Advance Authentication Techniques

Published on 2 weeks ago | Categories: Documents | Downloads: 0 | Comments: 0 | Views: 2
of x
Download PDF   Embed   Report

Comments

Content

 

A Seminar on

Advance Web Authentication Prepared By, Hardik K. Molia 130030702007 M.E. – III C.E. A.I..S. !a"ko#

 

(ontent 1 – Introduction to Authentication 2 – Google Authenticator - TOTP 3 – How TOTP Work! " – Introduction to OAuth # – OAuth Protocol $low % – &e'erence

 

1) Introduction to Authentication

A$#%en#i&a#ion'–  A$#%en#i&a#ion i( #%e pro&e(( o) de#erminin* +%e#%er (omeone or (ome#%in* i(, in )a&#, +%o or +%a# i# i( de&lared #o e. •



  %e pro&e(( o) iden#i)yin* an indi-id$al, $($ally a(ed on proo).   PA Card, /ri-in* i&en(e, Si*na#$re, Mark (%ee#(



and many more.

 r$(#   r$(# a&#or' a&#or'– –   Bank( don# #r$(# &$(#omer( (o #%ey a(k )or PA &ard, /ri-in* i&en(e, !e(iden#ial proo) e#&. •

 





1) Introduction to Authentication

A$#%en#i&a#ion'–   Kno+led*e a&#or a&#or  4%a# a $(er kno+(





 Pa((+ord,  Pa((+or d, Se&$ri#y 5$e(#ion 5$e( #ion an(+er

  6+ner(% 6+ner(%ip ip a&#or  4%a# a $(er o+n(





 /ei# &ard, Hard+are #oken(

  In%eren&e a&#or a&#or  4%a# a $(er i(





 in*er prin#, a&e re&o*ni#ion

 +o   +o a&#or a&#or A$#%en#i&a#ion'– A$#%en#i&a#ion'–

  Comina#ion o) #+o o) #%e ao-e )a&#or(.





 AM A$#%en#i&a#ion  /ei# Card 8 PI



 /ei# Card i( 6+ner(%ip a&#or



 PI i( Kno+led*e a&#or

 

2) Google Authenticator - TOTP   E9#endin* #%e &on&ep# o)



6P.   So)# oken a( a(ed ed moi moile le app.   o addi#ional %ard+ar %ard+are. e.   o In#erne# re5$iremen#.   o SMS : Call.   ; /i*i#( &ode -alid )or 30 <(ername 8 Pa((+ord  Kno+led* Kno+led*e e a&#or (e&ond(. Moile 8 PreS%ared key  6+ner(%ip a&#or •









HMAC Ba(ed 6P  H6P ' Mo-in* )a&#or i( e-en# &o$n#er  ime   ime Ba(ed 6P  6P ' Mo-in* )a&#or i( (y(#em da#e #ime

 

3) How TOTP Work!   <(er Poin# o) =ie+'   <(er Crea#e( an a&&o$n# +i#% $(ername and





pa((+ord.   <(er *e#( a PreS%ared Key >PSK? dire&#ly a( +ell a( in @! ar&ode.   <(er en#er( key or (&an @! ar&ode )rom oo*le A$#%en#i&a#or.   A ;/i*i# ;/i*i# &ode *e#( *enera#ed *enera#ed e-ery 30 (e&ond(. (e&ond(. •





 

3) How TOTP Work!  e&%ni&al Poin# o) =ie+'



 /a#eime in moile p%one  /a#eime in +e (er-er m$(# e (yn& a# (ome e9#en#.  Ser-er per)orm( #%e (ame &al&$la#ion )or -alida#ion. •



 6P   HM HMACSHA ACSHA1 1 >PSK, C/? D Mod 1000000   SHA1 prod$& prod$&e( e( 12 i#( Ha(% &ode.   PSK  /a#a  Pr Pre e S%ared Key a# #%e #ime o) a&&o$n a&&o$n## (e#$p. •





  C/  Co$n#e Co$n#err  C$rren# /a#e  ime   Mod #o *enera#e ; di*i#( &ode



 



3) How TOTP Work!  PSK'



 0Bi#( key a(ed on Ba(e 32 en&odin*.  1; C%ara&#er( ea&% o) F Bi#(.  >AG?>2;?  >27?>;? (o o#al 32 C%ara&#er( in (e#.









