Two-factor authentication

From Wikipedia, the free encyclopedia

Contents 1 Summary 2 Tokens 2.1 Biometrics 2.2 Mobile phones 2.3 Smart cards 2.4 Universal Serial Bus 2.5 Other types 3 The challenges of authentication 3.1 Product proliferation 3.2 User password management 3.3 Interoperability of authentication mechanisms 3.4 Cost effectiveness 3.5 Password security 3.6 Software security 4 Market segments 5 Related technologies 6 Examples 7 See also 8 References 9 External links

[edit] Summary

Main article: Authentication factor

In order to understand Two-factor authentication, it's important to understand the three methods by which people authenticate themselves to digital systems:

There are three universally recognized factors for authenticating individuals:

• 'Something you know', such as a password, PIN or an out of wallet response.
• 'Something you have', such as a mobile phone, credit card or hardware security token.
• 'Something you are', such as a fingerprint, a retinal scan, or other biometric.

A system is said to leverage Two-factor authentication (T-FA) (or dual factor authentication) when it requires at least two of the authentication form factors mentioned above. This contrasts with traditional password authentication, which requires only one authentication factor (such as knowledge of a password) in order to gain access to a system.

Common implementations of two-factor authentication use 'something you know' (a password) as one of the two factors, and use either 'something you have' (a physical device) or 'something you are' (a biometric such as a fingerprint) as the other factor. A common example of T-FA is a bank card (credit card, debit card); the card itself is the physical "something you have" item, and the personal identification number (PIN) is the "something you know" password that goes with it. See Chip and PIN for more information on this.

Using more than one factor is also called strong authentication; using just one factor, for example just a static password, is considered by some to be weak authentication. (Strong authentication also includes multi-factor that do not include a physical factor, such as a card or dongle. The multiple factors can both be online for strong authentication.)

According to proponents, T-FA could drastically reduce the incidence of online identity theft, and other online fraud, because the victim's password would no longer be enough to give a thief access to their information. However, T-FA is still vulnerable to trojan and man-in-the-middle attacks.^[1]

Deployment of T-FA tools such as smart cards and USB tokens appears to be increasing. More organizations are adding a layer of security to the desktop that requires users to physically possess a token, and have knowledge of a PIN or password in order to access company data. However, there are still some drawbacks to two-factor authentication that are keeping the technology from widespread deployment. Some consumers have difficulty keeping track of one more object in their life. Also, many two-factor authentication solutions are proprietary and protected by patents. The result is a substantial annual fee per person protected and a lack of interoperability.

[edit] Tokens

Main article: Security token

The most common forms of the 'something you have' are smart cards and USB tokens. Differences between the smart card and USB token are diminishing; both technologies include a microcontroller, an OS, a security application, and a secured storage area.

[edit] Biometrics

In both cases, vendors are beginning to add biometric readers on the devices, thereby providing multi-factor authentication. Users biometrically authenticate via their fingerprint to the smart card or token and then enter a PIN or password in order to open the credential vault. However, while this type of authentication is suitable in limited application, this solution may become unacceptabily slow and comaparatively expensive when a large number of users are involved. In addition, it is extremely vulnerable to a replay attack: once the biometric information is compromised, it may easily be replayed unless the reader is completely secure and guarded. Also, biometric information can not be changed.

[edit] Mobile phones

A new category of T-FA tools transforms the PC user's mobile phone into a token device using SMS messaging or instigating an interactive telephone call or using standard internet protocols such as http or https.

While such a method can simplify deployment, reduce logistical costs and remove the need for a separate hardware token devices, there are trade-offs. Users may incur fees for text messages or for WAP/HTTP services. However Out Of Band authentication solutions can counter emerging threats such as PC-based keyloggers. Wireless-based one-time password systems are susceptible to Man in the middle attacks just like tokens. Preventing MITM attacks requires strong mutual authentication Companies have also succeeded in incorporating a security token into a standard credit card.

[edit] Smart cards

Smart cards are about the same size as a credit card. Some vendors offer smart cards that perform both the function of a proximity card and network authentication. Users can authenticate into the building via proximity detection and then insert the card into their PC to produce network logon credentials. They can also serve as ID badges. The downside is that the smart card is a bigger device, the card reader is an extra expense.

[edit] Universal Serial Bus

A USB token has different form factor; it can't fit in a wallet, but can easily be attached to a key ring. A USB port is standard equipment on today's computers, and USB tokens generally have a much larger storage capacity for logon credentials than smart cards.

[edit] Other types

Some manufacturers also offer a One Time Password (OTP) token. These have an LCD screen which displays a pseudo-random number consisting of 6 or more alphanumeric characters (sometimes numbers, sometimes combinations of letters and numbers, depending upon vendor and model). This pseudo-random number changes at pre-determined intervals, usually every 60 seconds, but they can also change at other time intervals or after a user event, such as the user pushing a button on the token. Tokens that change after a pre-determined time are called time-based, and tokens that require a user event are referred to as sequence-based (since the interval value is the current sequence number of the user events, i.e. 1, 2, 3, 4, etc.). When this pseudo-random number is combined with a PIN or password, the resulting passcode is considered two factors of authentication (something you know with the PIN/password, and something you have from the OTP token). There are also hybrid-tokens that provide a combination of the capabilities of smartcards, USB tokens, and OTP tokens.

