Feeds

Liberty Alliance unveils secure sign-on specs

Authentic

  • alert
  • submit to reddit

3 Big data security analytics techniques

ComputerWire: IT Industry Intelligence

Liberty Alliance duly unwrapped its version 1.0 specifications yesterday, outlining a standard for federated network identity sign-on as a secure method for identifying individuals using any manner of internet-connected devices.

The first phase of work undertaken by Liberty Alliance in its first year has focused on the use of so-called opt-in account-linking so that businesses and customers can share and re-use recognized sign-on procedures and preferences. Once users' accounts are federated, they can log-in and authenticate at one linked account and navigate to another linked account, without having to log in again.

This single sign-on feature is deemed critical to the future success of e-commerce and the concept could play a significant role in the development of web services.

Federated online identities are expected to provide businesses with increased opportunities on the internet, by enabling them to maintain ownership of their customer databases while still being able to work closely with business partners to share customer leads and customer data securely over any access device.

The Liberty version 1.0 specifications do not involve the exchange of personal information. Instead, they involve a format for exchanging authentication information between companies so the identity of the user is held safe, without specific details having to be shared. The user could choose which account or accounts should be linked, but could opt to maintain separate identities in different locations while still benefiting from use of a seamless sign-on.

The version 1.0 specifications will enable consumers to choose their identity provider and benefit from the convenience of simplified sign-on when navigating the internet from any device. Version 1.0 also takes "a first stab at the problems of authentication context," Timo Skytta of Nokia Mobile Software and chairman of the architecture board for Liberty Alliance confirmed to ComputerWire. This is a method that allows companies linking accounts to communicate the type and level of authentication that should be used when a user logs in to different accounts.

Authentication context may incorporate the use of attributes or data such as a mobile telephone user's call number, a digital signature, a user name and password, or some other combination. It will also account for user preferences and whether access is via a fixed or wireless device. It is an ambitious plan: "It is an issue that has not yet been tackled fully by the security vendors," Skytta confirmed to ComputerWire.

The Liberty alliance includes large organizations such as General Motors, American Airlines, and Hertz, and achieving federated identity will require some agreement on standards among these commercial businesses as much as collaboration among numerous hardware and software technology vendors. As a demonstration of the specifications' acceptance among the 65 or so Liberty Alliance member organizations, several concurrently announced plans to deliver Liberty-aware products and services. These vendors include Communicator, Entrust, NeuStar, Novell, OneName, RSA Security and Sun Microsystems.

The first products are expected to be available by the end of 2002 and industry-watchers will want to track vendor-specific "enhancements" to the specification carefully, as first-edition standards will inevitably be inadequate for many requirements and will necessitate vendor-specific approaches to overcome some security concerns.

© ComputerWire

Combat fraud and increase customer satisfaction

More from The Register

next story
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Record labels sue Pandora over vintage song royalties
Companies want payout on recordings made before 1972
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Ex–Apple CEO John Sculley: Ousting Steve Jobs 'was a mistake'
Twenty-nine years later, post-Pepsi exec has flat-forehead moment
Number crunching suggests Yahoo! US is worth less than nothing
China and Japan holdings worth more than entire company
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.