OATH: One Token To Rule Them All

Posted by Avi Baumstein
February 09, 2008

Tags: Access Control, Authentication, Avi Baumstein, Business/Finance/Careers, Data Networking & Management, Data Protection, Database Management Services, Enterprise Identity, Enterprise Management, Identity Management, Identity Management Software, Initiative for Open Authentication, Internet Authentication , Motherboards, Network types, OATH, Other, Public Identity, Remote Access, Remote Access Software, Security and Privacy, Servers, Servers & Storage, Single Sign-On, Software and Web Development, Tech Road Map, USB, USB Cards, Unified Communications & VoIP, WLAN Security, Web Access Management, Wireless, strong authentication, tokens

Channel: Other, Networking & Mgmt, Servers & Storage, Data Protection, Wireless, UC & VoIP

We've long known that multifactor authentication provides stronger security over simple passwords, but a limited number of options, cost, interoperability issues, and the dread that IT pros feel at the idea of issuing users multiple tokens have put a damper on deployment. With its recently released Reference Architecture 2.0, the Initiative for Open Authentication, or OATH, hopes to allay these misgivings with an open standard to bring strong authentication to applications and services.

The operative word here is "standard." Systems based on OATH's architecture allow for interoperability among user tokens and a variety of services requiring authentication. The ultimate goal: a single token compatible with any number of services from different providers. This is a fantastic idea, but it's currently possible only in a limited way. Because the current token implementation is event-triggered, if a token is used with unconnected services, the event count for those services will not match the state of the token, causing authentication to fail. The only way to make the system work is for all services to use the same validation back end, thereby keeping token state consistent. One such service is VeriSign's Verified Identity Protection, or VIP. Charles Schwab and eBay are two high-profile users; customers need only a single token to authenticate to these and other VIP-managed online services.

THE LOWDOWN

THE PROMISE
A standard for interoperable, strong authentication focusing initially on one-time passwords, with the goal to make secure authentication less expensive and ultimately pervasive.
THE PLAYERS
Most industry notables--AOL, Entrust, IBM, and VeriSign--and many lesser-known authentication specialists. Conspicuously absent is market leader EMC/RSA, which favors its proprietary SecurID.
THE PROSPECTS
Online service providers, especially financial services firms, are eager to beef up security in light of federal guidelines that encourage use of two-factor authentication. A standards-based approach that lowers costs and speeds implementation is attractive, and OATH seems to fit the bill. But the big question is whether tokens can really solve the problem of online fraud.

For every open standard there are proprietary alternatives, and strong authentication is no exception. While RSA has been the closed-system market leader for quite a while, the multifactor authentication space is getting crowded. Entries include WiKID, which uses a mobile phone-based software token, and PhoneFactor, which sends an authentication code to users' phones. Still, this is one area where the open alternative has a real shot. OATH's membership list is large and varied. Besides VeriSign, the latest spec is integrated into products from AOL, BMC, Citrix, Entrust, Hewlett-Packard, IBM/Tivoli, Imprivata, SanDisk, and many more.

A BETTER WAY

Page: 1 | 2 |3 |Next Page »

More Insights


	To upload an avatar photo, first complete your Disqus profile. \| View the list of supported HTML tags you can use to style comments. \| Please read our commenting policy.

Tech Centers

Channels

Bloggers

Upcoming Events

Interop NY Oct. 1-5

Subscribe to Newsletter

Vendor NewsFeed