New wrinkles for authenticating users

SAN FRANCISCO'Authenticating users on an information technology system seems simple enough at first glance, but the task of providing an adequate level of assurance without swamping users with management overhead can be a daunting task, and there is no single solution in sight.

But if there is no single solution, vendors on the show floor of this year's RSA Security conference are displaying a variety of techniques and technologies to help administrators replace or augment commonly used password schemes.

'Enterprises have not taken a wide view of identity management,' said Neville Pattinson, vice president of government affairs at Gemalto NV. Identity management, which Pattinson called the core of strong authentication, has traditionally been done on an application-by-application basis. User name and password has been the default log-on standard, but the proliferation of increasingly complex passwords required for stronger authentication can quickly overwhelm end users and help desks. 'There is a lot of overhead to password management.'

Gemalto of course advocates the use of smart cards or other physical tokens to present digital certificates or keys for strong authentication.

'We're seeing a lot of uptake in smart cards,' coupled with centralized identity management across the enterprise, Pattinson said. Government has been in the leader in this area, with the Defense Department's Common Access Card and its civilian counterpart, the Personal Identity Verification Card.

New from Gemalto at this year's conference is its Secure Enterprise Guardian, which includes the functionality of a smart card in a USB device with 2G encrypted flash memory. It also can provide one-time passwords using the OATH algorithm for logical access and has full public-key infrastructure capability, with private keys.

The device is available now in sample, with broad availability expected later this month. The company is in the process of certifying it to the Federal Information Processing Standard 140-2 for cryptographic devices, required for government use. 'It probably won't be available to government until the end of the year,' he said.

IdentiPHI is hoping to get into a growing segment of the authentication market with middleware that enables biometric tools. Its SAFsolution5 is the glue between a variety of biometric tools and directories. Despite the attention being given to biometrics in the past several years, implementations for the most part have been on smaller scale. IdentiPHI's largest 10 deployments are from 1,500 to 8,000 users. But the company believes it is ready for enterprisewide use.

'There haven't been huge deployments of biometric solutions across organizations,' said Chief Executive Officer Steve Oyer. 'Now we're targeting the largest corporate and government organizations.'

IdentiPHI was an integrator in search of its own solution when it bought the source code for SAFsolution from SAFlink last year, and bought the company two months ago.

'The quickest way to market was to find a good solution and buy it,' said IdentiPHI President John Atkinson.

The migration to SAFsolution5 included adding support for Microsoft Vista and Linux for Novell, simplifying the installation for server and client software and making sure it would scale for enterprise deployment. The primary market of SAFlink originally was government, and the SAFsolution was included in early CAC pilots. Government will continue to be an important market for IdentiPHI, which is hardening SAFsolution5 and including support for PIV Cards.

Another company, 2factor, aims to close some of the security gaps in Web browsing by improving authentication between the browser and server.

'The problem is that the security now is based on session authentication techniques,' said Chief Technology Officer Glenn Veach. This is a one-time authentication at the beginning of a session or visit to a Web site, and it usually authenticates only the server. 'The client is not authenticated because of the low level of use of certificates by the public.'

This can leave sessions open to attack by outsiders who can break in after authentication has been completed. So 2factor is promoting its Real Privacy Management, which provides continuous, mutual authentication between the browser and the server. RPM manages the private keys used for authentication and generates encryption keys for a variety of algorithms, including 256-bit AES.

Authentication can be as granular as every packet exchanged. 'That depends on the application developer,' Veach said. 'Most will be doing it at a page level or an asset level.'

The company offers an RPM software developers kit. The small piece of code, only about 20k, can be burned onto a chip, put in firmware or used as software. 'We are talking to some PC chip manufacturers' about having it built into products, Veach said, but 'that's probably some time out.' For the time being it is implemented application by application.

Positive Networks is offering a form of out-of-band, risk-based second-factor authentication for online transactions. End users can authenticate themselves to an application as usual with a user name and password, but when a transaction meets a threshold for additional security, because of its size, sensitivity or because it is unusual, the Phone Factor system generates a phone call to the user for confirmation.

A Phone Factor agent protecting a server acts as a Radius proxy, passing the initial authentication request through to the server. It then can intercept the returning authentication, without seeing the password, and direct it by a Secure Sockets Layer-protected link to the Positive Networks data center, which hands it off to the phone system to initiate the call. When the user confirms the transaction, the Phone Factor agent is notified and it completes the authentication.

'We cannot be affected by man-in-the-browser attacks,' in which malicious code in a browser massages data being entered by the user to change the transaction being made, said Positive Networks Chief Technology Officer Steve Dispensa.

Phone Factor is available as a free product at www.phonefactor.net, and users can upgrade it with additional paid features. It comes in an enterprise version, which is an agent residing on the server which can integrate with Microsoft Active Directory to obtain account information and telephone numbers. A Web-based software developers' kit also is available.