitimate users and intruders, alike.
Among the popular methods used by IT system intruders are:
Password cracking
Exploiting known security weaknesses
Network spoofing
“Social engineering”
Masquerade
Replay
Repudiation
Interception of data
Manipulation of messages
One of the most common techniques used to gain unauthorized system access involves password cracking and the exploitation of known security weaknesses. Password cracking is a technique used to surreptitiously gain system access by using another user's account, often because the other user selected a weak password, for example, one easily guessed, based on knowledge of the user (e.g. wife's maiden name) a password that is susceptible to dictionary attacks (i.e., a brute-force guessing of passwords using a dictionary as the source of guesses). Unauthorized system access can be gained through the exploitation of known security weaknesses, such as system configuration errors, and security bugs.
In network spoofing, a system presents itself to the network as though it were a different system, for example, by presenting the other system's address as its own. In “social engineering,” an intruder may call a system operator, pretending to be some authority figure, and demand that a password be changed to allow them access.
Masquerade refers to users representing themselves as other users. Replay of data can be accomplished by recording the authentication data and playing it back at the whim of the intruder. If a user denies sending (or receiving) a communication, the communication has been repudiated. Passive eavesdropping on communications is a simple, but effective, form of data interception. Messages can be manipulated through unauthorized insertions, deletions, or modifications to messages. Clearly, some techniques, when implemented, can be indistinguishable from others, but the effect of these methods is undeniable—compromised computer security.
Users may be able to access network-connected computers from any physical location on the network, indeed from anywhere around the world, and the logical connection which supports a session between the user and a given computer may travel through many communications circuits, each subject to intrusion by the above methods. The increasing level of interconnection between computer systems has made it possible to distribute and process information far more easily than in the past. However, it has also become significantly more difficult to identify system users based on physical location, because the pathway between a user and the computing resources accessed by that user may be impossible to trace. One key process in determining the identity of a user, or claimant, is that of authentication.
Authentication is the verification of the true identity of a user. It is of such fundamental importance in IT systems that the DoD Computer Security Center standard, “Department of Defense Trusted Computer System Evaluation Criteria” (CSC-STD-001-83, August 1983) states: “Without authentication, user identification has no credibility. Without a credible identity (no) security policies can be properly invoked because there is no assurance that proper authorizations can be made.” Authentication, then, is essential to the proper use of IT systems handling sensitive data.
The three generally-accepted categories of methods for authenticating a user's identity are based on: (1) something the user knows, such as a password; (2) something the user possesses, such as an authentication token; or (3) some physical characteristic of the user, such as a fingerprint or voice pattern. Collectively, these are called credentials. Authentication systems can be hardware, software, or procedural mechanisms that enable a user to obtain access to computing resources. At the simplest level, the system administrator who adds new user accounts to the system is part of the system authentication mechanism. More sophisticated solutions can use fingerprint readers or retinal scanners to establish a potential user's identity. Without establishing and proving a user's identity prior to establishing a session, an IT system is vulnerable to any sort of attack.
Traditionally, users have been individually supplied with a secret password, which they must submit when requesting access to a particular system. The majority of computer systems in use today rely solely on passwords for authentication. The primary advantage of password-only authentication is that it can be implemented entirely in software, thus avoiding the cost of special purpose authentication hardware. However, password-only systems have a number of disadvantages in practice which restrict their use to applications with minimal security requirements, or situations where password management can be strictly controlled. Suitable secret information often cannot easily be remembered by a human. It may consist, for example, of from 56 to 1024 bits, or an even longer length, of randomly generated material.
A password is a sequence of characters obtained by a selection or generation process from a set of acceptable passwords. A good password system has a very large set of acceptable passwords in order to prevent an unauthorized person (or intruder) from determining a valid password in some way other than learning it from an authorized person (i.e., owner). The set of acceptable passwords should be large enough to assure protection against searching and testing threats to the password, commensurate with the value of the data or resources that are being protected. The set of acceptable passwords must be such that it can be specified easily, that acceptable passwords can be generated or selected easily, that a valid password can be remembered, can be stored reasonably, and can be entered easily.
Broadly stated, the security provided by a password depends on its composition, its length, and its protection from disclosure and substitution during storage and transmission. Composition is defined as the set of characters which may comprise a valid password. The composition of a password depends in part on the device from which the password is going to be entered.
Length is closely associated with composition in assessing the potential security of a password system against an intruder willing to try exhaustively all possible passwords. The length of a password provides bounds on the potential security of a system. The potential number of valid passwords is proportional to the number of characters in the acceptable composition set, raised to the power of the length of the password. The potential number of passwords in a credentialing scheme with a composition of 10 digits and a length of exactly 4 provides for 10
4
or 10,000 possible passwords, ignoring any other limiting factors.
Increasing these parameters would be expected to have a positive effect on the overall security of the syst
Adornato Rocco L.
Mehta Bhavesh
Starr Mark T.
Unisys Corporation
LandOfFree
Self-authentication apparatus and method does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Self-authentication apparatus and method, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Self-authentication apparatus and method will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2603945