NETWORK AND INFORMATION SECURITY (316317)
Unit - II User Authentication and Access Control
2.1 Identification and Authentication Methods
In computer and information security, Identification and Authentication are the
first and most important steps in controlling access to systems and resources.
Before granting access to any system, it is necessary to identify who the user is
and then verify whether the user is genuine.
• Identification answers the question: “Who are you?”
• Authentication answers the question: “How do you prove it?”
Together, identification and authentication ensure that only authorized users are
allowed to access systems, data, and services. Weak authentication mechanisms
can lead to unauthorized access, data theft, and system misuse.
❖ Electronic User Authentication
Electronic User Authentication is the process of verifying the identity of a user
through electronic means before allowing access to a computer system, network,
or application. It uses digital credentials such as passwords, biometric data,
tokens, or certificates.
In electronic authentication, a user provides authentication information, which is
checked against stored credentials in the system. If the credentials match, access
is granted; otherwise, access is denied.
Electronic authentication is widely used in:
• Online banking
• Email services
• College ERP systems
• E-commerce websites
Electronic user authentication helps in ensuring confidentiality, integrity, and
accountability by preventing unauthorized access.
❖ User Name and Password Authentication
User name and password authentication is the most common and traditional
authentication method. In this method, each user is assigned a unique user name
for identification and a password for authentication.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
The username identifies the user, while the password acts as a secret known only
to the user. During login, the entered password is compared with the stored
password (usually in encrypted or hashed form). If both match, the user is
authenticated.
To improve security, strong password policies such as minimum length,
complexity, and regular password changes are required.
➢ Advantages
• Easy to implement
• Low cost
• Widely supported
➢ Limitations
• Weak passwords can be guessed
• Vulnerable to phishing and brute-force attacks
• Users often reuse passwords
❖ Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA) is an authentication method that requires two
or more independent authentication factors to verify a user’s identity. It provides
stronger security compared to single-factor authentication.
➢ Authentication factors are classified into three categories:
1. Something you know – Password, PIN
2. Something you have – Smart card, OTP, mobile phone
3. Something you are – Biometrics (fingerprint, face, iris)
In MFA, even if one factor is compromised, unauthorized access is prevented
because the attacker cannot provide the other factors.
➢ Examples
• ATM card + PIN
• Password + OTP sent to mobile
• Fingerprint + password
MFA is widely used in banking, cloud services, and enterprise systems
because it significantly reduces the risk of unauthorized access.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
❖ Token-Based Authentication
Token-Based Authentication is a method in which a user is authenticated using a
physical or digital token instead of (or in addition to) a password. A token is
something the user possesses and must present to gain access.
➢ Tokens can be:
• Hardware tokens – Smart cards, USB tokens, key fobs
• Software tokens – Mobile apps generating OTPs
In this method, the system verifies the token information, such as a one-time
password (OTP) or digital certificate. Since tokens generate dynamic values,
they are more secure than static passwords.
➢ Advantages
• Difficult to duplicate
• Protects against password theft
• Strong authentication
➢ Limitations
• Token can be lost or stolen
• Additional cost
• Requires token management
Token-based authentication is commonly used in corporate networks, VPN
access, and secure online services.
2.2 Password Attacks
Passwords are the most commonly used authentication mechanism in computer
systems. They protect user accounts, systems, networks, and sensitive data.
However, passwords are also one of the weakest security mechanisms because
users often choose weak passwords or fail to protect them properly.
A password attack is any method used by an attacker to obtain or bypass a user’s
password in order to gain unauthorized access to a system. Password attacks may
be technical (using software tools) or non-technical (using human behavior and
carelessness).
Common password attacks include guessing passwords, piggybacking, shoulder
surfing, and dumpster diving.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
❖ Guessing Password
Password guessing is one of the simplest and most common password attacks. In
this attack, the attacker tries to guess the user’s password based on commonly
used words, personal information, or predictable patterns. Many users choose
weak passwords such as their name, date of birth, mobile number, or simple
words like “admin” or “123456”.
Attackers may attempt password guessing manually or by using automated tools
that try multiple combinations. If the system does not limit login attempts, the
attacker can eventually guess the correct password.
