OATH: One Token To Rule Them All

We've long known that multifactor authentication provides stronger security over simple passwords, but a limited number of options, cost, interoperability issues, and the dread that IT pros feel at the idea of issuing users multiple tokens have put a damper on deployment. With its recently released Reference Architecture 2.0, the Initiative for Open Authentication, or OATH, hopes to allay these misgivings with an open standard to bring strong authentication to applications and services.

The operative word here is "standard." Systems based on OATH's architecture allow for interoperability among user tokens and a variety of services requiring authentication. The ultimate goal: a single token compatible with any number of services from different providers. This is a fantastic idea, but it's currently possible only in a limited way. Because the current token implementation is event-triggered, if a token is used with unconnected services, the event count for those services will not match the state of the token, causing authentication to fail. The only way to make the system work is for all services to use the same validation back end, thereby keeping token state consistent. One such service is VeriSign's Verified Identity Protection, or VIP. Charles Schwab and eBay are two high-profile users; customers need only a single token to authenticate to these and other VIP-managed online services.

For every open standard there are proprietary alternatives, and strong authentication is no exception. While RSA has been the closed-system market leader for quite a while, the multifactor authentication space is getting crowded. Entries include WiKID, which uses a mobile phone-based software token, and PhoneFactor, which sends an authentication code to users' phones. Still, this is one area where the open alternative has a real shot. OATH's membership list is large and varied. Besides VeriSign, the latest spec is integrated into products from AOL, BMC, Citrix, Entrust, Hewlett-Packard, IBM/Tivoli, Imprivata, SanDisk, and many more.

A BETTER WAYSingle-factor authentication using passwords is weak. One-time passwords improve the situation by generating a new password for each use. This was originally done by printing out a list of complex passwords and crossing off each as it's used. A difficult system at best, at worst a productivity killer for users who run out of passwords. Token-based systems improved on the process by using a key-fob electronic device to display the next needed password on an LCD screen. Problem is, these systems were somewhat pricey to deploy because a limited number of proprietary systems dominated the market. As a result of the interoperability inherent in the OATH open standard, however, we've seen vendors develop a swell of token options, including credit card-size tokens; USB-connected tokens; even purely software-based key generators that can run on mobile phones, eliminating the need to even carry a separate gizmo.

There are two ways to generate one-time passwords. The first is event-based, where the password changes each time one is used, as with the printed password list; the other produces a new password on a fixed schedule, which is how EMC/RSA SecurID tokens work. While it's not clear that one method is inherently better, an event-based password rotation is simpler and less expensive to implement. Time-based tokens must have fairly accurate clocks to change the password at the same time the server does, whereas event-triggered tokens need only process an algorithm each time the button is pressed to display the next password in the sequence. This means event-triggered tokens can also be smaller and last much longer, since they need to be powered only when used.

TOKENS ARE JUST THE START

The OATH Initiative's first published standard was for Hashed Message Authentication Code (HMAC) one-time passwords; it specified the algorithm to securely generate passwords in an event-triggered manner. Since then, OATH has been busy submitting and revising standards through the Internet Engineering Task Force for other components of an authentication architecture, including key provisioning and challenge/response algorithms. It also has produced two versions of a reference architecture that lay out a framework for the rest of the infrastructure needed for secure authentication, including provisioning of new tokens, validation of multiple authentication types, authentication and authorization, and auditing.

Reference Architecture 2.0 expands on the previous version with additional detail and a host of planned new capabilities. Perhaps the most innovative is risk-based authentication. A risk module will evaluate every transaction and assign it a risk score, which is then used to choose the authentication method that will be required for that transaction. For instance, an account-balance query from a recognized computer during working hours might get a very low risk score and require a simple authentication--say, user name and password only. A large fund transfer request made during off hours from an IP address in a range previously used for fraudulent activity would seem riskier, and thus would require much stronger authentication and may require that the transaction be signed using a special cryptographic token.

Today, outsourcing the authentication back end for e-commerce and online financial sites is probably the best way for organizations to take advantage of OATH; providers such as VeriSign help companies comply with increasingly stringent government regulations and consumer expectations while avoiding gimmicks. The downside is you'll be tied to a single vendor.IT departments looking to roll out multifactor authentication to internal users would do well to look into OATH-based offerings. While corporate choices aren't as well fleshed out as VeriSign's e-commerce program, the comprehensive OATH framework and large number of companies developing to it show the promise of an increasing number of compelling and competitively priced products over the next few years. Two OATH-based products available now are from Innovative Card Technologies and Authenex.

TIMELINE: OATH

--Avi Baumstein ([email protected])More Strategic Security:
Stop! There Goes My Phone!