 Similar lookin* (ymol( are no# $(ed. 0,1, +i#% 6,I,B  Code L

*

1

2

3

"

#

%

+

SymolL

A

B

C

/

E





H

, I

 

1* K

11 

12 M

13 

1" 6

1# P

1%

1+

1,

1

2*

21

22

23

@

!

S



<

=

4



2"  J

2# G

2% 2

2+ 3

2, 

2 F

3* ;

31 7

 

3) How TOTP Work!  C/'



  !o$nd do+n #%e &$rren# #ime #o pre-io$( (e&ond( &omponen#.  i) #%e &$rren# #ime i( 0'00'07 0'00'07,, i# #ake( #%e #ime a( 0'00'00.. 0'00'00 I) #%e &$rren# #ime i( 0'00'31 0'00'31,, i# #ake( #%e #ime a( 0'00'30.. 0'00'30 •

 !epre(en# C$rren# /a#e and ime a( <ni9 #ime(#amp.



  >$mer o) elap(ed (e&ond( (in&e 1(#  an$ary 170? : 30.  6-erNo+ +ill e on 1#% an$ary 203. •



Ad-an#a*e('



 rree In(   In(#an #an## o nee need d o) In In#e #errne ne## or Ce Cell ll$la $larr e#+o e#+ork rk

•  

3) How TOTP Work! using System; using System.Text; using System.Security.Cryptography;

 

3) How TOTP Work!  public class demo demo {  public static string string GeneratePassword(string psk { !ateTime !ateTi me start " new !ateTime(#$%&' #' #' &' &' &; long dtalue " (long(!ateTime.)ow (long(!ateTime.)ow * start.T start.Tota otalSeconds lSeconds + ,&;

 

3) How TOTP Work!  public class demo demo {  public static string string GeneratePassword(string psk { !ateTime !ateTi me start " new !ateTime(#$%&' #' #' &' &' &; long dtalue " (long(!ateTime.)ow (long(!ateTime.)ow * start.T start.Tota otalSeconds lSeconds + ,&;  byte- cdt " /itConerter /itConerter.Get .Get/ytes(dtalue; /ytes(dtalue;  byte- key " 0ncoding.1SC22.Get/yte 0ncoding.1SC22.Get/ytes(psk; s(psk;

 

3) How TOTP Work!  public class demo demo {  public static string string GeneratePassword(string psk { !ateTime !ateTi me start " new !ateTime(#$%&' #' #' &' &' &; long dtalue " (long(!ateTime.)ow (long(!ateTime.)ow * start.T start.Tota otalSeconds lSeconds + ,&;  byte- cdt " /itConerter /itConerter.Get .Get/ytes(dtalue; /ytes(dtalue;  byte- key " 0ncoding.1SC22.Get/yte 0ncoding.1SC22.Get/ytes(psk; s(psk; 341CS31# hmac " new 341CS31#(key;  

byte- hash " hmac.Comput hmac.Compute3ash(cdt; e3ash(cdt;

 

3) How TOTP Work!  public class demo demo {  public static string string GeneratePassword(string psk { !ateTime !ateTi me start " new !ateTime(#$%&' #' #' &' &' &; long dtalue " (long(!ateTime.)ow (long(!ateTime.)ow * start.T start.Tota otalSeconds lSeconds + ,&;  byte- cdt " /itConerter /itConerter.Get .Get/ytes(dtalue; /ytes(dtalue;  byte- key " 0ncoding.1SC22.Get/yte 0ncoding.1SC22.Get/ytes(psk; s(psk; 341CS31# hmac " new 341CS31#(key;  

byte- hash " hmac.Comput hmac.Compute3ash(cdt; e3ash(cdt; ulong password " /itConerter.To /itConerter.To52nt67(hash'& 52nt67(hash'& 8 #&&&&&&; return password.ToString(new password.ToString(new string(9&9' 6;

:  

3) How TOTP Work! args  public static oid 4ain(String- args { Console.rite<ine(!ateTime.)ow; Console.rite<ine(GeneratePa Console.r ite<ine(GeneratePassword(=elisak>daacay ssword(=elisak>daacayar=; ar=; :

 

") Introduction to OAuth

4%a# i( 6A$#%'– A$#%en#i&a#e yo$r(el) +i#%o$# pro-idin* &reden#ial in)o.

