Symantec Teams With Intel On Authentication Security

Symantec is tapping new security features within Intel's second-generation Core processors to help boost usage of the security company's authentication products that are designed to prevent users from becoming victims of malicious Web sites.

The company is among the first security firms to offer products that leverage Intel's Identity Protection Technology. IPT makes it possible for Symantec to embed in Intel's chipset the credential that supporting Web sites would use to identify the PC user.

Symantec is offering the VeriSign Identity Protection (VIP) to computer makers who would offer the product as an option to customers. Symantec has not said which computer makers will be offering the product.

VIP essentially sets up what's known as a "soft token" on a PC, so that every time a user visits a supporting Web site, his computer has to generate and send to the site a string of numbers to allow access. The ID string is sent after a person logs in to the site using his usual user ID and password.

After a person opts in to activate VIP on a PC, Intel's chipset downloads and stores within the hardware a credential from Symantec's server. That credential follows the PC user to whichever Web site he visits. A PC used by multiple people would store a credential for each person, if those people logged into the computer under different user names and passwords.

The limitation with VIP for consumers is that they would have to use the PC that stores the credential in order to take advantage of the added security. People can't take the credential with them, so they lose the added security when using other devices. "It's a double-edged sword," Kerry Loftus, senior director of product management in Symantec's authentication group, said in an interview.

The purpose of VIP is to prevent people from becoming phishing victims. Phishing is when a spammer sends an email to lure someone to a site disguised to look like a banking site, for example, to steal a user ID and password. If the phisher was successful in stealing the information, he still wouldn't be able to access the banking site without the VIP credential.

VIP is particularly useful for companies that want the extra layer of security when employees visit a corporate site or log on to the company's private network. Symantec is hoping to expand the use of its soft tokens on consumer sites and for business-to-business transactions over the Web. "We see all those as potential opportunity for this solution," Loftus said.

Symantec says more than 700 Websites support VIP, including sites that serve consumers, such as PayPal, eBay, Merrill Lynch, and others. Many consumers, however, do not use VIP, today. Symantec offers the service at no charge to end-users. Web sites pay from $3 to $7 per user per year.

Any company can make use of Intel's Identity Protection Technology within the chipset that ships with its latest Core processors, called Sandy Bridge. Symantec acquired its authentication technology last August, when it completed the $1.28 billion acquisition of VeriSign's authentication business.