论文标题
基于弹性风险的自适应身份验证和授权（RAD-AA）框架
Resilient Risk based Adaptive Authentication and Authorization (RAD-AA) Framework
论文作者
论文摘要
在最近的网络攻击中，凭证盗用已成为进入系统的主要向量之一。一旦攻击者在系统中有立足点，他们就会使用包括令牌操作在内的各种技术来提升特权和访问受保护的资源。这使身份验证和基于令牌的授权成为安全且弹性的网络系统的关键组件。在本文中，我们讨论了这样一个安全且有弹性的身份验证和授权框架的设计注意事项，该框架能够根据风险分数和信任概况进行自我适应。我们将此设计与OAUTH 2.0，OpenID Connect和SAML 2.0等现有标准进行比较。然后，我们研究了大步和意大利面这样的流行威胁模型，并总结了针对常见和相关威胁向量的拟议建筑的弹性。我们将此框架称为基于弹性风险的自适应身份验证和授权（RAD-AA）。拟议的框架过多地增加了对手发射和维持任何网络攻击的成本，并为关键基础设施提供了急需的力量。我们还讨论了自适应引擎的机器学习方法（ML）方法，以准确地对交易进行分类并达到风险分数。
In recent cyber attacks, credential theft has emerged as one of the primary vectors of gaining entry into the system. Once attacker(s) have a foothold in the system, they use various techniques including token manipulation to elevate the privileges and access protected resources. This makes authentication and token based authorization a critical component for a secure and resilient cyber system. In this paper we discuss the design considerations for such a secure and resilient authentication and authorization framework capable of self-adapting based on the risk scores and trust profiles. We compare this design with the existing standards such as OAuth 2.0, OpenID Connect and SAML 2.0. We then study popular threat models such as STRIDE and PASTA and summarize the resilience of the proposed architecture against common and relevant threat vectors. We call this framework as Resilient Risk based Adaptive Authentication and Authorization (RAD-AA). The proposed framework excessively increases the cost for an adversary to launch and sustain any cyber attack and provides much-needed strength to critical infrastructure. We also discuss the machine learning (ML) approach for the adaptive engine to accurately classify transactions and arrive at risk scores.
