Perimeter
4/27/2011
04:31 PM
Taher Elgamal
Taher Elgamal
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Kind Of A Mess

Internet needs an infrastructure that enables back ends and users to communicate with each other using better authentication--and allows any number of authentication technologies to sign into it

I’ve blogged previously about how, back in the early days of SSL, we tried to do client authentication, but our direction somehow went sideways and we were never able to pull it off. Since then, and especially over the past 10 years or so, a number of authentication companies have developed interesting technologies aimed at selling Internet service providers and enterprises a better technique than password-based authentication.

The result: Some organizations have actually adopted these new technologies, leading to a proliferation of varying back-end authentication methods across the Internet.

It’s kind of a mess.

It’s a mess because each of these technologies requires two things: First, they require the back end to sign up and integrate the Web service interface of the authentication product into the login screen of the website and into the enterprise. Second, they require a user to do something specific to authenticate himself into this new website.

For the user, it’s confusing -- he gets a message on his screen asking for information additional to information he has already provided. And users can’t stand that.

Now, if it were his bank, the user would probably be willing to take extra steps because he’s used to banks making these kinds of requests. But if it’s another entity, it doesn’t fly.

So it seems that what the world actually needs is a piece of Internet infrastructure -- one that is altogether missing at this point -- that does two things: One, it enables websites (financial and others) to one-time-only participate in a stronger authentication infrastructure that allows them to choose any available strong authentication scheme without having to integrate the specific product each time; and two, it enables users to access these services in a seamless way -- perhaps not 100 percent seamless, since they may need to do a one-time registration, but as near seamless as possible.

We need to conceive of a new infrastructure that basically sits on top of today’s Internet e-commerce -- an infrastructure that enables back ends and users to communicate with each other using better authentication, and allows any number of authentication technologies to get signed into it. In this scenario, enterprises wouldn’t need to do multiple integrations and needlessly complicate their users’ workflow.

Additionally, the concept of “inferred identity” would need to live in the middle of this new infrastructure, allowing a back end to access either a user or device identity without actually asking the user to do anything. This new infrastructure would be able to tell what a specific device looks like, and then the back end would get the data and validate that the device is what they expect for this kind of session.

In order for this new kind of authentication to flourish, a lot of people will have to get on board. I believe that time is coming soon because we cannot continue to field the complexity that results from every single site determining which form of authentication it prefers. As it stands, all of these forms understand SSL, so the back-end authentication is certainly going to be an SSL certificate, just as it has always been. That means that the SSL session can actually secure the connection between the user, the front end, the client end, and the back end in order to set up the user authentication session. Once those actions are completed, it can then set up the stronger authentication session.

Is this goal little more than a dream? I hope not. The Internet needs a more intelligent way of handling stronger authentication. So until the patchwork mess of technologies is cleaned up, it’s a dream worth pursuing.

Recognized in the industry as the "inventor of SSL," Dr. Taher Elgamal led the SSL efforts at Netscape. He also wrote the SSL patent and promoted SSL as the Internet security standard within standard committees and the industry. Dr. Elgamal invented several industry and government standards in data security and digital signatures area, including the DSS government standard for digital signatures. In addition to serving on numerous corporate advisory boards, Dr. Elgamal is the Chief Security Officer at Axway, a global provider of multi-enterprise solutions and infrastructure. He holds a Ph.D. and M.S. in Computer Science from Stanford University. View more of his blog posts here.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7407
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2014-3675
Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

CVE-2014-3676
Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

CVE-2014-3677
Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-4448
Published: 2014-10-22
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.