➢ Password guessing attacks are successful mainly due to:
• Weak passwords
• Short passwords
• Reuse of passwords
• Lack of account lockout policies
This attack compromises authentication and confidentiality and may lead to data
theft, account misuse, and identity theft.
➢ Prevention:
Strong passwords, account lockout mechanisms, and multi-factor authentication
help prevent password guessing attacks.
❖ Piggybacking
Piggybacking is a type of password or access-related attack where an
unauthorized person gains access to a system or secure area by following an
authorized user. Instead of breaking passwords technically, the attacker takes
advantage of human trust and carelessness.
In physical security, piggybacking occurs when an attacker enters a restricted area
by following an authorized person through a secure door. In computer systems,
piggybacking may occur when an attacker uses a system that is already logged in
by a legitimate user.
For example, if a user logs into a system and leaves it unattended, another person
may use the same system without authentication. Piggybacking violates
authentication and accountability because the system cannot distinguish between
the legitimate user and the attacker.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
➢ Prevention:
Users should always log out of systems when not in use, avoid sharing access,
and follow strict access control policies.
❖ Shoulder Surfing
Shoulder surfing is a password attack in which an attacker observes the user
while they are entering their password. The attacker may watch directly over the
user’s shoulder or use tools such as cameras, mobile phones, or binoculars to
capture the password.
This attack is very common in public places such as cyber cafés, ATMs, railway
stations, and offices. Shoulder surfing does not require technical skills; it relies
entirely on visual observation.
Once the attacker obtains the password, they can access the user’s account and
misuse the information. Shoulder surfing mainly affects confidentiality and
authentication.
Prevention:
Users should cover the keyboard while typing passwords, avoid logging in from
public places, and use privacy screens or biometric authentication.
❖ Dumpster Diving
Dumpster diving is a non-technical password attack where attackers search
through trash or discarded materials to find sensitive information. Many users and
organizations throw away documents without destroying them properly.
Attackers may find:
• Written passwords
• Old login slips
• Printed emails
• Sticky notes with credentials
• System configuration details
Dumpster diving exploits careless disposal of information rather than system
vulnerabilities. Once attackers obtain credentials, they can easily access systems
without detection.
Dumpster diving compromises confidentiality and privacy and is commonly used
as a preparatory step for larger attacks.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
➢ Prevention:
Sensitive documents should be shredded, passwords should never be written
down, and proper data disposal policies must be followed.
2.3 Biometrics
Biometrics is an authentication method that identifies and verifies individuals
based on their unique physical or behavioural characteristics. Unlike traditional
authentication methods such as passwords or tokens, biometric characteristics are
inherent to the user and are difficult to copy, forget, or share.
Biometric authentication is widely used in security systems, smartphones,
banking, attendance systems, airports, and government applications. It provides
stronger security because biometric traits are unique for every individual.
Biometric systems mainly support authentication, accountability, and non-
repudiation.
Biometric characteristics are broadly classified into:
• Physiological biometrics (physical traits)
• Behavioural biometrics (behaviour-based traits)
➢ Advantages of Biometrics
• High security
• Difficult to forge or steal
• No need to remember passwords
• Provides non-repudiation
• Convenient for users
➢ Limitations of Biometrics
• Privacy concerns
• High initial cost
• False acceptance or rejection
• Cannot be changed if compromised
• Environmental and physical factors may affect accuracy
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
❖ Fingerprints
Fingerprint recognition is one of the most widely used biometric authentication
methods. It is based on the unique patterns of ridges and valleys present on a
person’s fingertip. No two individuals, even identical twins, have the same
fingerprints.
In fingerprint authentication, a scanner captures the fingerprint image and extracts
features such as ridge endings and bifurcations. These features are compared with
stored templates in the database. If a match is found, the user is authenticated.
Fingerprint biometrics are commonly used in smartphones, attendance systems,
access control systems, and banking applications. They provide high accuracy,
are easy to use, and require minimal user effort. However, fingerprints can
sometimes be affected by dirt, cuts, or aging.
