Home
Search
Login
<mosaic.cnfolio.com>
Technology Exploration Project – M591

Profiting From Third Party Innovation


Technology has come a long way from when man was still trying to figure out how to start a fire with two stones. It is man’s creative spirit that drives him to innovative ideas. These ideas then turn into products or services that we see and use in our everyday lives. Although there are people who develop products that can be freely available for the majority these are for profiting purposes. As part of the process of maximising profits one must also protect their ideas or inventions from possible infringers. In doing so, in most cases this mean patenting your ideas and inventions.

As a people we have become more concern with security in many forms be it personal, we have seen many a company push products that claim to protect our confidential information whilst we make transactions over public networks. These products that are being marketed to us were but a mere idea in someone’s head before they were turned into something tangible. Products such as CyberSafe’s TrustBroker is based on Kerberos and RSA SecurID not only offers piece of mind but also actually does what the box says it does. These products play a major role in our everyday lives even without us realising it. Being that these products were once just an idea, and in realising how such an idea would affect our lives the inventors had to have these idea patented.

A patent (Pressman, David, 2006, pg 10) is a grant from the federal government that gives an inventor the right to exclude others from making, using, selling, importing, and offering an invention for sale for a fixed period of time. As inventions are forms of property and these can also be seen as investments and so they must be protected, and patenting is this just another way of protecting your property. Patents can take up to 24 months to process and cost starting from around £400 (UPO, 2007), for big companies this is a small price to pay for something that may net them millions in future. Patent rights also last up to 20 years depending on the type of patent filed.

Both TrustBroker and SecurID use patented tools, some of which are patented by other companies. Permission has to be granted in order to use an idea set out in a patent filed by another inventor as using it without the inventor’s permission would constitute infringement on the rights of the inventor and the inventor would have every right to seek damages. Permission can be sought in various ways or a company can wait until the patent expires or they could buy the patent out right. If feasible for the company a patent can be bought and depending on the type of technology patented and its market value this can extend to millions of pounds.

TrustBroker Kerberos Implementation


TrustBroker is a commercial Kerberos implementation of the popular open source authentication protocol that is known as Kerberos. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Kerberos is a complicated system that can offer protection against many network attacks and vulnerabilities and also provides a plethora of mechanisms for doing so. It provides ways of mutual authentication between two parties such as a client and a server way before the communication connection is established or opened between the two parties. The protocol assumes the path of communication or network is not secure and that it may be susceptible to eavesdropping.

TrustBrokeris a Kerberos implementation that was produced by CyberSafe Corporation when the original Kerberos version was not available outside of the USA. It can be hosted on UNIX platforms and also on Microsoft Windows NT/2000 Servers. It has been written to support Kerberos based authentication as well as Public Key encryption. TrustBroker uses Kerberos which is a copyrighted software but as Kerberos was submitted to the Open Source Foundation the licence to use the software states that “Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation file (the “software”), to deal in the software without restriction, including limitation the rights to use, copy, modify, merge, publish, distribute, sublicence, and/or sell copies of the software, and to permit persons to whom the software furnished to do so, subject to the condition that the copyright notice and this permission notice be included in all portions of the software(OSI, 2006) produced as a result of the use of Kerberos software.

The software deals with issues of authenticating users of a network whereby the user’s password never needs to go over the network. It uses electronic tickets that are encrypted over the network. The user is then authenticated by a central server called a KDC (Key Distribution Center), which also issues a ticket that allows the user to access the network and the services available. Below is a tutorial courtesy of Learn Networking (Learning Networking, n.d) showing how Kerberos works:


Photo caption



1. - The authentication service, or AS, receives the request by the client and verifies that the client is indeed the computer it claims to be. This is usually just a simple database lookup of the user’s ID.

Photo caption

2. - Upon verification, a timestamp is created. This puts the current time in a user session, along with an expiration date. The default expiration date of a timestamp is 8 hours. The encryption key is then created. The timestamp ensures that when 8 hours is up, the encryption key is useless. (This is used to make sure a hacker doesn’t intercept the data, and try to crack the key. Almost all keys are able to be cracked, but it will take a lot longer than 8 hours to do so)

Photo caption


3. - The key is sent back to the client in the form of a ticket-granting ticket, or TGT. This is a simple ticket that is issued by the authentication service. It is used for authenticating the client for future reference.

