Authentication

From Wikipedia, the free encyclopedia

For other uses of the terms "authentication", "authentic" and "authenticity", see authenticity.

Authentication αυθεντικός = real or genuine, from 'authentes' = author ) is the act of establishing or confirming something (or someone) as authentic, that is, that claims made by or about the thing are true. Authenticating an object may mean confirming its provenance, whereas authenticating a person often consists of verifying their identity. Authentication depends upon one or more authentication factors.

In computer security, authentication is the process of attempting to verify the digital identity of the sender of a communication such as a request to log in. The sender being authenticated may be a person using a computer, a computer itself or a computer program. A blind credential, in contrast, does not establish identity at all, but only a narrow right or status of the user or program.

In a web of trust, "authentication" is a way to ensure users are who they say they are—that the user who attempts to perform functions in a system is in fact the user who is authorized to do so.

To distinguish authentication from the closely related term authorization, the short-hand notations A1 (authentication) and A2 (authorization) are occasionally used. The terms AuthN / AuthZ or Au / Az are also used to make this distinction in some communities.

The problem of authorization is often thought to be identical to that of authentication; many widely adopted standard security protocols, obligatory regulations, and even statutes are based on this assumption. However, more precise usage describes authentication as the process of verifying a person's identity, while authorization is the process of verifying that a known person has the authority to perform a certain operation. Authentication, therefore, must precede authorization. For example, when you show proper identification to a bank teller, you could be authenticated by the teller, and you would be authorized to access information about your bank accounts. You would not be authorized to access accounts that are not your own.

Since authorization cannot occur without authentication, the former term is sometimes used to mean the combination of authentication and authorization.

In Packaging and labelling, authentication refers to the use of special seals, labels, or markings which indicate that the package and contents are authentic. Sometimes substitute pharmaceuticals, perfume, fashion clothing, etc. are marketed as authentic when, if fact, they are not.

1 Access Control
2 Multifactor authentication
- 2.1 Strong authentication
3 eAuthentication
4 See also
5 External links

[edit] Access Control

One familiar example is access control. A computer system supposed to be used only by those authorized must attempt to detect and exclude the unauthorized. Access to it is therefore usually controlled by insisting on an authentication procedure to establish with some established degree of confidence the identity of the user, thence granting those privileges as may be authorized to that identity. Common examples of access control involving authentication include:

withdrawing cash from an ATM.
controlling a remote computer over the Internet.
using an Internet banking system.

However, note that much of the discussion on these topics is misleading because terms are used without precision. Part of this confusion may be due to the 'law enforcement' tone of much of the discussion. No computer, computer program, or computer user can 'confirm the identity' of another party. It is not possible to 'establish' or 'prove' an identity, either. There are tricky issues lurking under what appears to be a straightforward surface.

It is only possible to apply one or more tests which, if passed, have been previously declared to be sufficient to proceed. The problem is to determine which tests are sufficient, and many such are inadequate. There have been many instances of such tests having been spoofed successfully; they have by their failure shown themselves, inescapably, to be inadequate. Many people continue to regard the test(s) -- and the decision to regard success in passing them—as acceptable, and blame their failure on 'sloppiness' or 'incompetence' on the part of someone. The problem is that the test was supposed to work in practice -- not under ideal conditions of no sloppiness or incompetence—and did not. It is the test which has failed in such cases. Consider the very common case of a confirmation email which must be replied to in order to activate an online account of some kind. Since email can easily be arranged to go to or come from bogus and untraceable addresses, this is just about the least robust authentication possible. Success in passing this test means little, without regard to sloppiness or incompetence.

[edit] Multifactor authentication

Main article: Two-factor authentication

The authentication factors for humans are generally classified into four cases:

Something the user is (e.g., fingerprint or retinal pattern, DNA sequence (there are assorted definitions of what is sufficient), voice pattern (again several definitions), signature recognition, unique bio-electric signals produced by the living body, or other biometric identifier)
Something the user has (e.g., ID card, security token, software token or cell phone)
Something the user knows (e.g., a password, a pass phrase or a personal identification number (PIN))
Something the user does (e.g., voice recognition, signature, or gait)

Sometimes a combination of methods is used, e.g., a bank card and a PIN, in which case the term 'two-factor authentication' is used.

Historically, fingerprints have been used as the most authoritative method of authentication, but recent court cases in the US and elsewhere have raised fundamental doubts about fingerprint reliability. Other biometric methods are promising (retinal and fingerprint scans are an example), but have shown themselves to be easily spoofable in practice.

In a computer data context, cryptographic methods have been developed (see digital signature and challenge-response authentication) which are currently not spoofable if (and only if) the originator's key has not been compromised. That the originator (or anyone other than an attacker) knows (or doesn't know) about a compromise is irrelevant. It is not known whether these cryptographically based authentication methods are provably secure since unanticipated mathematical developments may make them vulnerable to attack in future. If that were to occur, it may call into question much of the authentication in the past. In particular, a digitally signed contract may be questioned when a new attack on the cryptography underlying the signature is discovered.

[edit] Strong authentication

The U.S. Government's National Information Assurance Glossary defines strong authentication as:

Layered authentication approach relying on two or more authenticators to establish the identity of an originator or receiver of information.

[edit] eAuthentication

The eAuthentication was defined by Arnnei Speiser in 2003 as the Web Based service that provides authentication to end users accessing (logging into) an Internet service.

The eAuthentication is similar to Credit Card verification for eCommerce web sites. The verification is done by a dedicated service that receives the input and returns success or fail indication.

For example, an end user wishes to enter his eBuy or eTrade web site. He gets the Login web page and is required to enter his user ID and a Password or in the more secured sites – his One Time Password. The information is transmitted to the eAuthentication service as a query. If the service returns Success – the end user is permitted into the eTrade service with his privileges as a user.