❖ Hand Prints
Hand print or hand geometry recognition measures the shape, size, and structure
of the human hand. It analyses features such as finger length, finger width, palm
size, and overall hand shape.
Hand geometry systems use a scanner to capture the hand image and compare the
measurements with stored data. This method is reliable for access control systems
where moderate security is required.
Hand print biometrics are less detailed than fingerprint recognition but are stable
over time and easy to use. However, they are not suitable for very high-security
environments because hand geometry may be similar among different
individuals.
❖ Retina Scan Patterns
Retina scanning is a highly secure biometric technique that identifies individuals
based on the unique pattern of blood vessels in the retina of the eye. The retina
pattern is extremely difficult to forge and remains stable throughout a person’s
life.
In this method, a low-intensity infrared light is directed into the eye to capture the
retina pattern. The captured pattern is compared with stored templates for
authentication.
Retina scanning offers very high accuracy and security and is used in military,
research laboratories, and high-security installations. However, it is expensive,
intrusive, and may cause discomfort to users, limiting its widespread use.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
❖ Voice Patterns (Voice Recognition)
Voice recognition is a behavioural biometric method that authenticates users
based on their voice characteristics, such as pitch, tone, frequency, and speaking
style. Every individual has a unique voice pattern due to differences in vocal tract
structure.
Voice authentication systems record the user’s voice and analyze these features
for verification. This method is widely used in call centres, phone banking, and
virtual assistants.
Voice biometrics are convenient and user-friendly but may be affected by
background noise, illness, or voice changes. There is also a risk of voice recording
attacks if additional security measures are not used.
❖ Face Recognition
Face recognition is a biometric technique that identifies individuals based on
facial features such as the distance between eyes, nose shape, jawline, and facial
structure. It uses cameras and image processing algorithms to capture and analyze
facial images.
Face recognition systems compare the captured image with stored facial
templates. This method is widely used in mobile phones, surveillance systems,
airports, and social media platforms.
Face recognition is non-intrusive and easy to use. However, its accuracy can be
affected by lighting conditions, facial expressions, aging, and disguises.
❖ Signature and Writing Patterns
Signature and writing pattern recognition is a behavioral biometric method that
analyzes the way a person signs or writes, rather than the final shape of the
signature. It considers factors such as speed, pressure, stroke order, and rhythm.
This method is commonly used in banking, legal documents, and digital signing
systems. Since writing behavior is unique to each individual, it provides good
authentication.
However, writing patterns may vary due to stress, illness, or emotional state,
which can affect accuracy.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
❖ Keystroke
Keystroke is a behavioural biometric technique that authenticates users based on
their typing behaviour. It analyzes factors such as typing speed, key press
duration, and time intervals between keystrokes.
This method works silently in the background and does not require additional
hardware. It is often used as a continuous authentication method to monitor users
after login.
Keystroke biometrics enhance security by detecting unusual typing behavior,
which may indicate unauthorized access. However, accuracy may vary due to
fatigue or changes in typing habits.
2.4 Authorization
Authorization is a fundamental concept in computer and information security that
determines what an authenticated user is allowed to do within a system. After a
user is successfully identified and authenticated, authorization decides the level
of access granted to that user. In simple words, authorization answers the
question:
“What actions is the user permitted to perform?”
While authentication verifies the identity of a user, authorization controls access
to resources such as files, databases, applications, network services, and system
functions. Authorization ensures that users can access only those resources that
are necessary for their role or responsibility.
For example, in a college system, a student may be authorized to view results but
not modify them, while a teacher may be authorized to enter marks. This control
prevents misuse of system resources and protects sensitive information.
Authorization is implemented using access control policies, permissions, and
roles, and it plays a crucial role in maintaining confidentiality, integrity, and
accountability.
➢ Need for Authorization
Authorization is required because not all users should have the same level of
access. In an organization, users have different roles such as administrators, staff,
students, or guests. Granting unrestricted access to all users can lead to data
misuse, accidental damage, or security breaches.
➢ Authorization helps in:
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
• Preventing unauthorized actions
• Limiting access to sensitive data
• Reducing internal security threats
• Enforcing organizational security policies
Without proper authorization, even authenticated users may misuse system
resources either intentionally or accidentally.