Photo caption

4. - The client submits the ticket-granting ticket to the ticket-granting server, or TGS, to get authenticated.

5. - The TGS creates an encrypted key with a timestamp, and grants the client a service ticket.


Photo caption


6. - The client decrypts the ticket, tells the TGS it has done so, and then sends its own encrypted key to the service.


Photo caption


7. - The service decrypts the key, and makes sure the timestamp is still valid. If it is, the service contacts the key distribution center to receive a session that is returned to the client.

8. - The client decrypts the ticket. If the keys are still valid, communication is initiated between client and server.

The client is authenticated until the session expires. Kerberos uses symmetric-key algorithm and some versions also use a public key cryptography. Wikipedia describes symmetric-key algorithm as a class of algorithms for cryptography that use trivially related, often identical, cryptographic keys for both decryption key, in that they may be identical or there is a simple transform to go between the two keys. The keys in practice represent a shared secret between two or more parties that can be used to maintain a private information link (Wikipedia, n.d a). Through the use of symmetrical encryption it means that when a message is sent between the two communicating parties the message can only be decrypted by the key used to encrypt the message this is because the keys are only visible or known to the two parties which allows for secure transit of information across the communicating path. In Kerberos the trusted third part is what is referred to the KDC hence why keys are only known to the users and the KDC. A KDC (Wikipedia, n.d b) is part of a cryptosystem intended to reduce the risks inherent in exchanging keys. A cryptosystem is a suite of algorithms used to put forms of encryption and decryption in place with sending data between systems.

As CyberSafe uses freely available software they can choose how to implement their version. With so many different kinds of Kerberos implementation on the market and with each one implementation having its own suite of algorithms in the KDC this has contributed to the interoperability issues between various implementations of the authentication protocol. In solving these issues “”TrustBroker”” implements many algorithms in its cryptosystem. These include the use of DES (Data Encryption Standards), 3DES (Triple DES) and AES (Advanced Encryption Standards), MD5, SHA-1 to name a few in providing detection and prevention of unauthorised reading of messages. These standards are all patented and were invented by companies outside of CyberSafe.

With the Kerberos software being open source created by MIT and IBM on a joint project. Also with IBM being the inventors on the DES standard when Kerberos was forfeited to the public domain so was the patented DES standard with which the DES patent expired when CyberSafetook on the project to offer a Kerberos outside the USA. As patents cannot be renewed once these expired they are usually offered to the public with terms and conditions. One such patent is the DES patent that was filed on February 24th, 1975 and was issued sixteen months later on June 8, 1996. As the patent would be in the public domain before the patent is officially issued, meaning that the inventor would not have patent rights as the patent would be pending. But as IBM has published the ideas behind the technology it meant that they could later seek royalties for infringement during the post-publication “pendency period”.

DES – Product Block Cipher System For Data Security


All patents being submitted to the US patent office or the European patent office have to follow a certain format or you risk being rejected. These rules extend to the type and size of paper to text sizes. The patent submitted will eventually become a legal document so it must be written clearly and be precise as all this contributes in making the claims about the invention clear to all reading the patent as well as the examiner on submission. The DES patent is no exception to the rule; patent number 3962539 is a detailed description of how DES operates in its implementation.

The patent is a full disclosure of how the product block cipher system for data security later known as the DES encryption method. It illustrates through schematics, diagrams and descriptions of how the data is ciphered using the proposed method and the series of well-defined steps that are followed in the DES procedure. As the DES was derived from Lucifer, one of the earliest block ciphers also patented by IBM this is also disclosed in the patent as all technologies similar to or building on to the one being submitted for examination have to be mentioned. The DES patent is technically detailed with all the operational functions of the ciphering because once a patent has been submitted to the patent office it cannot be added to. The patent abstract (Google, n.d a) states the following:

Below is an illustration provided in the patent :

