More than just being signed-in or signed-out. Parul Jain, Architect,

Transcription

1 More than just being signed-in or signed-out Parul Jain, Architect,

2 Why do we care? TRUST & SECURITY EASE OF ACCESS Can t eliminate friction? Delay it Authentication Levels to balance security and usability Delightful product experience

3 Authentication Not Signed In Username Password Sign In Signed In

4 Authentication Signed In or Not Example1 Not Signed In Browse OLX for used products Username Password Sell an item Sign In Signed In Place Ad

5 Authentication Signed In or Not Example2 Not Signed In Browse apps on App Store Username Password Install App Sign In Signed In New App on Device

6 Why Authenticate? Authentication is required to establish trust Is trust binary - Trust you fully or Not at all Degrees of trust - Factor of time and situation Trust you for this but not for that Didn t trust you earlier but trust you now

7 Authentication Levels Authentication is not binary Authentication Assurance Levels (AAL) Adaptive - Change with time and situation

8 Authentication Assurance Levels (AAL) Authentication Level 1 Less Trust Enter OTP Submit Authentication Level 2 More Trust

9 AAL Example1 Authentication Level 0 Usernam e Passwor d Sign In My bank portal Sign In Authentication Level 1 My bank account Transfer Money Authentication Level 2 Payment

10 AAL Example2 Authentication Level 0 Usernam e Passwor d Sign In Mint application Sign In Authentication Level 1 Access my personal finances Enter OTP Submit Transfer Money Authentication Level 2 New Payment Instrument

11 AAL Example3 Authentication Level 1 Browse products on Amazon Username Password Sign In Track Order Or Checkout Authentication Level 2 View/Place Order

12 MFA and AAL Relationship AAL is the outcome. MFA is the mechanism MFA provides layered defense Binary Authentication Multiple Authentication Assurance Levels

13 LIC: Binary without MFA

14 Google: Binary with MFA

15 Amazon: Multiple Levels with MFA

16 Intuit: Multiple Levels with MFA

17 How to determine the AALs? ASSIGN Based on factors of authentication REQUIRE Based on sensitivity of the APIs ADAPT Based on trust in the user with time

18 ASSIGN an AAL Based on factors of authentication ASSIGN ADAPT REQUIRE What I know password What I have OTP What I am fingerprint Other Federated

19 ADAPT to an AAL Based on trust in user with time ASSIGN ADAPT REQUIRE Change in Device Geolocation IP address Velocity of use Behavioral Biometrics Anomalous behavior

20 REQUIRE an AAL Based on sensitivity of the APIs ASSIGN ADAPT REQUIRE Secret OAuth Client Secret Highly Sensitive Money movement Financial data Sensitive Personal information Other Public information

21 AAL Determination High Step-up Step-up Good Sensitivity of the APIs Step-up Good Good Low Good Good Good Low High Trust in user authentication

22 Component Interaction 1. Sign in 2. Session with an AAL Identity Service s Determine AAL 7. Step-up Client Remembe r the state 8. Higher AAL 4. Verify 5. Step-up URL 6. Redirect for Stepup 3. Access Resource APIs Check expected AAL

23 Client Widget Configuration

24 APIs Create the verify request Verify with expected AAL

25 Identity Services Device, IP, geo, time, Sign-in Verify Authn Service Get Risk Score Risk Engine ML Model Real time Risk Score Feedbac k

26 UNIVERSAL STRONG AUTHENTICATION FIDO AS A STANDARD

27 Fast Identity Online (FIDO)

28 FIDO Protocols Public Key cryptography UAF Universal Authentication Framework Password less UX Local device with UAF stack installed User presents a local authentication U2F Universal Second Factor Standalone U2F device - USB/NFC/Bluetooth Physical keychain with multiple keys one for each origin Built-in support in web browsers

29 UAF Src:

30 UAF - Registration FIDO Client Win, Mac, ios, Android, User Device User Agent Browser, App, FIDO Authenticators 3. Enroll user + New Key Pair 1. Legacy Auth + Initiate Registration 2. Registration request + Policy 4. Registration response + Attestation + User s public key Identity Provider Web App 5. FIDO Server Validate Response + Attestation Store user s Public Key

31 UAF - Authentication User Device Identity Provider FIDO Client Win, Mac, ios, Android, User Agent Browser, App, FIDO Authenticators 1. Initiate Authn 2. Authn request + Challenge + Policy 4. Authn response signed by user s private key Web App FIDO Server Verify User and unlock private key Validate Response using user s Public Key

32 U2F Src:

33 Summary As developers we have thought of authentication as a binary switch We need to start thinking about the degree and levels of trust Incorporate AAL into the design thinking AAL will help us in balancing security vs usability Deliver delightful experience to customers

34 Thank you

35