Battle Brews Over Authentication Schemes

Can Microsoft avoid the Liberty Alliance Project? Industry group intends to create an open solution allowing decentralized single sign-on capabilities and authorization from any device connected to the Internet.

by Thor Olavsrud of internetnews.com [September 27, 2001]

Sun Microsystems (NASDAQ:SUNW) and 32 well-known, industry-leading companies raised their standard Wednesday in what is rapidly shaping up to be the Internet's newest battle ground: authentication systems.

The most noted industry leader that was excluded from the new consortium, though, was Microsoft Corp., (NASDAQ:MSFT) which last week fired the first salvo when it put out a call for a "federated" authentication system—one in which competitors are allowed to license Microsoft's Passport system for their own use.

The strategic importance of authentication systems has evolved alongside an increasing focus on Web services, a model which Burton Group analyst Gary Hein calls "the latest—and most credible—effort to define a workable distributed computing framework for the Internet, one that supports inter-enterprise communication and interoperability among applications."

Microsoft, according to Burton, is "betting the company" on the importance of that model with its .NET initiative. But Microsoft is not the only one to recognize the import of the model, and unwilling to let Microsoft make its authentication system become the defacto standard that makes Web services feasible, Sun and its compatriots Wednesday formed the Liberty Alliance Project to develop and deploy an open solution.

"It's recently become clear that the software for managing user identity and authentication is one of the key building blocks of the emerging Internet operating system," said Tim O'Reilly, founder and chief executive officer of technology publisher O'Reilly & Associates and an activist for open source software and Internet standards.

"It's so fundamental that a widespread consensus has emerged that this is a technology that shouldn't be owned or controlled by any one player," O'Reilly continued. "Instead, we need an open, distributed system with implementations available from multiple technology providers and identities issued by many parties operating in a web of trust. Project Liberty is an important step in that direction."

Sun said the charter members of the Liberty Alliance Project represent a broad global spectrum of industries, and that they intend to create an open, federated solution for network identity that allows ubiquitous single sign-on, decentralized authentication and open authorization from any device connected to the Internet—from personal computers to cellular phones, televisions, automobiles, credit cards and point-of-sale terminals.

Members include ActivCard, American Airlines, the Apache Software Foundation, Bank of America, Bell Canada Enterprises, Cingular Wireless, Cisco Systems, CollabNet, Dun and Bradstreet, eBay, Entrust, Fidelity Investments, Gemplus, General Motors, Global Crossing, i2, Intuit, Liberate Technologies, Nokia, NTT DoCoMo, O'Reilly & Associates, Openwave, RealNetworks, RSA Security, Sabre, Schlumberger, Sony Corp., Sprint, Sun Microsystems, Travelocity, United Airlines, Verisign, Vodafone and others.

Esther Dyson, chairman of EDventure Holdings and former chairman of ICANN, said security and identity are facets of almost every big issue in the digital world today.

"They touch it all: privacy, anonymity, integrity of data and safety assets, freedom of speech, legitimacy, trust and trust worthiness, branding, visibility of marketers and visibility to marketers," Dyson said. Therefore, it's important for individuals to have a convenient way to identify themselves (and their counterparts)."

The Liberty Alliance Project has announced three main objectives:

• To allow individual consumers and businesses to maintain personal information securely.
• To provide a universal, open standard for single sign-on which users and service providers can rely upon, and leverage to interoperate.
• To provide an open standard for network identity spanning all Internet-connected devices.

"Interoperability requires cooperation and collaboration, something Sun understands and endorses in the evolution of its systems and software platform," said Scott McNealy, chairman and chief executive officer of Sun. "Identity is a common thread throughout all network services—the Liberty Alliance Project will leverage and cooperate with existing open, and interoperable standards that will unleash an Internet that roams with you and your customers, wherever they and your business partners take you."

—End