New reference architecture for open authentication standards

SAN FRANCISCO'The Initiative for Open Authentication (OATH), a 4-year-old industry coalition promoting the use of open standards for interoperable strong authentication, hopes that the release of a new version of its reference architecture will help spur adoption of the specifications by industry and consumers.

Uptake of the coalition's architecture has been slow since announcement of the initial release at the RSA Security conference in 2004. 'I think this year is an inflection point,' said Don Malloy, marketing chief for OATH and director of business development at Innovative Card Technologies.

OATH member companies are promoting the updated specs at this year's RSA Security conference and trade show. So far, the greatest traction has come from the financial services industry, particularly in Asia and South America.

'The banks get it,' Malloy said. Interest from the banking industry is growing in this country due largely to regulatory requirements for stronger authentication for online transactions.

Version 2.0 of the OATH reference architecture, released in September, is the first major upgrade of the document since its initial release. The changes incorporate risk-based authentication and identity sharing. With specifications updated, the organization's road map for the coming year focuses on implementation and adoption of the specifications by industry, said Siddharth Bajaj, Joint Coordination Committee chair and principal at the Innovation Group of VeriSign, the founding member of OATH.

The purpose of OATH is to make use of strong, two-factor authentication simpler and more widespread, increasing security and making it easier to conduct sensitive online transactions. The OATH architecture is based primarily on existing standards with a goal of making authentication schemes interoperable across networks and vendor platforms. One of the organization's guiding principles is that open architectures rather than proprietary solutions are required for the widespread adoption of a technology.

Strong authentication usually involves the use of an additional factor, such as a physical token, digital certificate or a biometric template, in combination with the user name and password typically required to verify the identity of an online user. There are a number of protocols and technologies that allow this, such as Lightweight Directory Access Protocol and Remote authentication dial-in user service. But strong authentication schemes often have been complex and not interoperable, making strong authentication expensive and creating stovepiped applications. Governmentwide standards such as those for the Defense Department's Common Access Card and the civilian counterpart the Personal Identity Verification card can help implement strong authentication using digital certificates in the government arena, but do not address the issues of interoperability outside of the government and its contractors.

OATH hopes to ensure that open standards for implementation will help secure credentials be provided and verified across multiple hardware and software platforms. The organization's membership has leveled off at 70 to 80 members, and adoption of the reference architecture has not been as wide as had been hoped, although Malloy estimated there are nearly a million tokens in circulation incorporating the architecture.

'There are different barriers to adoption,' Bajaj said. In Europe, customers expect strong authentication requirements with online banking. 'But in the United States banks are wary of putting any additional burden on the customer,' although that attitude is beginning to change,' he said. 'One of the biggest hurdles is budgets and the cost of deployment.'

The cost of adopting an OATH solution should be reduced as tokens become more affordable and people become more used to using them. But the problem of managing multiple tokens or certificates for accessing multiple resources remains. Managing multiple passwords already is a notorious problem, both for administrators and end users. Increasing the use of physical tokens could result in similar problems.

That is why identity sharing, the use of the same token and credential to access multiple online resources, is addressed in Version 2.0 of the architecture. It contains three models for sharing identity between sites. 'All three models can co-exist,' so implementers do not have to choose between them, Bajaj said.

Risk-based authentication ties the strength of the authentication required by an application to the risk involved in the transaction. The application determines when a transaction is in some way out of the ordinary or especially critical, and can require an additional authentication factor. This could be an out-of-band confirmation by e-mail or phone, having the user answer an agreed-upon question or any other method of authentication. The architecture standardizes interfaces for sharing information about risk levels so that additional factors for risk-based authentication can be applied.

"The delivery of this new document represents thousands of hours spent with OATH member companies as well as significant research into the successful implementation of OATH-derived technologies,' Bajaj said. 'This has resulted in a much stronger reference architecture."