Risk-Based Authentication for OpenStack: A Fully Functional Implementation and Guiding Example

TL;DR

This paper presents the first fully functional open source implementation of Risk-Based Authentication for OpenStack, demonstrating its feasibility and providing a practical example to encourage adoption in cloud services.

Contribution

It introduces a complete RBA implementation for OpenStack based on Freeman et al.'s algorithm, addressing implementation complexity and serving as a guiding example.

Findings

First open source RBA implementation for OpenStack

Initial reference tests demonstrating effectiveness

Blueprint for developers to adopt RBA in cloud services

Abstract

Online services have difficulties to replace passwords with more secure user authentication mechanisms, such as Two-Factor Authentication (2FA). This is partly due to the fact that users tend to reject such mechanisms in use cases outside of online banking. Relying on password authentication alone, however, is not an option in light of recent attack patterns such as credential stuffing. Risk-Based Authentication (RBA) can serve as an interim solution to increase password-based account security until better methods are in place. Unfortunately, RBA is currently used by only a few major online services, even though it is recommended by various standards and has been shown to be effective in scientific studies. This paper contributes to the hypothesis that the low adoption of RBA in practice can be due to the complexity of implementing it. We provide an RBA implementation for the open source cloud management software OpenStack, which is the first fully functional open source RBA implementation based on the Freeman et al. algorithm, along with initial reference tests that can serve as a guiding example and blueprint for developers.