Evolution of User Authentication Practices: Moving Beyond IP Filtering
I
P
F
i
l
t
e
r
i
n
g
i
s
O
b
s
o
l
e
t
e
W
h
e
r
e
d
o
w
e
g
o
f
r
o
m
h
e
r
e
?
Rich Wenger, E-Resource Systems Manager
MIT Library
T
O
C
In the beginning…
The march of technology
Playing games
Two broad goals
A way forward
Page 2
I
n
t
h
e
b
e
g
i
n
n
i
n
g
.
.
Early days of the internet
No portable devices
Static IP addresses
Unspoken assumptions
Page 3
T
h
e
m
a
r
c
h
o
f
t
e
c
h
n
o
l
o
g
y
Portable PCs, laptops, tablets, smart phones
DHCP – non-static IP addresses
Off-campus users
Page 4
P
l
a
y
i
n
g
g
a
m
e
s
Virtualization at multiple levels
Pretending that nothing had changed
VPN and proxy servers
Page 5
B
o
t
t
o
m
l
i
n
e
The assumption that an IP address = a physical location =
an authenticated, authorized user is
false
.
IP filtering is about
where
a user is (which is completely
obscured by proxy servers and VPNs), not
who
the user
is.
Page 6
B
o
t
t
o
m
l
i
n
e
IP filtering
Conflates IP address with location and identity.
Creates proprietary portals, the opposite of modern
Discovery practices.
Is a maintenance nightmare.
Is unsecure and easily exploitable.
“Without IP filtering, Scihub could not exist”*
* Atypon presentation on Piracy at SSP conference in Boston, June 2017
Page 7
T
w
o
a
r
e
a
s
o
f
c
o
n
c
e
r
n
W
e
n
e
e
d
t
o
:
Improve the user experience.
Respond to the security problems.
Page 8
I
m
p
r
o
v
i
n
g
t
h
e
u
s
e
r
e
x
p
e
r
i
e
n
c
e
The point of referral for authentication must be located
at the providers’ sites, not in our portals.
Affiliation defaults must be preserved across browser
sessions.
All devices must be robustly supported.
Page 9
S
e
c
u
r
i
t
y
We need to:
Focus on
who
the patron is, not
where
they are.
Use institutional credentials.
Arrest the proliferation of resource-specific
userids and passwords.
Support SSO across all devices.
Page 10
A
w
a
y
f
o
r
w
a
r
d
Federated Identity Management, robustly implemented
by providers and subscribers.
SAML-based systems
Ex. Shibboleth, OpenAthens, etc.
Federated metadata.
Authentication referral at the point of need.
Use of institutional credentials.
Support for affiliation at multiple institutions.
Page 11
F
I
M
FIM has been available for many years, but its uptake has
been halting and sporadic.
Providers and subscribers were/are each waiting for the
other to take the initiative.
SAML-based systems are becoming ubiquitous, but the
quality of implementations varies widely.
Page 12
R
A
2
1
I
n
i
t
i
a
t
i
v
e
R
A
2
1
,
a
c
o
n
v
e
r
g
e
n
c
e
o
f
e
f
f
o
r
t
s
b
y
STM
Scientific, Technical, and Medical publishers
PDR
Pharma Documentation Ring
URA
Universal Resource Access
Page 13
R
A
2
1
I
n
i
t
i
a
t
i
v
e
RA21
SAML-based Federated ID Management.
Authentication at the point of need.
Collaboration on a set of recommended best
practices for providers
and
subscribers.
Open process.
Page 14
R
A
2
1
•
Addresses issues important to academic libraries
Privacy
Walk-ins
Protection of personally-identifying history and usage
data
Uneven quality of some providers’ SAML
implementations
Page 15
R
A
2
1
Improved user experience
-
Authentication at the point of need
-
Single Sign On (SSO)
-
Comprehensive device support
-
Support for multiple institutional affiliations
Page 16
R
A
2
1
Simplified technical environment
-
More granular control
-
Federated metadata
-
No need to maintain IP ranges with providers
-
Reduced dependence on proxy servers
Page 17
R
A
2
1
Challenges
-
Gaining library management’s attention to this issue
-
Getting buy-in and support from campus IT
-
Resisting fragmentation of effort
Page 18
R
A
2
1
P
a
r
t
i
c
i
p
a
n
t
s
Steering Committee
Participants
Page 19
C
a
s
e
s
t
u
d
y
Improve the user experience of students and
researchers
https://scholarlykitchen.sspnet.org/2015/11/13/dismantl
ing-the-stumbling-blocks-that-impede-researcher-access-
to-e-resources/
Page 20
A
w
a
y
f
o
r
w
a
r
d
A goal to work toward,
NOT
an abrupt change
•
Dual stack support for the foreseeable future
•
Libraries need to get involved
I
f
w
e
d
o
t
h
i
s
c
a
r
e
f
u
l
l
y
a
n
d
w
e
l
l
,
i
t
s
h
o
u
l
d
b
e
m
i
n
i
m
a
l
l
y
d
i
s
r
u
p
t
i
v
e
t
o
u
s
e
r
s
.
