Paul Madsen, Senior Technical Architect at Ping ID, discusses types and trends of authentication as well as FIDO and federation.

1. Confidential. All Rights Reserved. FIDO Alliance. Copyright 2016.
FIDO & STRONG AUTH
TECHNOLOGY LANDSCAPE
Paul Madsen, Senior Technical Architect, Ping ID

2. Copyright © 2014 Ping Identity Corp. All rights reserved. 2

3. FIDO in context
Federation
Authentication
Trends
FIDO

4. FIDO & Authentication TRENDS

5. Authentication Trends
1. Mobile phone as authentication factor
2. Local authentication to device
3. Device identity
4. Continuous authentication
Copyright © 2013 Ping Identity Corp. All
rights reserved.

6. Phones make great *have* factors
•Connected
•Computation
•Storage
•UI
Copyright © 2013 Ping Identity Corp. All
rights reserved.
In a package a user
won’t leave at home

7. Copyright © 2014 Ping Identity Corp. All
rights reserved.
Authn
server
MFA
server
Mobile MFA

8. Local authentication
• Capabilities of phones also make
practical a model the verification
check is performed locally, ie on
the device
• Result of local verification on
device communicated to server
(typically via demonstration of
knowledge of a previously
established secret)
• Evolution of ‘device unlock’
mechanisms, e.g. PIN or pattern
• Particularly for biometrics,
advantages to keeping sensitive
secrets off the server

9. Apple ‘Selfie for authn’ patent

10. Authenticating device & user
yes
no
Is device authenticated?
no
yes
User
authenticated?
Enjoy
partial
application
access
Enjoy full
application
access
Device
Registration
User logs in
from
untrusted
device.
User logs
out
User logs in
from
trusted
device.
Enjoy
partial
application
access
Enjoy
limited
application
access

11. Explicit giving way to implicit
Copyright © 2014 Ping Identity Corp. All
rights reserved.
Explicit
factors
Implicit
factors
Trend
Explicit
factors
Implicit
factors

12. Contextual authentication
• Replaces single ‘does user know password?’ query with
multiple ‘Is this signal consistent with what I expected?’
checks
• Any anomalies cause system to adapt accordingly
• Collection of different X signals passive & invisible to user so
few UX implications
• Assumption is that attacker unlikely to be able to simulate all
signals in order to impersonate valid user
Copyright © 2014 Ping Identity Corp. All
rights reserved.

13. Adaptive Authentication
Copyright © 2014 Ping Identity Corp. All
rights reserved.
• Systems that can, based on an
assessment of risk (determined
by multiple criteria), choose
between available overt login
mechanisms and contextual
factors
• Adaptive Authentication ==
Contextual Verification +
Logins
• If we have a user “John”,
answers the question:
• Is the user trying to access the
system still “John”?
Contextual checks
Overt login
(only when necessary)

14. Sweet spot
Continuous
Authentication
Local
Authentication
Mobile device
as factor
Confidential. All Rights Reserved. FIDO Alliance. Copyright 2016. 14
FIDO

15. FIDO & Federation

16. Federation
• A model of identity management where the different components
of a given transaction are distributed across actors
• One actor relies on the identity data that another actor provides
• Manifests in issuance, storage, presentation, and validation of ‘security
tokens’
• Archetypical manifestation is Web SSO
• May cross policy boundaries, e.g. business partners,
enterprise/SaaS, education institutions, social providers
• Federation standards define
• semantics of token (authn, authz, attributes)
• Token format (XML -> JSON)
• Protocols for moving tokens over network (SOAP -> REST)
Copyright © 2014 Ping Identity Corp. All

17. Complementary
• Insulates authentication
server from specific
authenticators
• Focused solely on primary
authentication
• Does not support attribute
sharing
• Can communicate details of
authentication from device
to server
• Insulates application from
specific identity providers
• Does not address primary
authentication
• Does enable secondary
authentication & attribute
sharing
• Can communicate details of
authentication from IdP to SP
FIDO Federation

18. Copyright © 2014 Ping Identity Corp. All
rights reserved.
HighLow
High Low
Frequency of login
Assurance

19. Copyright © 2014 Ping Identity Corp. All
rights reserved.
HighLow
High Low
Frequency of login
Assurance
status
quo

20. Copyright © 2014 Ping Identity Corp. All
rights reserved.
HighLow
High Low
Frequency of login
Assurance
status
quo
Mobile
2FA

21. Copyright © 2014 Ping Identity Corp. All
rights reserved.
HighLow
High Low
Frequency of login
Assurance
status
quo
Mobile
2FA
federation
SSO slide

22. Copyright © 2014 Ping Identity Corp. All
rights reserved.
HighLow
High Low
Frequency of login
Assurance
Status
quo
Mobile
2FA
Federation
continuum
FIDO

23. Copyright © 2014 Ping Identity Corp. All
rights reserved.
HighLow
High Low
Frequency of login
Assurance
Status
quo
Mobile
2FA
Federation
FIDO
FIDO +
Federation

24. Making it real
• FIDO Enterprise Adoption WG drafting guideline doc defining
how to compose FIDO & Federation
• How to express in a federation flow that the authentication
was FIDO-based
• SAML AuthenticationContext
• OpenID Connect ‘acr’
• OpenID Foundation Enhanced Authentication Profile WG doing
the same with focus on OpenID Connect
Copyright © 2014 Ping Identity Corp. All

25. Mobile Connect
• Mobile Connect is GSMA effort designed to leverage phones for
authentication & identity into applications
• Technically, manifests as a profile of OpenID Connect
• operators act as ASs
• Web sites act as Clients
• Defines how to use a FIDO based authentication as an
alternative to SIM, followed by Connect-based SSO
Copyright © 2014 Ping Identity Corp. All
rights reserved.

26. FIDO in context
Federation
Authentication
Trends
FIDO

27. THANK YOU
Copyright © 2014 Ping Identity Corp. All rights reserved.
27