jump to navigation

Advanced Authentication Technologies April 13, 2015

Posted by melihbilen in Security.

We are living in world in which we should keep in our minds multiple usernames and passwords. Nowadays, each website, web service or even applications requires signing up and login in order to be able to use that service. Each person should create a username and password and every time they want to use that service they should remember their credentials. People cannot have single username and password for multiple systems. It creates a single point of failure. We cannot survive without having multiple usernames and passwords. Although we have different username and passwords, still we are not safe enough with single level of authentication.  When we talk about authentication factors, there are 3 different factors which are defined by United States Government.

  • Something only the user knows (e.g., password, PIN, pattern);
  • Something only the user has (e.g., ATM card, smart card, mobile phone); and
  • Something only the user is (e.g., biometric characteristic, such as a fingerprint).

Since, single factor authentication is not enough, systems should have two level authentications. This two level authentication should include two factors from list above. Username and passwords are in the category of something only user knows. This type of information is called knowledge factors. Systems allow user to create his password and then they expect user to remember this information when they are trying to be authenticated. Passwords and PINs (Personal Identification Number) are most common information which user knows.

When we talk about user’s possessions, we can give example of tokens with a display, connected tokens, Magnetic stripe cards, SMS one time password or Mobile applications. All these approaches can be defined as something user has. All of these are being used in different systems. ATM machines use magnetic stripe cards with PINs. Tokens are used by companies when they want to protect their systems in a more secured way. SMS one time passwords can be seen in mail services, applications, banking systems. Google, Amazon, Facebook also use this type of authentication. Since, it requires only a basic cell phone with cellular connectivity; it is a very basic but powerful way.

Third and maybe the strongest approach towards authentication is using something only user is. Biometric characteristics can be given as an example of this kind of authentication. In this approach, system uses characteristic information of that user to confirm user identity. Fingerprint sensors or facial recognition systems are examples of biometric authentication. Although, these are most secure ways to authenticate, they have some problems in real world in terms of usability, cost and regulations.



No comments yet — be the first.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: