Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any good methods for authenticating that a user is a maint engineer, or at least trusted enough to use the maint access? The environment is code that is running in client sites, without internet access, and runs for many years between visits.

Think of a vending machine as example, how do i know that you are from service company, OR are talking to service engineer who gives you the password? I want to stop you being able to use this password again weeks later, although again within next few hours is fine if it helps.

We currently use a long term password, so you login first (site security) and then enter maint password to jump to super mode. Only problem is once this password is known, we cannot really change it.

I am not after perfect security, only that users must be reasonably trusted to access the maint mode. I was thinking of some challenge/response, where the challenge question changes every 24hours or so, but if the code might need to store 10years (life of single release) of challenge/responses I'm wondering if this is really a good idea. We only have keyboards as authentication capture devices.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

I'd use some kind of HOTP-esque system - Event-based One Time Password. Think about the little RSA key fobs some people use with random numbers. You can either buy a bunch of them and give them to your engineers (they have to be programmed in to the machines, though), or set up some phone system for your engineers to call to get the OTP.

One issue is that you can't revoke stolen keys. If you give them to your engineers, and they lose it or leave and don't return it, they can still get in. If these systems have accurate (+/- 30 seconds from real time) clocks, you can get a time-based OTP system instead. Use the same 6-digit number code, but then your engineers can't stockpile a dozen numbers before they walk off the job with their company ID and those passcodes.

You can do this without the keyfobs. The downside is that, if anyone has access to the private key in the code, they can get into any machine anywhere. If you can compile it in, you're pretty set.

The HOTP or TOTP dongles can be purchased, or you can just use a Linux command to generate them at-will.

Simpler way

The simpler way is to have a random number generated by an algorithm. The number changes daily at a specific time. That way a newly non-employee or a stolen code couldn't be used for more than a day. You can actually use the HOTP example from above in this, using the HOTP method to generate the daily code and validate it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.