Page 21
F
i
n
i
s
Rich Wenger
rwenger@mit.edu
Phone
617-253-0035
Page 22
The article explores the obsolescence of IP filtering in user authentication, highlighting the challenges posed by evolving technology and the limitations of IP-based authentication methods. It discusses the shift towards improving user experience and addressing security concerns by focusing on user identity rather than physical location. The need for modern authentication practices, such as institutional credentials and single sign-on solutions, is emphasized to enhance security and convenience for users accessing online resources.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
IP Filtering is Obsolete Where do we go from here? Rich Wenger, E-Resource Systems Manager MIT Library
TOC In the beginning The march of technology Playing games Two broad goals A way forward Page 2
In the beginning.. Early days of the internet No portable devices Static IP addresses Unspoken assumptions Page 3
The march of technology Portable PCs, laptops, tablets, smart phones DHCP non-static IP addresses Off-campus users Page 4
Playing games Virtualization at multiple levels Pretending that nothing had changed VPN and proxy servers Page 5
Bottom line The assumption that an IP address = a physical location = an authenticated, authorized user is false. IP filtering is about where a user is (which is completely obscured by proxy servers and VPNs), not who the user is. Page 6
Bottom line IP filtering Conflates IP address with location and identity. Creates proprietary portals, the opposite of modern Discovery practices. Is a maintenance nightmare. Is unsecure and easily exploitable. Without IP filtering, Scihub could not exist * * Atypon presentation on Piracy at SSP conference in Boston, June 2017 Page 7
Two areas of concern We need to: Improve the user experience. Respond to the security problems. Page 8
Improving the user experience The point of referral for authentication must be located at the providers sites, not in our portals. Affiliation defaults must be preserved across browser sessions. All devices must be robustly supported. Page 9
Security We need to: Focus on who the patron is, not where they are. Use institutional credentials. Arrest the proliferation of resource-specific userids and passwords. Support SSO across all devices. Page 10
A way forward Federated Identity Management, robustly implemented by providers and subscribers. SAML-based systems Ex. Shibboleth, OpenAthens, etc. Federated metadata. Authentication referral at the point of need. Use of institutional credentials. Support for affiliation at multiple institutions. Page 11
FIM FIM has been available for many years, but its uptake has been halting and sporadic. Providers and subscribers were/are each waiting for the other to take the initiative. SAML-based systems are becoming ubiquitous, but the quality of implementations varies widely. Page 12
RA21 Initiative RA21, a convergence of efforts by STM Scientific, Technical, and Medical publishers PDR Pharma Documentation Ring URA Universal Resource Access Page 13
RA21 Initiative RA21 SAML-based Federated ID Management. Authentication at the point of need. Collaboration on a set of recommended best practices for providers and subscribers. Open process. Page 14
RA21 Addresses issues important to academic libraries Privacy Walk-ins Protection of personally-identifying history and usage data Uneven quality of some providers SAML implementations Page 15
RA21 Improved user experience - Authentication at the point of need - Single Sign On (SSO) - Comprehensive device support - Support for multiple institutional affiliations Page 16
RA21 Simplified technical environment - More granular control - Federated metadata - No need to maintain IP ranges with providers - Reduced dependence on proxy servers Page 17
RA21 Challenges - Gaining library management s attention to this issue - Getting buy-in and support from campus IT - Resisting fragmentation of effort Page 18
RA21 Participants Steering Committee Participants Page 19
Case study Improve the user experience of students and researchers https://scholarlykitchen.sspnet.org/2015/11/13/dismantl ing-the-stumbling-blocks-that-impede-researcher-access- to-e-resources/ Page 20
A way forward A goal to work toward, NOT an abrupt change Dual stack support for the foreseeable future Libraries need to get involved If we do this carefully and well, it should be minimally disruptive to users. Page 21
Finis Rich Wenger rwenger@mit.edu Phone 617-253-0035 Page 22