➢ Importance of Authorization in Security
Authorization is essential because:
• It limits damage caused by compromised accounts
• It protects critical system resources
• It enforces security policies
• It supports secure access control
Without authorization, authentication alone is insufficient to protect systems.
❖ Goals of Authorization
1. Controlled Access
Controlled access means ensuring that only authorized users are allowed to access
specific systems, data, or resources. Not every user in an organization should have
unrestricted access to all information. Authorization mechanisms control who can
access what, when, and how.
For example, in a college system, students may be allowed to view their results,
but they are not allowed to modify marks. Controlled access helps in reducing
security risks, preventing accidental damage, and maintaining confidentiality. It
ensures that access is granted strictly according to predefined rules and
permissions.
2. Protection of Resources
One of the main goals of authorization is the protection of system resources such
as files, databases, applications, servers, and network services. Resources are
valuable assets, and unauthorized access to them can result in data theft, data loss,
or system failure.
Authorization ensures that sensitive resources are protected from unauthorized
users by assigning appropriate permissions. For example, confidential files may
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
be accessible only to managers or administrators. By protecting resources,
authorization helps maintain data confidentiality, integrity, and availability.
3. Least Privilege
The principle of least privilege states that a user should be given only the
minimum access rights required to perform their job and nothing more. This
principle reduces the risk of misuse, whether accidental or intentional.
If a user account is compromised, limited privileges reduce the damage that an
attacker can cause. For example, a student account should not have administrative
rights. Least privilege is one of the most effective ways to improve system
security and minimize internal threats.
4. Role-Based Access
Role-Based Access Control (RBAC) assigns permissions to users based on their
roles within an organization, rather than on an individual basis. A role represents
a job function such as student, teacher, clerk, or administrator.
When a user is assigned a role, they automatically receive all permissions
associated with that role. This simplifies access management and ensures
consistency. Role-based access improves efficiency, reduces errors, and makes
authorization easier to manage in large organizations.
5. Accountability
Accountability ensures that every action performed in a system can be traced back
to a specific authorized user. Authorization plays an important role in
accountability by clearly defining who is allowed to perform which actions.
When users have unique identities and defined permissions, system logs can
record their activities accurately. Accountability helps in detecting misuse,
investigating security incidents, and enforcing discipline. It also discourages
users from performing unauthorized actions.
6. Policy Enforcement
Authorization helps in enforcing organizational security policies by translating
rules and guidelines into access control mechanisms. Security policies define how
information should be accessed, used, and protected.
For example, a policy may state that only authorized staff can access financial
records. Authorization ensures that such policies are implemented practically
through permissions and roles. This helps organizations comply with legal,
regulatory, and internal security requirements.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
7. Prevention of Misuse
Another important goal of authorization is the prevention of misuse of systems
and data. Misuse can be intentional (malicious actions) or unintentional
(accidental deletion or modification).
By restricting access and defining clear permissions, authorization prevents users
from performing actions beyond their responsibility. This reduces insider threats,
accidental errors, and unauthorized system changes, thereby improving overall
system security.
2.5 Access Controls
Access control is a fundamental concept in computer and information security
that ensures only authorized users can access specific resources in a system.
Access control decides who can access what resources and what actions they are
allowed to perform. These resources may include files, databases, applications,
systems, and network services.
Access control works in coordination with identification, authentication, and
authorization. First, a user is identified, then authenticated, and finally granted
access based on predefined access control rules. Proper access control is essential
to protect sensitive information, prevent misuse, and maintain system security.
➢ Definition of Access Control
Access control is the process of regulating and restricting access to system
resources based on a user’s identity, role, or attributes. It ensures that users can
perform only permitted actions on authorized resources.
In simple words, access control answers:
Who can access which resource and what can they do with it?
❖ Authentication Mechanism in Access Control
An authentication mechanism is used to verify the identity of a user before access
is granted. Authentication ensures that the user requesting access is genuine.