Photo caption

Above is the original illustration of the diagrammatic workings of the ciphering. An enciphering process carried out in a series of 16 iterations in accordance with a product block cipher algorithm, which may defined in terms of a cipher function and key scheme function. Thus, in the enciphering process, if the 64-bit input message block consists of 32-bit block L and a 32-bit block R, then in the input message block maybe denoted by the term LR. Also, if the block of cipher key bit is chosen from a cipher key KEY, then the block of cipher bits it may be denoted by the term K. Therefore, for all iterations except the last, the output of an iteration with an input of LR may be denoted by the term L’R and may be defined as follows (Google, n.d a):

L’ = R
R’ = L xor f(R,K)

The criss-crossing in the diagram is referred to as the Fiestel structure. It is this structure that ensures identical or similar processes of decrypting and encrypting with the only difference being that the subkeys are applied in reverse order when decrypting (Wikipedia, n.d c). The rest of the algorithm is identical. This greatly simplifies implementation, particularly in hardware, as there is no need for separate encryption and decryption algorithms. The L-function and R-functions scrambles half a block together with some of the key. The output from the F-function is then combined with the other half of the block, and the halves are swapped before the next round. After the final round, the halves are not swapped; this is a feature of the Feistel structure which makes encryption and decryption similar processes. The patent goes into more detail about further steps in the expansion permutation of the 32-bit half block, key mixing, substitution as well as the algorithm for generating subkeys and calculations of parity bits. This scrambling of data is what ensures secure data is sent across a communication link.

RSA SecurID

Photo caption

SecurID is considered to be a two-factor authentication system. Authentication systems can be of single or multi-factor. An authentication factor is a piece of information used to authenticate or verify a person's identity for security purposes (Wikipedia, n.d d). SecurIDwas developed by RSA Security who were originally called Security Dynamics. With authentication systems falling into three different categories of something you know, something you are and something you have. As SecurID is token based, it falls in the last category, which involves carrying a physical token that can be seen as hard to forge. These tokens can take the form of a physical token or software token.

The physical token are typically small enough to carry and around. Each SecurID user on the network has a pin or password together with the token, which comes with an LCD screen. The LCD screen (RSA, 2007a) of the token displays a new pseudo-random value, called the tokencode, at a fixed time interval, usually one minute. The user combines the memorized factor with the tokencode, either by simple concatenation or entry on an optional keypad on the token, to create the passcode, which is then entered to gain access to the protected resource.

These tokens are have built in microcontrollers and provides “hacker resistant” authentication a designed that is meant to be tamper proof. They store current time and a 64 seed value that is unique to a particular secured token. This seed is the token’s factory-encoded random key. Using RSA’s proprietary algorithm the seed and time are combined at specific time intervals and then store on the on board microcontroller thus creating a tokencode value. The passcodes are authenticated on the SecurID network server, which maintains a database that records these seeds for each token together with their corresponding passwords and pin numbers.


To access resources protected by the RSA SecurID system, users simply combine their secret Personal Identification Numbers (PIN’s) (something they alone know) with the token codes generated by their authenticators (something they have). The result is a unique, one-time-use passcode that is used to positively identify, or authenticate, the user. If the code is validated by the RSA SecurID system, the user is granted access to the protected resource. If it is not recognized, the user is denied access (RSA, 2007b). There is not user maintenance on these tokens and come ready to use out of the box, which also which offers user and easy to use network security tool that does not require complicated installations.

RSA - Cryptographic Communications System and Method


SecurID uses the public key cryptography algorithm together with other RSA proprietary algorithms. RSA was developed by Ron Rivest, Adi Shamir, and Leonard Adleman at Massachusetts Institute of Technology (MIT). Originally developed by a mathematician Clifford Cock but as his work was not put forward in the public domain before RSA beat him to the patent office. The algorithm patent was filed under Cryptographic Communications System and Method in December 14, 1977 and was issued some six years later on September 20 1983 (patent number 4405829). The patent provides a detailed break down of how the technology was intended to work with illustrations of its working and testing results or expected operation and its potential contribution to secure transmission of data in communications systems.

