Technology landscape for Identification Management System
Tags: security, mfa, sso, caac
Published: 2019-07-11 06:31:01

---
title: Technology landscape for Identification Management System
published: true
description: Let me explain the technology trend for Identification Management System like MFA, Risk-based authentication, CAAC and SSO.
tags: security, MFA, SSO, CAAC
---


## Preface

Identification Management System is very important component for both enterprise and consumer.

Especially, **MFA** is very hot topic. Anyone know about MFA. But do you know MFA **clearly**? It is **NOT** MFA to just use SMS or biometrics.

Let me explain the technology trend for Identification Management System like MFA, Risk-based authentication, CAAC and SSO.

## Authentication/Authorization

As you know **Auth** has two mean — **Authentication** and **Authorization**.  These are very similar word. But different is simple.

Authentication is **Identify**. This mean "Who are you?".  Authorization is **Access Control**. This mean "What is permitted for you?"

For example, **OpenID** is a technology for Identify and **OAuth** is a technology for Access Control.

## Multi-Factor Authentication(MFA)

MFA/2FA is very hot technology. But it doesn't mean to use SMS or biometrics. And please be careful about difference with **two-step verification**.

According to [NIST Special Publication 800-63-3 Digital Identity Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf), there is **three factor of authentication**.

- Something you know
- Something you have
- Something you are

***"Something you know"*** is knowledge which is known only right user. Password or PIN are typically examples.

***"Something you have"*** is property which is had only right user. SMS(Phone Number), mail address, token generator, hardware key/card, IP address and Geo-location are typically examples.

***"Something you are"*** is biometrics. Fingerprint, face and iris are typically examples. Smartphone and AI help this area today.

MFA is **a combination of over two factor**. This mean **2nd password is NOT 2FA**. It's **only two-step verification** with single factor. Because password and 2nd password are both ***"Something you know"*** .

Single factor is **easy to hack by same way**. So combination is important.

Especially  almost **attacker already knows about right ID and password**. Then we need to **additional factor** for important operation.

## Fraud detection

**Monitoring** and **Fraud detection** is very important part for Identification Management. Because **attacker already knows about right ID and password** . But we need defect fraud.

Internet Protocol Address **(IPA) Location**, **Geo-Location**  and **time** are important information for this.

Because if someone accessed in USA five minutes after being accessed in Japan, maybe it's **illegal access**. Such a access **should be rejected**.

## Risk-based authentication

Risk-based authentication is improvement of fraud detection. Sometime we use new PC and we move to another location.

If it's only provided fraud detection, we can't log-in in such a situation. It is NOT user-friendly.

So Risk-based authentication manages such a **irregular access patterns as risk**. And it requires more **additional authentication** like SMS, e-Mail and so on. This is very useful function.

In general, smartphone industry call this behavior as **two-step verification** with SMS authentication.

## Context-aware access Control (CAAC)

Context-aware access control is mainly for enterprise system. It is a extetnion of [role-based access control (RBAC)](https://en.wikipedia.org/wiki/Role-based_access_control).

It **dynamically** determines access capability according to the following factors.

- User
- Device
- Location
- Target system
- Target operation

For example, we can control access level by office or home. And it is able to **require additional authentication factor** like hardware-key when user is on their home.

[Azure AD Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview) and [Google Cloud IAP](https://cloud.google.com/iap/) provide this feature. It's key component for **Zero Trust Security**. This is only way for security control for SaaS. Because Cloud Age is **every access is Remote Access** . VPN is NOT enough now.

## Single Sign On (SSO)

**SSO** is not new technology for Enterprise. LDAP and Acitive Direcotry and each cloud vendor's IAMs provide this function. It's natural way for enterprise systems.

 Maybe someone may think that **SSO is for usability for employee**. But it's **NOT correct**.

**SSO is for security**. As you already know, **Identification Management is very complex system**. It's required a lot of features like MFA, Fraud Detection and monitoring and Context-aware access.

If we don't use SSO, individual system has own account. And user needs to manage their password. It **looks secure**.

But **it's difficult to make the best auth features for individual systems** and it's **not realistic scenario** to be managed many passwords **properly** by every user. Maybe **they use same password for every system** to help their brain memory. It's not secure.

So we **use SSO** for security with **trusted ID systems**. This is **the best practices!**

## Conclusion

This diagram is summary of Identification Management System.

![](https://thepracticaldev.s3.amazonaws.com/i/t861bvmob1i6p5wehraa.png)

Most importantly, **Identification Management System is very complex**. We **shouldn't make by ourself**.

If you make **a system for consumer**, you should use **Social Service ID** like Google, GitHub, Twitter and Facebook with **OpenID Connect**.

And if you make **a system for business**, you should use **IDaaS** like AzureAD with **SAML 2.0** or **OpenID Connect**.

It's the best practice and only way to avoid Identify Issues, I believe.

Happy Hacking !