Cybersecurity: Authentication & Authorization Systems 

1. AUTHENTICATION BASICS

Definition & Distinction

• Authentication: Verifying "who you are" (Identity Proof)

• Authorization: Determining "what you can access" (Permissions)

• Analogy: Authentication = Showing ID at club entrance; Authorization = Which VIP areas you can enter

Password-Based Authentication

DoS (Best Practices):

• Use strong password policies: Minimum 12+ characters, complexity requirements

• Implement password managers: Enable secure storage

• Regular security audits: Check for compromised passwords

• Provide user education: Teach password hygiene

• Offer password generators: Built-in tools for strong passwords

• Support copy-paste: Allow password manager pasting

Don'ts (Common Mistakes):

• No password length limits (beyond reasonable maximum)

• Don't enforce frequent password resets (NIST discourages this)

• Avoid complex character requirements that reduce memorability

• Never store passwords in plaintext

• Don't transmit passwords over unencrypted channels

• Avoid security questions with publicly available answers

Password Hashing

Purpose: Convert passwords to irreversible, fixed-length strings

Modern Algorithms:

bcrypt:

python

# Adaptive hash function
salt = generate_salt(12)  # 12 rounds (configurable)
hash = bcrypt.hashpw(password, salt)
# Automatically includes salt in output

Argon2 (Winner of Password Hashing Competition):

• Three variants:

  • Argon2d: Maximizes resistance to GPU attacks

  • Argon2i: Optimized for side-channel resistance

  • Argon2id: Hybrid (recommended default)

• Parameters: Time cost, memory cost, parallelism

• Memory-hard: Requires substantial RAM, deterring ASIC attacks

Comparison Table:

Multi-Factor Authentication (MFA)

Factors of Authentication:

1. Knowledge: Something you know (password, PIN)

2. Possession: Something you have (phone, security key)

3. Inherence: Something you are (fingerprint, face)

4. Location: Somewhere you are (geolocation)

5. Behavior: Something you do (typing pattern)

MFA Implementation Types:

• TOTP (Time-based One-Time Password): Google Authenticator, Authy

• SMS-based: Less secure (SIM swapping risk)

• Push notifications: Duo Security, Microsoft Authenticator

• Hardware tokens: Yubikey, Feitian

• Biometric: Fingerprint, facial recognition

2. MODERN AUTH SYSTEMS

JWT Authentication

Structure: Header.Payload.Signature

javascript

// Example JWT
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.  // Header (alg, typ)
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.  // Payload
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c  // Signature

Pros:

• Stateless: No server-side session storage

• Scalable: Easy horizontal scaling

• Decentralized: Self-contained token

• Flexible: Can contain custom claims

Cons:

• Token Size: Larger than session IDs

• Revocation Challenges: No built-in invalidation

• Security Risks: If stolen, valid until expiration

• Implementation Complexity: Easy to get wrong

Security Best Practices:

• Use strong algorithms (RS256 over HS256)

• Keep tokens short-lived

• Implement proper token refresh flow

• Store securely (HttpOnly cookies for web)

• Validate all token claims

OAuth 2.0 Flows

Four Main Grant Types:

1. Authorization Code Flow (Most Common):

text

User → Client → Auth Server → Consent → Code → Client exchanges Code for Token

• Use Case: Server-side web applications

• Security: Tokens never exposed to user agent

2. Authorization Code with PKCE (Proof Key for Code Exchange):

• For: Native/mobile apps, SPAs

• Prevents: Code interception attacks

• Process: Creates code_verifier/challenge

3. Client Credentials Flow:

• For: Machine-to-machine communication

• No user context: Service accounts

4. Resource Owner Password Credentials:

• Discouraged: Only for highly trusted applications

• Direct password handling: Increased risk

OpenID Connect (OIDC)

• Identity layer on top of OAuth 2.0

• Adds: ID Token (JWT), UserInfo endpoint

• Standardized claims: sub, email, profile, etc.

