State of e-Authentication in Higher Education Bernie Gleason Stronger Authentication – Issues, Techniques, Security Tokens & Biometrics State of e-Authentication in Higher Education Bernie Gleason August 20, 2004

Acknowledgements ”Most Trusted University” University of Miami has a strategic goal to become respected as one of the “Most Trusted Universities.” Illustrations and strategies in this presentation have been provided with the permission of the University of Miami. Identity management and authentication concepts have been contributed by members of the Information Technology department at Boston College. Special thanks to IBM for their sponsorship and support

E-Business Progression

Academic Environment Heterogeneous Disparate Authentication Mechanisms Redundant Identity Data “Weak Passwords” – the norm Proprietary Integration Methods Expanding User Base and Access Methods Trust Agreements Elusive

Basic Transitive Trust Model

Trust Model Progression More Customer Types More Access Devices Weak Passwords Single Sign-On Identity Management Directory Services Portals Federations PKI XML Standards Web services ASPs – Rebirth Grids Service-oriented Architectures (SOA)

Weak Password Authentication Often pretending passwords are strong Can build from the current base Need to add more muscle – second factors Maintain privacy Maturation is going to take time

Two-Factor Authentication ATM requires that I use two factors: “something I have” Bankcard “something I know” Password/PIN On-line transaction requires one factor: What should be the on-line equivalent on the ATM second factor?

Authentication – Three Factors Passwords “something we know” Tokens and Cards – “something we possess” (e.g., ID cards, smart cards, digital certificates) Biometrics “something that is part of us” (e.g., retina scan, fingerprints, facial recognition)

Smart Cards and Security Tokens USB Tokens Dartmouth University of Texas Medical

Interim Two-Factor Authentication Practices

Biometrics in Practice Hand Scans Facial Recognition Retina Scans Conversational Voice Fingerprints Don Estridge High School in Boca Raton Dormitory surveillance in combination with security cameras Swift & Company tracking cattle in conjunction with GPS system Spoken secret (e.g. password) is used to verified identity with the voice Piggly Wiggly stores - fingerprints r for credit and debit card processing and check cashing

Biometrics in Practice -- Fingerprints

Biometrics in Practice – Facial Recognition

Managing Biometrics Database – Identity is authenticated against a central database or directory Local – Biometric is stored in the device or token and authentication test is simply that the user of the device is the person assigned.

Biometric Acceptance Required authentication strength for the transaction Privacy precautions and requirements Cost and customer convenience Customer audience and customer access device capabilities Adopted institutional standards and supporting infrastructure (e.g., PKI) Accepted practices, both within and outside of Higher Education

Charting a Strategy Accept passwords as a way of life Concentrate on building a stronger security and identity management infrastructure – what users don’t see or experience but take for granted Implement innovative ways that make the user experience easier and more intuitive Apply new methods universally in a non-intrusive, transparent manner Require second factors of authentication only at the time that access to sensitive data and transactions is needed

New Paradigm Existing ID Numbers and Passwords – “something we know” Existing CaneID Cards – “something we possess” for low-level authentication and existing applications, but upgraded with standard credit card security features Public Key Infrastructure – underlying security framework but the keys and complexity masked from the users Smart USB Tokens -- “something we possess” for higher-level authentication and distributed to all core constituents (faculty, students and staff) Fingerprint Scans -- “something that is part of us” and optionally imbedded in USB tokens

Matching Risk to Authentication Technique Authorization Risk Assessment Minimal Risk Low Risk Substantial Assurance High Assurance Authentication Technique PIN Password + PIN Two Factors Three Factors with Biometric

Future PKI Infrastructure Most Trusted Passwords Smart Devices Biometrics Central Authentication Authority PKI Infrastructure

Questions?

Trust Agreements is the User is Central Authentication Service is the Target Application Transitive Trust – B trusts A and B trusts C, so C trusts A Proxy – B trusts A and B trusts F, F trusts C, so C trusts A Federated – B trusts A, B trusts Circle, so C trusts A