1k VIEWS
Pinterest LinkedIn LINE

After a hard-fought 4 and a half years—starting with the formation of the working group—and then 6 hard-fought years, we have finally released OpenID Connect.

OpenID Connect forms an “identity layer” for the Internet. Let me explain briefly.

When people talk about layers, one commonly used model is the TCP/IP reference model[1]. Developed by the IETF, it divides the communication functions that Internet hosts should have into a layered structure, forming a model. It is also called the TCP/IP reference model or Internet protocol suite, among other names, and defines communication functions (communication protocols) by dividing them into 4 layers (RFC 1122). The 4th layer is called the application layer, but this refers strictly to communication services such as HTTP and FTP, not to what are commonly called “business applications.” The “business applications” that actual users use are built on top of it. The picture looks something like this.

（図１）ネットワーク層と業務アプリケーション層
(Figure 1) Network layer and business application layer

In Figure 1, I placed “authentication and authorization” inside an oval within the “business application layer.” I singled them out because these functions exist in every business application.

It is said that more than 95% of Internet security problems arise from poor “authentication and authorization.” The other day, I had an opportunity to hear Dr. Peter Tippett, the father of antivirus and malware detection[2]. He said, “From the standpoint of strengthening security, even if you perfected antivirus, firewalls, and every other security function, the benefit would not come close to what you could gain by improving identity functions just a little.”

What we have released is an international standard for taking those “authentication and authorization” functions out of individual application implementations and externalizing them as 1 layer—the “identity layer”—just like the network layer. A rough picture would look like Figure 2.

（図２）ネットワーク層、アイデンティティ層、アプリケーション・ソフト層
(Figure 2) Network layer, identity layer, and business application layer

Here, application software can securely perform “authentication and authorization” by exchanging information with the identity layer according to predefined standard procedures (protocols). By externalizing authentication and authorization functions in this way and outsourcing them to specialized software or services, application software no longer has to perform the extremely difficult task of getting “authentication and authorization” right itself. It can therefore avoid creating security holes caused by those functions and focus on its core competence: “application functionality.”

This release covers the following parts of the overall identity-layer framework.

OpenID Connect Core This is the core of everything, and by itself it makes basic authentication and authorization possible.
OpenID Connect Discovery This makes it possible to discover where the service providing authentication and authorization for each user is located.
OpenID Connect Dynamic Registration This specification enables application software (called a client) to dynamically register itself with the identity layer.
OAuth Multiple Response Type This defines some of the messages used by the specifications above.

Many companies have already announced support for OpenID Connect. Google has announced that it will migrate fully to OpenID Connect by April 2015, while Microsoft and Salesforce have already begun providing services. In Japan, Nomura Research Institute provides the technology as a backend for various companies, and SoftBank and Yahoo have already added support. Other companies that have announced support include, in no particular order, ForgeRock, CA, VMWare, AOL, and Cisco—an impressive group.

In addition, at Mobile World Congress in Barcelona, the organizer, GSMA, simultaneously announced “Mobile Connect,” a profile of OpenID Connect for mobile network operators. (I will write a separate article about this later.)

OpenID Connect is the product of the blood and sweat of many people. I would like to take this opportunity to thank everyone who has helped us.

[1] When people talk about layers, another commonly used model is the OSI reference model. Developed by the International Organization for Standardization (ISO), it divides the functions that computers should have for communication into a layered structure, forming a model. It is also called the OSI Basic Reference Model or the OSI model, among other names, and defines communication functions (communication protocols) by dividing them into 7 layers. The 7th layer is called the application layer, but this refers strictly to communication services such as HTTP and FTP, not to what is commonly called “application software.” The “application software” that actual users use is built on top of it.

[2] At the invitation-only International Identity Summit held at the White House (about 30 people?).

[3] Here I have broadly called it the “identity layer,” but in reality it is divided into a layer that issues tokens representing access rights, the so-called identity layer above it that exchanges identity data (attribute data associated with an entity), and an access-control layer that uses those layers to perform actual access control.

(Revision history)

  • 2014/3/1 – Initially written using the OSI reference model, but changed to the TCP/IP reference model because the former did not fit well. Also changed the list to a table.

Related posts