The patent describes RSA as an algorithm that provides the ability to encode and decode a message using a ciphering message in doing so the technology uses both public and private keys in the encryption and decryption process. The algorithm was built to provide a system and method that provides private communications and providing privation transmission of signed messages across a network.

The patent states:


Below is an illustration submitted with the patent document, which illustrate the about patent details.

Photo caption

The patent although issued to MIT it was exclusively licensed to RSA Security who have since incorporated it in their products and have build on this technology to other patented two-factor authentication systems such as RSA BSAFE encryption and RSA Keon® public key management systems. The licence expired in 2000 and was offered to the public with set conditions such as those offered with the open licence. As the licence was exclusively given to RSA who were also the designers of the algorithm, it has still made a remarkable contribution to the industry as more than 800 global organisations have turned to use RSA based systems for their data encryption. (RSA, 2007c)


Marketing The Flaws In Good Light


Despite the increased research and development into computer security we have yet to see the “perfect” system in terms of secure data transmission technology. This may be due to the overall emphasis on the required speed of the technology, how much space it requires, the information required to operate it and so forth that when these are offset against the design the end result leaves a less than perfect system although fully functional yet with a few flaws.

Due to the data protection acts and other privacy laws, when designing such a system as those relating to authentication systems these can greatly hinder the design because of the restrictions they impose. Both patents covered are similar in that both are concerned with cryptography. These cryptography operations are incorporated into authentication system that in turn are used in authenticating user identity. This is where personal details might be used so these systems have to offer data integrity and confidentiality at the least.

With the argument that nothing or no one is perfect, then we have to allow for these shortcomings not just in people but in systems as well. Both the patents RSA and DES have weaknesses. RSA uses padding schemes, these are distinct practices that are used in cryptography to prevent predictability to find a sequence that would aid in breaking the encryption. These padding schemes are used in preventing the known and potential attacks on the RSA scheme such as the plaintext attack (Wikipedia, n.d e) where RSA encryption is a deterministic encryption algorithm an attacker can successfully launch a chosen plaintext attack against the cryptosystem, by encrypting likely plaintext under the public key and test if they are equal to the ciphertext. A crypto system is called semantically secure if an attacker cannot distinguish encryptions from each other even if the attacker knows (or has chosen) the corresponding plaintexts. As described above, RSA without padding is not semantically secure. This is why RSA without the padding is not as secure.

In the DES the possible weakness were seen early, which saw RSA in 1997 sponsoring (Wikipedia, n.d f) a contest and offering a sum of money for the first person to break the DES encryption. It was broken using a method of defeating the scheme by trying a large number of possibilities referred to a brute force attack. This was done to show that due to DES’s fixed length string of the plaintext bits was breakable, proving that DES was not secure. There are also other known attacks that were proven to be far quicker and efficient in breaking the system such as the differential cryptoanalysis (DC), linear cryptoanalysis (LC) and another known as the Davies attack. Without going into more detail it is just to show that both algorithms have weaknesses. It is these flaws, once discovered drive the improvements we see in many systems. These discovered flaws have lead to new mechanisms being incorporated in patching the security issues the pose.

In the case of Trustbroker, CyberSafe has added more algorithms to its implementation of the cryptosystem such as AES the successor of DES, MD5 and public key encryption RSA itself.Comparing the two cryptographies RSA is much slower than DES and other symmetric cryptosystems. For the overall system of “”SecurID””, even though the algorithm discussed is quite strong the tokens offer a level of protection against password replay attacks, they have other potential vulnerabilities such as man in the middle type of attacks which the Trustbroker system in vulnerable to. This is an attack where the attacker is able to manipulate the authentication data flow between the user and the server, the attacker will be able to forward this authentication information on the server themselves, effectively masquerading as the given user.

Trustbrokerhas drawbacks in that it has a single point of failure and requires continuous availability of a central server but this can be solved through the use of multiple Kerberos servers. This also does not help that the authentication protocol is not standardised as mention implementations differ from vendor to vendor.

The patents at the time of filling improved the authentication security measure in encrypting data to be transmitted over public networks but this was short lived as they were proven to have flaws which are constantly remedied through extensions and improvements of the same technology to offer variety and better execution of the system in providing secure and efficient and authentication system.

