What implementations are possible for dual control?

Question

An organization requires employees to use 2 person authentication in some scenarios. That is, when accessing, say, a server, secret knowledge from 2 people should be used for authentication. No one person should ever have access to the server alone.

Question: What implementations of this requirement are possible?

This is a Windows setup.

The only implementation I can think of is the following: 2 people both connect to the machine (say, remotely), first person enters first part of the password he knows, and the second person enters the second half.

Note: Not to be confused with two factor authentication.

Answer 1

One approach is to use temporary passwords, and a password management application. The process could work like:

1. An admin submits a request for access to a server for a particular time window
2. A separate admin approves this request
3. With the request approved, from the start of the time window the first admin can now access a temporary password for the server
4. The admin logs in as normal, using the temporary password
5. At the end of the time window, the temporary password is automatically reset to a new value

I have seen systems like this, but they all used some bespoke scripting, based on an existing request management system. I don't know anywhere you can just download such an application.

Of course, once the admin has the temporary password, they have single-handed access to the server. If you need the two-man rule the whole way - that there have to be two admins sat at one computer to perform the work - this approach won't work.

A variant on this I have seen is that a secure ID token is held by ops staff. When the admin needs to login to the server, they provide a password (that only they know) and also phone the ops desk to get the code from the secure ID token. I'm not convinced this arrangement is a good idea, but it does get used.

Answer 2

Two people with the same password (each knows a half) is not a good idea from a security perspective as each will have knowledge on the password. This would break by half their chances of guessing the other half with known attacks (brute-force, dictionary, ..).

I would suggest Shamir's Secret Sharing. Each person would have a password and only combining them would generate a shared secret. Both passwords have to be changed each time they're used tough.

Answer 3

In addition to @rda's mention Shamir Secret Sharing, or @paj28's idea of an out-of-band authorization mechanism, you can also consider a much simpler solution, that does not require a lot of coding or setup:

Use 2 factor authentication, giving each person a different factor.
E.g. you give a hardware token to one, and a password to the other. The advantage of this solution is that it can be directly applied even to Windows access quite simply. The weakness, of course, is the same as using a single factor anywhere - a hardware token with no password is usually trivial to be stolen. To counter this, there should still be another factor, e.g. there are some tokens that require a PIN (separate from the OS password).
Another similar solution, is for one to have the OS password, the other has the physical key (or biometric) to enter the data centre where the server is located. Or one has the password, the other is allowed through the firewall. Or OS user vs application user (and verify they match).

Most of these are pretty straightforward to set up, but possibly not as strong or as strict as Shamir. It really depends on the specific scenario and what requirements and constraints you have.