Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
FIT1093/2093 Assignment
Submission Guidelines & Tasks
Guidelines Details
• Deadline: Assignment 2 submission is due in Week 12 on 20 May 2024
at 09:30am Melbourne, Australia time (CL Campus) and 20 May 2024 at
09:30am Malaysia time (MA Campus). This Task is an individual (not
group) work and it must be submitted by each student individually.
• Submission Platform: Electronic submission via the `Assignment 2
Submission’ link on the Moodle Assessments page (an Ed
announcement will be sent once the link is added).
• Required Files: Required data and numerical parameter files for the
assignment will be available for download via the Moodle `Asg 2 Moodle
Quiz’ link.
• Submission File Format: Two PDF documents: one for Task 1 and one
for Task 2. There will also be an interview in week 12 Applied Session.
• Submission Page Limit: Each submitted PDF document must be at
most 10 pages, excluding cover page and references. Any
screenshots that cannot fit in the main 10 pages can be placed in an
Appendix (which does not count in the page limit).
• Plagiarism: It is an academic requirement that your submitted work be
original. Zero marks will be awarded for the whole submission if there is
any evidence of copying, collaboration, pasting from web sites, or
copying from textbooks.
• Use of Generative AI tools: ChatGPT or other AI tools may be used for
study purposes, to learn about your topic, and to develop your
assignment. However, similar to citation requirements for other
references, you must include a clear declaration of all generative AI tools
used (e.g. ChatGPT, DALL-E, Grammarly, voice-to-text), how and where
you have used them. Please follow the Monash guidelines on how to
acknowledge the use of Generative AI.
Notes
● For each question, you need to answer both the computation result
question and the explanation questions about your working process such
as the source code or the commands you are using to solve the tasks.
● Note that if numbers in this assignment are specified in hexadecimal
format, your written answer and many software packages expect
hexadecimal numbers to be input a ‘0x’ prefix (e.g. ’0xa0b1c2d3’) for
indicating the hexadecimal format. For example, this prefix allows
SageMath to interpret the value in hex.
Background
Multiple factor authentication, usually a combination of biometric and password
authentication factors, is widely used today to verify the identity of a user attempting to
access a system. After being verified, whether they are permitted to access certain
resources in the system depends on the access control configured. This assignment is
designed to improve your understanding of these topics and apply this understanding in a
practical real world scenario.
Task 1 gives you the practical exercises on a two-factor authentication system while Task 2
is an access control exercise of how a network administrator can set the permissions to
various users and user groups according to the system access control requirements.
Overview of the assignment
In Task 1 of the assignment, you are to demonstrate your understanding of biometric
authentication and password authentication in an individual Task 1 report file. For
biometric authentication, you will study how the system parameters affect the
authentication accuracy. For password authentication, you will use the UNIX password
authentication and use an attack tool application, John the Ripper and the UNIX
password hashing tools, to study the impacts of password hashing parameters on the
difficulty of hacking the hashed password and the usability of the system.
In Task 2 of the assignment, you are given several practical tasks on the access control
knowledge you acquired in the lectures and tutorials/labs. You are asked to create new
groups and users, and then assign the users into appropriate user groups. You will also
study how SUID is used to give special access rights to users running certain processes.
Another Task 2 report file should capture your results and explanation and is worthy of
10% of unit mark. You have to demonstrate configuration results of Task 2 during the
in-class interview which is worth 5 marks of your unit mark.
Two report files in pdf format are to be submitted via one submission link.
Your work in this assignment will be assessed based on your Task 1 and Task 2 reports
and your responses on Task 2 in an interview conducted with your TA during your
Applied Session in Week 12.
Assessment Details
Task Rubric
Task 1a
■ Method and answers (FAR and FRR) for each threshold (4%)
■ Explanation on the impact of the choice of threshold (3.5%)
Task 1b
■
Results of the four hashed passwords including screen captures
for both john and mkpasswd timing (0.375% x 8 = 3%)
■ Discussions on the different approaches (2.5%) and time
estimates for dictionary search (1%)
■ Recommendations on the password hashing (1%)
Task 2
■ Task 2a (2%: on creating users and user groups).
■ Task 2b (5%: 3% on configuration and 2% read the file by non-
owner)
■ Task 2c (3%: configuration of the files)
■ Interview during Week 12 Applied Session (5%)
Assignment Details
Task 1 (15% of unit marks): Two-Factor Authentication System
Task 1a) (5% of unit marks): Biometric authentication
Using the sample testing results of a face recognition authentication system, you are asked
to evaluate the security and usability of this system using the False Acceptance Rate (FAR)
and False Rejection Rate (FRR) accuracy metrics, as discussed in the User Authentication
lecture.
Instructions:
Consider the sample testing results obtained using a Face recognition software in Table 1
and Table 2.
Table 1 contains the face recognition testing results using 10 images of a registered person
“Ammie”. For each of those 10 testing images, the table shows the similarity probability
score when trying to log in to Ammie’s account using the image for face recognition. Note
that the similarity probability scores indicate how similar each of Ammie’s 10 login images
are to Ammie’s registered image, when attempting to access her account 10 times. The
higher the similarity probability score, the more similar the login and registered images are.
The system lets a user log in if the similarity score is greater than some threshold value.
Table 2 contains the face recognition testing results using 10 images of an un-registered
person “Brenda”. For each of those 10 testing images, the table shows the similarity
probability score when trying to log in 10 times to Ammie’s account using Brenda’s images
for the face recognition.
Registered Person
(“Ammie”) Testing Image ID
Similarity Probability Score
1 0.985
2 0.971
3 0.984
4 0.977
5 0.996
6 0.999
7 0.968
8 0.956
9 0.935
10 0.990
Table 1. Results for Registered Person (“Ammie”) Testing Images
Un-Registered Person
(“Brenda”) Testing Image ID
Similarity Probability Score
1 0.923
2 0.922
3 0.930
4 0.940
5 0.955
6 0.937
7 0.963
8 0.909
9 0.982
10 0.943
Table 2. Results for Unregistered Person (“Brenda”) Testing Images
■ For the testing data in Table 1 and Table 2, count the number of images falling in
each of the four categories below.
○ True Accept/Positive (TP): The system correctly lets the real account owner
log in (probability score above the threshold)
○ False Reject/Negative (FN): The system incorrectly denies access to the
real account owner (probability score below the threshold)
○ False Accept/Positive (FP): The system incorrectly lets an impersonator log
in (probability score above the threshold)
○ True Reject/Negative (TN): The system correctly denies access to an
impersonator (probability score below the threshold)
■ Based on the results in Table 1 and Table 2, Compute the FAR and FRR metrics for
your testing images using the two different threshold settings of 0.95 and 0.97,
respectively.
■ In the Task 1a section of your report, include and explain your calculations of FAR
and FRR with the two different threshold settings of 0.95 and 0.97, respectively.
Finally, include an explanation of the impact of the choice of threshold on the security
and usability of the authentication system.
Task 1b) (5% of unit marks): Password Authentication
In this task, you will attempt to hack some system passwords using John the Ripper
(command john) and investigate how this time and the time to compute a single password
hash depends on the hashing parameters. You can time the brute force password search
process by using time john . You can also measure the time taken to
compute a single password hash by SHA-512 using command time mkpasswd -m sha-
512 . Note that you should use “user time” (time spent by CPU to execute
the mkpasswd process, excluding kernel and other processes’ CPU time) in your below
computations.