Protected logon to OS

Why do we need to log in to the operating system safely?

Nobody seems to ask this question nowadays. People are aware of difference between their own and someone else's things at the age of three. As soon as you see the difference, you begin treating your belongings very carefully ("Don't take MY toys!"), and you can hardly hide your interest in other people's things (we do not feel like giving any examples with this respect now). Thus, we do not have to wage a campaign for using simple authentication techniques when logging in to your operating system (when you are to enter your login and password): this is simple, and you feel protected.

Is there any use in relying upon this feeling?

This question is less unambiguous.

If the identification/authentication program works as a part of the OS, it will run when you logged in to the OS, and you can see it running only then. The program prompts for your identifier (login) and password. You enter the required verification data, the program checks them and if they are OK, your profile is logged in. Can the procedures described above ensure any reliable protection? The answer is most probably "No." To make sure of this, let us consider the following probable option.

The program prompts for your identifier (login) and password. You enter the required verification data but the program hangs up. Is this probable? Of course, yes - this has happened to everyone quite often. What can you do in this case? To be sure, you will reboot and enter your login and password again. The verification will be probably successful, and you will be able to start using your computer. It is after a lapse of considerable time when you realize that the fault was not accidental. It turns out that an eavesdropper program actually prompted for your login and password: it imitated the password entry form, got it and then hanged your computer up imitating a random failure. Thus, intruders laid their hands on your password long ago, and your computer has recently been under their control. It is an unpleasant situation, isn't it?

Do you think it is difficult to create such an eavesdropper program? Not at all. Any second-year student can do this. This means your computer only seems to be protected, and imitation of verification procedures makes you feel safe in vain. They cannot protect you but in fact only help the intruders.

Meanwhile, the trusted startup regimen for the OS is a radical means against such attacks. This regimen provides for starting verification means based on a modification-protected device being independent of the computer PRIOR TO the startup of the operating system. However, such means are quite expensive and their application is not always appropriate taking into account the risks involved.

If you do not feel like spending much money but at the same time you need to protect your profile against intrusion, you can protect the OS entry using the SHIPKA PCDST without having to install the Trusted Startup Hardware Module. You can get access to the system in a very easy way: instead of the standard login and password entry window, you will be prompted to plug SHIPKA in and enter its PIN code.

This means that instead of unreliable OS authentication, which can be corrupted if an eavesdropper program is running, you are authenticated directly in SHIPKA. In this case, authentication is carried out in the processor, which is protected against any modifications, and this is SHIPKA that provides the system with the user login and password registered in his account.

Such a way to enter the OS cannot replace trusted startup but it is much safer that logging in based on your login and password only.

To log in to the system this way, you first need to run the Configuration of the Secure OS Entry program and perform a number of easy-to-follow procedures.

Thus, the program window is displayed. The User Registration tab is displayed by default.

 

At first you must select the particular SHIPKA device by clicking on the button in the right-hand corner of the taskbar. After you have selected the device, a message saying "Create a new database?" can appear. This means that no file for saving user data and data on the computers with authorization has been created in the SHIPKA device yet.

In this case, you need to create the database and then register a user (or users if there is more than one profile on your computer).

Click on the Register a User with SHIPKA PCDST icon in the menu (this is the second left-hand icon featuring a PC and plus sign on the taskbar). A window where you can select a name of the user already registered with the OS user database and enter his/her password will be displayed.

The secure OS entry configuration program provides for the possibility to register several "username - computer ID" accounts within one SHIPKA device. However, this does not mean that anyone but you needs to be registered with your SHIPKA PCDST.

At the same time, if you use several computers you can configure secure system entry using your SHIPKA on each of them. You will not have to remember different passwords and logins. SHIPKA determines automatically to which computer it has been plugged in, and will find your authentication data for your account on the computer.

To activate the secure entry subsystem, click on the Install button in the OS Entry Configuration tab.

 

The installation procedure is completed by the message reading "System installation completed successfully," and then the Configuration button becomes active.

 

Now you can configure how the OS must respond if SHIPKA is disconnected in the course of its operation.

For example, you can block the screen and keyboard so that you could resume the operation mode as soon as you reconnect SHIPKA and enter your PIN code. Or you can turn off the computer after a specified time interval as soon as the SHIPKA device is unplugged.

You need to reboot the computer after the secure entry system has been installed and configured. When the OS is logged in, plug in the SHIPKA device and enter your PIN code.

Advantages of this OS entry technique vs. regular identification/authentication procedure built in the Windows OS by default are obvious. First, this is the so-called "second authentication factor," i. e. when the user needs to produce something else except for the password. As a rule, some object can serve as "something else" (like an amulet cut down in two parts). There are many systems providing for two-factor authentication now, and all of them are very popular. This is logical. However, this is not the only advantage of using SHIPKA to log in to the system. In fact, it is SHIPKA that enters the password in this system instead of the user, and it does so only when its processor has authenticated the user in a secure way (that is based on its hardware). It is impossible to build in any eavesdropper program in SHIPKA.

It is quite easy to understand how to use this function of SHIPKA PCDST. At the same time, it is necessary to take into account quite a great number of things to configure it. Please read the appropriate section in the User Manual prior to using the software. Do not rely on its intuitive interface!