Building a One-Time-Password Token Authentication Infrastructure
LISA: Where systems engineering and operations professionals share real-world knowledge about designing, building, and maintaining the critical systems of our interconnected world.
The LISA conference has long served as the annual vendor-neutral meeting place for the wider system administration community. The LISA14 program recognized the overlap and differences between traditional and modern IT operations and engineering, and developed a highly-curated program around 5 key topics: Systems Engineering, Security, Culture, DevOps, and Monitoring/Metrics. The program included 22 half- and full-day training sessions; 10 workshops; and a conference program consisting of 50 invited talks, panels, refereed paper presentations, and mini-tutorials.
Jonathan Hanks, LIGO Lab/California Institute of Technology, and Abe Singer, Laser Interferometer Gravitational Wave Observatory, Caltech
One-time-passwords provide more security than passwords, but what about risks, multiple sites, provisioning and distribution? At LIGO, our infrastructure supports using a single token across multiple sites, and tolerates network failures while minimizing the overhead in managing and distributing tokens. We don’t have to to trust third party services, use “black box” software, or custom client software. We also support OTP for Kerberos without any client-side modifications. In this talk: our approach to evaluating and deploying token authentication includes risks, requirements, system architecture, supporting multiple sites, fault tolerance, Kerberos, and our experiences using it for a couple of years.
Jonathan Hanks, LIGO Lab/California Institute of Technology
Jonathan Hanks is currently a software engineer at the Laser Interferometer Gravitational Wave Observatory (LIGO) in Hanford, WA. Previously he worked as a system administrator for five years with LIGO, which included system administration duties, several development projects, and supporting the LIGO Identity and Access Management Infrastructure. Prior to LIGO he worked in mobile devices.
Abe Singer, Laser Interferometer Gravitational Wave Observatory, Caltech
Abe Singer is the Chief Security Officer for the Laser Interferometer Gravitational Wave Observatory and the LIGO Scientific Collaboration, and formerly the Chief Security Officer of the San Diego Supercomputer Center. At times he has been a programmer, system administrator, security geek, consultant, and expert witness. He is based at the California Institute of Technology in Pasadena.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
author = {Jonathan Hanks and Abe Singer},
title = {Building a {One-Time-Password} Token Authentication Infrastructure},
year = {2014},
address = {Seattle, WA},
publisher = {USENIX Association},
month = nov
}