 

") Introduction to OAuth

4i#%o$# 6A$#%'–

 

") Introduction to OAuth

4i#%o$# 6A$#%'– App( (#ore #%e $(erO( pa((+ord. •



App( *e# a&&e(( #o a&&o$n#.

a&omple#e $(erO(



<(er #o&an# a&&e(( an app re-oke e9&ep# y &%an*in* pa((+ord.

 

") Introduction to OAuth

4i#% 6A$#%'–

 

") Introduction to OAuth

4i#% 6A$#%'–

 

") Introduction to OAuth

6A$#% Componen#('– A$#%oria#i on Ser-er

B6B Clien#

Own

4an#( #o in#e*ra#e +i#% oo*le Ser-i&e( e.* Pi&a(a Own

!e(o$r& e 6+ner

Prin#a(#

Pi&a(a /a-id

!e(o$r& e Ser-er

 

#) OAuth Protocol $low

Authori.ation &e/uet Authori.ation Grant

Clien#

Authori.ation Grant Acce Token

!e(o$r&e 6+ner

A$#%oria#i on Ser-er

Acce Token Protected &eource

!e(o$r&e Ser-er

 

#) OAuth Protocol $low A$#%oria#ion !e5$e(#

A$#%oria#ion ran#

<! $(ed i( %##p'::pi&a(a.&om:Q&lien#Ridprin#)a(# (&opepr %##p'::pi&a(a.&om:Q&lien#Ridprin#)a(# (&opeprole,email,p%o#o( ole,email,p%o#o( redire&#R$ri%##p'::prin#)a(#.&om

 

#) OAuth Protocol $low Clien#RIdprin#)a(# prin#)a(# Clien#RId !edire&#R$rl  %##p'::prin#  %##p'::prin# )a(#.&om S&opeprole,email,p%o#o( S&ope prole,email,p%o#o( &ode  a(e3  a(e3

Clien#

!e(o$r&e 6+ner

/a-id

A$#%oria#i on Ser-er

Prin#a(# !e(o$r&e Ser-er

 

#) Oauth Protocol $low

!e(o$r&e 6+ner Clien#RIdprin#)a(# prin#)a(# Clien#RId &ode  a(e3  a(e3 Clien#

A&&e((R#oken  93e  93e

/a-id

A$#%oria#i on Ser-er

Prin#a(# !e(o$r&e Ser-er

 

#) OAuth Protocol $low

!e(o$r&e 6+ner

A$#%oria#i on Ser-er

Clien#

Prin#a(#

/a-id

 93e  93e A&&e((R#oken  !e(o$r&e(

!e(o$r&e Ser-er

 

#) OAuth Protocol $low Clien#RIdprin#)a(# Clien#RIdprin#)a(# !edire&#R$rl  %##p'::prin#  %##p'::prin# )a(#.&om S&opeprole,email,p%o#o( S&ope prole,email,p%o#o(  a(e3 &ode  a(e3

!e(o$r&e 6+ner

/a-id

Clien#RIdprin#)a(# Clien#RIdprin#)a(# &ode  a(e3  a(e3 Clien#

Prin#a(#

A&&e((R#oken  93e  93e

A$#%oria#i on Ser-er

 93e  93e A&&e((R#oken  !e(o$r&e(

!e(o$r&e Ser-er

 

%) &e'erence

Pro ASP.E 4e API Se&$ri#y Se&$rin* ASP.E 4e API By Badrinarayanan ak(%mira*%a-an  AP!ESS %##p'::oa$#%.ne# %##p'::oa$#%.ne#:&ore:1.0 %##p'::*ro$p(.*oo*le.&om:*ro$p:oa$#% %##p'::+iki.oa$#%.ne#

 

Thank 0ou

Sponsor Documents

Or use your account on DocShare.tips

Hide

Forgot your password?

Or register your new account on DocShare.tips

Hide

Lost your password? Please enter your email address. You will receive a link to create a new password.

Back to log-in

Close