IDENTIFICATION AND AUTHENTICATION

Аннотация

One of the most common authentication schemes is simple authentication, which is based on the use of traditional multi-factor passwords. The procedure for simple authentication of a user on a network can be imagined as follows. A user trying to use the network types his or her ID and password on a computer keyboard. Key words: network, DES algorithm, authentication, time synchronization, one- time password-based authentication, Security. A matching record is found in the database for the user ID stored on the authentication server, the password is found and compared with the password entered by the user. If they match, authentication is considered successful and the user receives the legal (legal) status and the rights defined for his status through the authorization system and permission to use network resources. A simple authentication scheme using a password is shown in Figure 1. Obviously, the authentication option by transmitting the user's password without encryption does not guarantee even a minimal level of security. To protect the password, it is necessary to encrypt it before transmitting it over an unprotected channel. For this, the scheme includes encryption E and decryption D tools. These k k tools are controlled by a shared secret key K. User authentication is based on comparing the password P sent by the user with the initial value P stored on the authentication A A server. If the values P and P match, the password P is considered valid, and the user A A A A is considered legitimate. Authentication server Figure 1. Simple authentication using a password. Simple authentication schemes are distinguished not only by the transmission of passwords, but also by the types of their storage and verification. The most common method is the method of storing user passwords in system files, in the open state. In https://scientific-jl.com 8 46-son_3-to’plam_Iyun -2025 ISSN:3030-3621 Ta'lim innovatsiyasi va integratsiyasi this case, read and write protection attributes are set for the files (for example, by specifying the appropriate privileges in the operating system access control list). The system compares the password entered by the user with the record stored in the password file. This method does not use cryptographic mechanisms such as encryption or one-way functions. The disadvantage of this method is the possibility of an attacker with administrator privileges in the system, as well as system files, including password files. From a security point of view, it is convenient to transmit and store passwords using one-way functions. In this case, instead of the open form of the password, the user must send its image, obtained using the one-way function h(.). This modification guarantees that the adversary cannot reveal the password through its image, since the adversary faces an insoluble numerical problem. Simple authentication systems based on multi-factor passwords have low resilience, since the authentication information in them is collected from a relatively small set of meaningful words. The validity period of multi-factor passwords should be determined by the organization's security policy, and such passwords should be changed regularly. Passwords should be chosen so that they are not in the dictionary and are difficult to guess. In authentication based on one-time passwords, different passwords are used for each request. A dynamic one-time password is only valid for one use in the system. Even if someone intercepts it, the password is useless. Typically, an authentication system based on one-time passwords is used to verify remote users. One-time password generation can be implemented using hardware or software. Hardware devices based on one-time passwords are miniature devices with a microprocessor installed on the outside, similar to payment plastic cards. Such cards, usually called keys, have a keyboard and a small display window. The following methods of using one-time passwords for user authentication are known: 1. Using a timestamp mechanism based on a uniform time system. 2. Using a list of random passwords common to the legal user and the verifier and a reliable synchronization mechanism for them. 3. Using a pseudorandom number generator with the same initial value common to the user and the verifier. An example of the first method is the SecurID authentication technology. This technology was developed by SecurityDynamics and is implemented on the servers of a number of companies, in particular, CiscoSystems. The authentication scheme using time synchronization is based on an algorithm for generating random numbers after a certain time interval. The authentication scheme uses the following two parameters: a secret key, which is a unique 64-bit number assigned to each user and stored on the authentication server and on the user's hardware key; the current time value. When a remote user tries to use the network, he is prompted to enter a personal identification https://scientific-jl.com 9