SURFconext Strong Authentication allows institutions to secure access to cloud-based services linked to SURFconext more effectively. Better security is particularly critical for cloud services handling more sensitive data. Strong authentication is available at an additional fee for all institutions in higher education and research that are already connected to SURFconext.
Institutions increasingly use cloud services that handle sensitive data, such as eHRM, Student Information Systems and applications with patent-sensitive research data or privacy-sensitive patient information. Such services require stronger forms of authentication than a username and password in order to limit the risk of any security incidents.
The availability of Strong Authentication functionality enables institutions to enforce strong authentication for cloud services linked to SURFconext. SURFconext acts as a link between the institutions and service providers. Institutions can select the services they wish to secure with stronger authentication.
SURFconext Strong Authentication allows access to cloud services via SMS, Tiqr (smartphone app) or YubiKey (USB hardware token). Users first log in with their institutional account and, as an additional step, are then prompted to confirm their identity with one of the means of authentication. The result is a second layer of security: authentication requires both entry of account details and the use of an item in the user's possession.
How does it work?
How does SURFconext Strong Authentication work? Users must first register their telephone (SMS or Tiqr app) or Yubikey USB token for their account. The user will have to visit their institution's service desk once to have an authorized employee verify his identity who will then bind their token to the user's account.Only then will the user's telephone or USB key be activated.
From that point on, the user can log in to any services designated for strong authentication using the two-step login procedure. That makes SURFconext Strong Authentication convenient for users, yet secure for institutions and service providers.
SURFconext Strong Authentication supports three different types of tokens: SMS, Tiqr, YubiKey.
- NB: Available in fall 2015
- Authentication app for Apple iOS and Android smartphones
- Smartphone must have camera and active internet connection.
- User must download Tiqr app for iOS or Android
- A Tiqr account for SURFconext Strong Authentication must be created for future login
- User authenticates with app-specific PIN code after receiving a push-notification on their phone
- If push-notifications are disabled a QR code must scanned to authenticate.
The architecture of the SURFconext Strong Authentication is designed as such that SURFnet can add other authentication tokens in the future. If such a need arises within member institutions, SURFnet will first research technical capabilities of other token solutions and perform a cost-benefit analysis, before deciding if adding the extra token to SURFconext is indeed feasible. Please note that SURFconext Strong Authentication is designed to facilitate strong authentication for cloud applications. As such, for any new token solution to be connected to SURFconext Strong Authentication, SAML2.0 compliancy and cloud based are necessary prerequisites.
Our roadmap already foresees in some activities in 2016 and beyond to explore the possibilities to add other authentication tokens to SURFconext Strong Authentication.