The purpose of both systems is to provide secure and transmitted data but privacy issues come into play about the type of information and how much of it is recorded and retained. With authentication being deployed as a well to control access to systems users have to be identified in one way or another. The two systems benefit the user in there is limited information requested from the user in order to access the system. The issues arise in both systems in that there is a record kept about the areas access by users to different areas of the network. This may be an issue with users in that their every move is recorded and breaches their privacy. With each and every company having a policy on the use of their networks this is just another way of enforcing these policies and as user tracking is usually built in on authentication system is can be used to identify misuse, and investigating breaches. Furthermore, the benefits offered are that the system provides a secure environment for all users and there is also that fact that transmitted data is private between a particular send and receiver offering privacy in communication but not privacy in turns of tracking of these transactions. This is show where (Kent, Stephen, 2003) law makers and courts have recognised that along with protecting the privacy of communications, laws also need to provide for law enforcement access to confidential information where necessary, consistent with basic protection rights. Debates over the appropreciate balance between individual privacy interests and law enforcements power revolve around the proposition that increasingly powerful technologies demand increasingly strong privacy protections which means new protections will be needed for future technology advancements.

These products have seen fierce marketing strategies that seem to offer the best thing since sliced bread and present a system that is flawless but as we have read these systems come with a few flaws tucked away if not implemented properly. The marketing for the Trustbroker is one where CyberSafe presents their implementation that offers an interoperable authentication system. With the problems seen in the past where different implementations of Kerberos had different encryption methods proved to be difficult in communicating with other system which bridges the gap between heterogeneous networks or operating system environments. This is done through the variety features offered such as the well know encryption algorithms used on the cryptosystem as well having there implementation compatible with Microsoft product which are commonly used by many an organisation. With the release of RSA in 2000 saw CyberSafe adding that to the list of methods used in their implementation. The company introduced a package that, for the first time, will let companies combine two leading authentication technologies - Kerberos and public-key encryption - to check user identities and control access to network resources. With CyberSafe's Unix- and Windows NT-based TrustBrokerSecurity Suite, companies can keep existing Kerberos systems intact and roll out new Kerberos systems while embracing public-key technology (Messmer, Ellen, 2003). There marketing strategy is to show to everyone that not only are they overing something that is secure but that they are right at the centre of ensuring continous improvements on network security systems that can work with something a company might already have.

RSA’s marketing strategy is simple as they are responsible for the very invention of an algorithm that has proved powerful in providing strong data encryption for so many organisations. The strategy plays on the words “two- factor” authentication with the publication stating that its is based on something you know (a password or PIN) and something you have (an authenticator)—providing a much more reliable level of user authentication than reusable passwords. This is so as to represent a system that is “immune” to password replay attack. In selling a product mean you have to put it in the best possible light.

The Reasoning Behind The Protection of Ideas.


With the level of detail that have to be disclosed in patents, even though you are disclosing this information in the public domain without knowing if the patent will be accepted means your ideas are no longer secret. There is a benefit to patenting ideas rather than having the idea as a trade secret, like it was mentioned in the case of the RSA patent if Clifford had disclosed his ideas he would have claimed the rights and reaped the benefits enjoyed by the RSA Security today. Furthermore it has been shown that the systems discussed had weaknesses and have since been upgraded but with today’s increased speed in technology advancements means that what we consider a strong authentication system today may not only be obsolete in a few years but compared to future upgrades they may not be seen as strong by future standards.

Clearly, having a patented technology does not mean the system that incorporates the patented technology is any stronger or better as the technology it self patent as shown may have flaws that may be damaging to part or all of the intended purpose of the system being designed. The advantages of having a patented technology is that is offer back up to the design idea in that it may strength the system should the chosen addition prove to enhance the design and implemention of the authentication system in our case here. Also patenting a system does not mean that the system be claimed is strong is just states the invention and knowing the system and its weakness means knowing it vulnerabilities. It is these vulnerabilities that bring us new ideas, new advancement and technologies, which keeps many business running and many customers happy on many levels.

References



Page revised 2007-12-03 06:49 • ©2012 University of Portsmouth • This website uses wikkawiki.org software.