Towards Secure and Dependable Authentication and Authorization Infrastructures

We propose a resilience architecture for improving the security and dependability of authentication and authorization infrastructures, in particular the ones based on RADIUS and OpenID. This architecture employs intrusion-tolerant replication, trusted components and entrusted gateways to provide survivable services ensuring compatibility with standard protocols. The architecture was instantiated in two prototypes, one implementing RADIUS and another implementing OpenID. These prototypes were evaluated in fault-free executions, under faults, under attack, and in diverse computing environments. The results show that, beyond being more secure and dependable, our prototypes are capable of achieving the performance requirements of enterprise environments, such as IT infrastructures with more than 400k users.

I. Introduction

Despite their widespread use, Authentication and Authorization Infrastructures (AAIs) such as RADIUS-based network access controllers does not implement security mechanisms able to tolerate advanced persistent threads [1], [2], large scale distributed denial of service [3], [4] or even to protect authentication information confidentiality in case of intrusions. Beyond that, current available and widely deployed services such as RADIUS and OpenID have several vulnerabilities regarding their security and dependability [5]. Given the importance AAIs in modern networked systems, these limitations can be considered as one of top threats in future network environments [5].