Kerberos Authentication in Network Security

 

Kerberos Authentication

Kerberos is a network authentication protocol used to verify the identity of users and systems before access to network resources is provided.

It uses secret-key cryptography and a trusted third party, called the Key Distribution Center (KDC), to perform authentication. The important feature is that the user's password is not sent directly across the network.

Kerberos was developed at MIT (Massachusetts Institute of Technology) and provides secure login along with Single Sign-On (SSO).

(Kerberos in Greek mythology: Kerberos is a multi-headed dog that guards the gates of the underworld. The name is used for the authentication system because it acts as a guard for network resources.)


Why Kerberos is Needed?
Normal Client–Server Login Before Kerberos

In a traditional client-server login:

        Username + Password

Client ------------------------> Server
        <------------------------
          Access Granted / Denied

The client sends the username and password directly to the server.

Problems

  • The password travels through the network.
  • An attacker may capture the login message.
  • The captured information may be reused for unauthorized access.
  • There is no Single Sign-On (SSO).
  • The user may need to log in separately for different services.

Kerberos addresses these problems by using authentication tickets instead of repeatedly sending the password across the network. 


Components of Kerberos
Kerberos mainly consists of the following components.

1. Client
The client is the user or system that requests access to a network service.

2. Application Server
The Application Server is the server that provides the required network service.

3. Key Distribution Center (KDC)
The KDC is a trusted third party responsible for authentication.
It contains two important servers:

Authentication Server (AS)
The Authentication Server verifies the identity of the user.

Ticket Granting Server (TGS)
The Ticket Granting Server issues service tickets that allow the client to access particular services.


Kerberos Process
Kerberos Process


Step 1 – Login Request
The client sends the username to the Authentication Server (AS).
The password is not sent over the network.

Step 2 – AS Verification
The AS checks the username in the KDC database where passwords are stored in encrypted form.

Step 3 – AS Response
After successful verification, the AS sends two important pieces of information:

  1. Ticket Granting Ticket (TGT) encrypted with the TGS key.
  2. TGS Session Key encrypted using a key derived from the user's password. 
Step 4 – Client Decryption
  • The client uses the user's password to obtain the TGS session key.
  • The client can use the TGS session key without decrypting the TGT.
  • The TGT remains protected because it is encrypted with the TGS's secret key.

Step 5 – Request to TGS
The client sends the TGT and an authenticator to the Ticket Granting Server (TGS).

The authenticator contains information such as:
  • Client ID / username
  • Client address
  • Current timestamp

The authenticator is encrypted using the TGS session key.


Step 6 – TGS Verification
The TGS decrypts and verifies the TGT and authenticator.
After successful verification, the TGS generates a service ticket for the requested application server.

Step 7 – Service Ticket Issued
The TGS sends the service ticket to the client along with the required service session key.

Step 8 – Access Service
  • The client sends the service ticket and required authentication information to the application server.
  • The application server verifies the ticket.
If the ticket is valid, access to the requested service is granted.
Client ───── Service Ticket ─────> Application Server
Client <──── Access Granted ───── Application Server


Advantages of Kerberos
  • Strong authentication security
  • Password is not transmitted over the network
  • Supports Single Sign-On (SSO)
  • Provides secure communication between authenticated entities
  • Uses a trusted authentication server
  • Uses tickets for accessing network services 
Limitations of Kerberos
  • Depends on a central KDC server.
  • Implementation can be complex.
  • Proper configuration and management are required.
  • Availability of the authentication infrastructure is important.


Handwritten Notes-Download PDF

Video Explanation-Watch on YouTube


Comments

Post a Comment

Popular posts from this blog

B+ Tree in DBMS | B+ Tree in Data Structure

    B+  Tree A B+ Tree is a self-balancing multi-way search tree   All leaf nodes are present at the same level . Actual data records are stored only in the leaf nodes . Internal nodes contain only search keys . It is mainly used for efficient searching and sequential access . B+ Tree supports efficient range queries . Structure of B+ Tree Consider a B+ Tree node containing keys and children: Number of Keys Number of Children 1 2 2 3 3 4 In general, Number of children = Number of keys + 1 The leaf nodes are connected sequentially using links( Linked List ). Rules of B+ Tree For a B+ Tree of order m : At most: A node can have at most m children . A node can contain at most m − 1 keys. At least: An internal node must have at least [ m/2 ] children . An internal node must contain at least [ m/2 ] − 1 keys . Insertion...
Read more

Hashing in Data Structure | Collision Resolution Techniques | Hashing in DBMS

  Hashing in DBMS Hashing is a technique used to map data elements (keys) to specific locations in a hash table using a hash function. It allows insertion and retrieval of data efficiently     Hash Function A hash function converts a key into a hash code (index) , which is used to store and retrieve the data from a hash table.                                 h(k)=k mod m Where: k → Key m → Hash table size h(k) → Hash index  Hash Table A hash table is a data structure that stores data in an array format . Each position in the table is called a bucket , and the position is accessed using the hash function. Example Consider Keys                   (k) = 11, 18, 20, 25, 29, 33 Hash table size (m) = 7 Hash function:    h(k)=k mod m                     ...
Read more

Normalization in DBMS,(1NF,2NF,3NF,BCNF,4NF,5NF)

                      Normalization in DBMS Normalization divides a large table into smaller , logically related tables and connects them using appropriate keys. The main purpose of normalization is to reduce unnecessary duplication of data and prevent problems that may occur when data is inserted, updated, or deleted. 1. First Normal Form (1NF) A relation is said to be in First Normal Form (1NF) when every attribute contains a single, indivisible value . Conditions of   1 NF Each cell must contain only one value. Multiple values should not be stored in the same field. ·         Example Customer Items Purchased Gowsi Rice, Dal Tamil Soap ·   Here, the Items Purchased column contains more than one value for Gowsi . ·   Therefore, the table is not in 1 NF . Converting it into 1NF. ...
Read more