Building a One-Time-Password Token Authentication Infrastructure

One-time-passwords provide more security than passwords, but what about risks, multiple sites, provisioning and distribution? At LIGO, our infrastructure supports using a single token across multiple sites, and tolerates network failures while minimizing the overhead in managing and distributing tokens. We don’t have to to trust third party services, use “black box” software, or custom client software. We also support OTP for Kerberos without any client-side modifications. In this talk: our approach to evaluating and deploying token authentication includes risks, requirements, system architecture, supporting multiple sites, fault tolerance, Kerberos, and our experiences using it for a couple of years.

Jonathan Hanks is currently a software engineer at the Laser Interferometer Gravitational Wave Observatory (LIGO) in Hanford, WA. Previously he worked as a system administrator for five years with LIGO, which included system administration duties, several development projects, and supporting the LIGO Identity and Access Management Infrastructure. Prior to LIGO he worked in mobile devices.

Abe Singer is the Chief Security Officer for the Laser Interferometer Gravitational Wave Observatory and the LIGO Scientific Collaboration, and formerly the Chief Security Officer of the San Diego Supercomputer Center. He has been at times a programmer, system administrator, security geek, consultant, and expert witness. He is based at the California Institute of Technology in Pasadena.