Implementación de una autoridad de certificación para la autenticación fuerte de los usuarios ante una base de datos de información académica.

Abstract

Its important to preserve suspiciously a basedate, because of the information it can store, as: private dates, student’s grades, register of approved or reproved subjects, among other informations. Due to this, problems that an organization could have, if it doesn’t offer a safety security for preserving this basedate that not only can be legal, or else it can affect its image in the face of the society, since its information could not be reliable. The method of authentication user/password can be a solution, but this one is a weak authentication, since the password and the user can be guessed, moreover it can be found assault for brute force or be captured eading the packages, if the comunication is not coded or using keylogger2 . Use a method of strong authentication, involving two or more factors ofauthentication (something you know, something you have, something that is), allowsto provide greater security and difficult work to the attackers. The University of Pamplona used authentication username/password to access academic information of students, so that the system can be compromised through various types of attacks. This project creates an infrastructure of public key (PKI) in order to implement a strong authentication method, using digital certificates, to access a database of academic information. The PKI is made up of: an authority record (RA) which is responsible for registering students (users) in the system, generate certificate requests and issuing them with smart card with your keys and certificate users, protected by a PIN (Personal identification number); an authority of certification (CA) that receives requests for certificates of RA and binds the public key of each student with their identity through the digital signature of the digital certificates. Also responsible for revoking certificates; a validation authority (VA) which is responsible for verifying whether the certificates are valid (they have not been revoked or they have not expired); and the entities end (EE) who are students or users of the system who to authenticate to the database of academic information should enter the PIN of your card and verify possession of your password private, properly responding to a challenge, although this process is transparent to users. A database of academic information, with basic functionality to verify successful access to this after the two factor authentication was simulated. In addition the same evidence that the current system of the University of Pamplona not resist, as they were Sniffing, spoofing, identity theft and even to the author then be implemented system-wide not can violate its own authentication system, which gives understanding, that can increase the security with respect to the authentication of the traditional, such as those used by our alma mater; the safety tests were the great pillar for this project, but... What if we have more robust system with a disastrous performance? It would be a feasible implementation, therefore all software was created to evaluate its performance under this condition to a point ofstress outcomes were favorable with times of 8.78 seconds to create a key pair in asmart card the very promising and even times of reading were even lower approximately 2,528 seconds to access the contents of a smart card where everything is internally coded except the public area, this adding to the high level of usability given evidence where a group of 3 people with basic knowledge of computing were able management of all software on average in 1.19 seconds this due to the use offeatures images to the function and easy access to all functions.