➢ Common authentication mechanisms include:
• User name and password
• Biometrics (fingerprint, face recognition)
• Tokens (smart cards, OTPs)
• Multi-factor authentication
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
Authentication is a prerequisite for access control. Without authentication, access
control cannot be applied effectively because the system cannot determine who
the user is.
❖ Access Control Principles
1. Least Privilege
Users should be given only the minimum access rights required to perform their
tasks. This reduces the risk of damage if an account is compromised.
2. Separation of Duties
Critical tasks are divided among multiple users to prevent misuse. No single user
should have complete control over a sensitive process.
3. Need-to-Know
Users are granted access only to the information that they genuinely need. This
principle protects sensitive data.
4. Accountability
All actions performed by users should be traceable through logs and audit trails.
❖ Access Rights and Permissions
Access rights and permissions define the actions a user is allowed to perform on
a resource. These actions typically include:
• Read
• Write
• Modify
• Delete
• Execute
Permissions are assigned to users or roles to control access to resources. Proper
management of access rights prevents unauthorized data access and accidental
system damage.
❖ Access Control Policies
An access control policy is a set of rules that defines how access is granted,
controlled, and enforced. Different access control policies are used depending
on the security requirements of an organization.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
➢ Importance of Access Control
Access control is important because it:
• Protects sensitive data
• Prevents unauthorized access
• Reduces insider threats
• Supports accountability
• Enforces security policies
1. Discretionary Access Control (DAC)
Discretionary Access Control is an access control policy in which the owner of a
resource has full authority to decide who can access it and what type of access is
allowed. The system does not enforce strict global rules; instead, decisions are
made at the discretion of individual users.
In DAC, permissions can be granted, modified, or revoked by the resource owner
at any time. This model is simple and flexible but can be vulnerable to misuse if
users grant permissions carelessly. DAC is commonly used in general-purpose
operating systems.
In DAC, access rights are based on user identity, and the resource owner has full
control over granting or revoking permissions.
Example:
A file owner allows other users to read or edit their file.
➢ Advantages:
• Flexible
• Easy to implement
➢ Disadvantages:
• Less secure
• Prone to misuse
2. Mandatory Access Control (MAC)
Mandatory Access Control is a highly secure and centralized access control policy
where access decisions are made strictly by the system based on predefined
security rules. Users and resource owners cannot change access permissions.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
In MAC, every user and resource is assigned a security label (such as confidential,
secret, top secret). Access is granted only if the user’s clearance level matches the
resource’s classification. This model provides strong security and is widely used
in military and government environments.
Users cannot change access permissions in MAC systems.
Example:
Military or government systems where classified data is accessed based on
clearance levels.
➢ Advantages:
• High security
• Strong control
➢ Disadvantages:
• Complex
• Less flexible
MAC is used in high-security environments.
3. Role-Based Access Control (RBAC)
Role-Based Access Control assigns access permissions based on the role
assigned to a user within an organization, rather than on individual identity.
Roles are created according to job responsibilities, and users inherit permissions
from their roles.
RBAC simplifies administration, reduces errors, and improves security by
following the principle of least privilege. It is ideal for large organizations where
many users share similar responsibilities.
➢ Advantages:
• Easy to manage
• Scalable
• Reduces administrative effort
RBAC is widely used in enterprise systems, colleges, and organizations.
Subject Teacher: Prof. D. B. Mahankale
NETWORK AND INFORMATION SECURITY (316317)
4. Attribute-Based Access Control (ABAC)
Attribute-Based Access Control is a dynamic and flexible access control policy
where access decisions are based on a combination of attributes related to the
user, resource, action, and environment.
Attributes may include user department, job title, time of access, location, device
type, or security status. ABAC allows fine-grained control and is suitable for
modern systems such as cloud computing and distributed environments.
➢ Attributes may include:
• User department
• Time of access
• Location
• Device type
Example:
Allow access only if the user is from the finance department and accessing during
office hours.
➢ Advantages:
• Highly flexible
• Fine-grained control
➢ Disadvantages:
• Complex to implement
• Requires policy management
ABAC is used in cloud computing and modern systems.
Subject Teacher: Prof. D. B. Mahankale