• Discovery endpoint: /.well-known/openid-configuration

3. AUTHORIZATION MODELS

Role-Based Access Control (RBAC)

text

User → Role → Permissions → Resources

Components:

• Users: Individual identities

• Roles: Job functions (Admin, Editor, Viewer)

• Permissions: CRUD operations on resources

• Sessions: Temporary role activation

Implementation Example:

sql

-- Database schema
Users (id, name)
Roles (id, role_name)
User_Roles (user_id, role_id)
Permissions (id, permission_name)
Role_Permissions (role_id, permission_id)

Limitations: Can't handle complex conditions ("Allow access if owner AND within business hours")

Attribute-Based Access Control (ABAC)

XACML Standard (eXtensible Access Control Markup Language):

• Subject: User attributes (department, clearance)

• Resource: Object attributes (sensitivity, owner)

• Action: Read, write, delete

• Environment: Context (time, location, threat level)

Policy Example:

json

{
  "policy": {
    "target": "allow",
    "condition": {
      "allOf": [
        {"user.department": "Finance"},
        {"resource.classification": "<= Secret"},
        {"action": "read"},
        {"time.between": ["09:00", "17:00"]}
      ]
    }
  }
}

Policy-Based Authorization

Popular Frameworks:

• AWS IAM: JSON policies with conditions

• Open Policy Agent (OPA): Rego language

• Casbin: Supports multiple models

OPA Example:

rego

package authz

default allow = false

allow {
    input.method == "GET"
    input.path == ["users", user_id]
    input.user == user_id
}

allow {
    input.method == "GET"
    input.path = ["reports", _]
    input.user_roles[_] == "manager"
}

4. ADVANCED TOPICS

Session Security Threats

Session Fixation:

• Attack: Attacker sets user's session ID before login

• Prevention: Issue new session ID after authentication

Session Hijacking:

• Methods: XSS, packet sniffing, MITM

• Protection:

  • Use HTTPS exclusively

  • HttpOnly and Secure cookie flags

  • Regular session rotation

  • IP/user-agent validation

Token Management

Expiration Strategies:

• Short-lived access tokens (15-60 minutes)

• Longer-lived refresh tokens (7-30 days)

• Sliding sessions: Extend on activity

Token Rotation:

javascript

// Refresh token rotation
POST /oauth/token
{
  "grant_type": "refresh_token",
  "refresh_token": "old_refresh_token",
  "client_id": "..."
}
// Response includes new refresh_token (one-time use)

Passwordless Authentication

Methods:

1. Magic Links: Email containing one-time login link

2. One-time codes: Sent via email/SMS

3. Biometric authentication: Face ID, Touch ID

4. Security keys: FIDO2/WebAuthn

Pros:

• No password management

• Better user experience

• Eliminates phishing for passwords

Cons:

• Dependency on second device/email

• Potential lockout scenarios

Biometrics & WebAuthn

Web Authentication API (WebAuthn):

• Standard: W3C recommendation

• Components:

  • Authenticator (hardware/software)

  • Relying Party (website)

  • Client (browser)

Registration Flow:

1. Server sends challenge + user info

2. Browser calls authenticator

3. Authenticator creates keypair, signs challenge

4. Public key sent to server for storage

Authentication Flow:

1. Server sends challenge

2. Authenticator signs with private key

3. Server verifies with stored public key

Security Properties:

• Phishing-resistant: Bound to origin

• No shared secrets: Public key cryptography

• User verification: Biometrics/PIN

• Attestation: Authenticator provenance

Implementation Example:

javascript

// Registration
const publicKeyCredential = await navigator.credentials.create({
  publicKey: {
    challenge: Uint8Array.from(randomString, c => c.charCodeAt(0)),
    rp: { name: "Example Corp" },
    user: {
      id: Uint8Array.from(userId, c => c.charCodeAt(0)),
      name: "user@example.com",
      displayName: "User"
    },
    pubKeyCredParams: [{alg: -7, type: "public-key"}]
  }
});

SECURITY BEST PRACTICES SUMMARY

1. Always use HTTPS for authentication traffic

2. Implement rate limiting on auth endpoints

3. Use secure, HTTP-only cookies for web sessions

4. Regularly update and patch auth libraries

5. Monitor and log authentication events

6. Conduct regular penetration testing

7. Follow principle of least privilege

8. Have account lockout policies (but not too aggressive)

9. Implement anomaly detection for suspicious logins

10. Keep audit trails for compliance and investigation

EMERGING TRENDS

1. Passwordless as default: FIDO2 adoption increasing

2. Decentralized identity: Blockchain-based self-sovereign identity

3. Continuous authentication: Behavioral biometrics

4. Zero Trust Architecture: "Never trust, always verify"

5. Quantum-resistant cryptography: Preparing for post-quantum era