[edit] The challenges of authentication

So if smart cards or USB tokens provide all this security, why isn't everybody deploying them? It would seem to be a logical line of defense against intrusions and information loss.

Despite the security advantages of strong authentication its adoption is not yet widespread. There are several factors that contribute to this.

[edit] Product proliferation

The first challenge to face is the difficulty of deploying the client PC software required to make these systems work. Most vendors have created separate installation packages for network login, Web access credentials and VPN connection credentials. In other words, there may be four or five different software packages to push down to the client PC in order to make use of the token or smart card. This translates to four or five packages on which version control has to be performed, and four or five packages to check for conflicts with business applications. If access can be operated using web pages, it is possible to limit the overheads outlined above to a single application.

[edit] User password management

Users have natural problems retaining a single authentication factor like a password. It is not uncommon for users to be expected to remember dozens of unique passwords. T-FA where one factor is a password or PIN code, does not eliminate this problem. One possible solution is to have the second factor be a biometric, instead of an entity that the user needs to memorize.

[edit] Interoperability of authentication mechanisms

Two-factor authentication is not standardized. There are various implementations of it. Therefore, interoperability is an issue.

[edit] Cost effectiveness

Adding a second factor in the authentication mechanism could lead to increase in costs for implementation and maintenance. Most systems are proprietary and charge an annual fee per user in the $50-100 USD range. Deployment of hardware tokens is logistical challenge. Hardware tokens may get damaged or lost and issuance of tokens in large industries such as banking or even within large enterprises needs to be managed. Therefore, an analysis on the cost and benefit should be made before deciding on a stronger authentication mechanism.

[edit] Password security

Another concern is the security of the T-FA tools and their systems. Several products store passwords in plain text for either the token or smart card software or its associated management server. In either case this largely negates one factor of the authentication since although an intruder could easily find the password/PIN used to authenticate to the device, they still need to be in possession of the relevant token or smart card for this type of attack to work.

There is a further argument that purports that there is nothing to stop a user (or intruder) from manually providing logon credentials that are stored on a token or smart card. For example to show all passwords stored in Internet Explorer, all an intruder has to do is to boot the Microsoft Windows OS into safe mode (with network support) and to scan the hard drive (using certain freely available utilities). However, making it necessary for the physical token to be in place at all times during a session can negate this.

[edit] Software security

Another concern when deploying smart cards, USB tokens, or other T-FA systems is the security of the software loaded on to users' computers. ^[2] A token may store a user's credentials securely, but the potential for breaking the system is then shifted to the software interface between the hardware token and the OS, potentially rendering the added security of the T-FA system useless.

[edit] Market segments

Market segments in regards to two-factor authentication are:

• Enterprise
  • Secure remote access
  • Enterprise authentication
  • B2B transactions
• Consumer
  • Online banking
  • Electronic commerce
  • ISP's
• Government
  • Common authentication
  • Biometrics

[edit] Related technologies

Two-factor authentication solutions sometimes includes technologies to generate one-time passwords, a few solutions also include single sign-on (SSO) technology.

[edit] Examples

Some examples of two-factor authentication include:

• America Online's Passcode service, in which users get a small handheld six-digit numeric code key based around RSA's SecurID product line. To log onto an AOL account equipped with the service, users must enter the six-digits, which refresh on the device every 60 seconds, in addition to the user's standard password.
• United States Department of Defense is implementing a Common Access Card, a smartcard with PIN based on ActivIdentity technology.
• IBM/Lenovo's new ThinkPad, which includes a fingerprint reader that signs users into all their passwords.
• The DBS iB Secure Device from the Development Bank of Singapore.
• RSA's SecurID product.
• Deepnet Security's Deepnet Unified Authentication Platform product.
• VeriSign's Unified Authentication managed service, in which enterprises deploy USB tokens to all their users and VeriSign manages the infrastructure.
• enCap provides a mobile phone based solution for user security services
• ActivIdentity's Strong Authentication solutions with smart cards, one-time password tokens and USB tokens
• FreeAuth Project offers a free T-FA option, with all source code available.
• Search VMware's appliance marketplace for two factor authentication

[edit] See also

• Mutual authentication
• Identity management
• Security token

[edit] References

1. ^ The Failure of Two-Factor Authentication (Bruce Schneier, March 2005)
2. ^ Token Effort, "USB tokens aren't as strong as you think." (TechTarget, Jul 2004)

[edit] External links

• A 3 minute video explaining two factor authentication from ZDNet
• Why Authenticating Once is Not Enough
• Microsoft to abandon passwords, Microsoft preparing to dump passwords in favour of two-factor authentication in forthcoming versions of Windows (vnunet.com, 14 Mar 2005)
• Banks to Use Two-factor Authentication by End of 2006, (slashdot.org, 20 Oct 2005)
• White Paper: Key Human-Factors Issues Affecting Consumer Two-Factor Authentication and Mutual Authentication (July 2006)
• Pundits blaming 2 factor authentication again
• How to secure SSH with two-factor authentication
• Authentication Strength Article from AuthenticationWorld