![ATMUser](https://upload.wikimedia.org/wikipedia/commons/6/69/ATMUser.140209.jpg)
Authentication (from ''authentikos'', "real, genuine", from αὐθέντης ''authentes'', "author") is the act of
proving an
assertion, such as the
identity
Identity may refer to:
* Identity document
* Identity (philosophy)
* Identity (social science)
* Identity (mathematics)
Arts and entertainment Film and television
* ''Identity'' (1987 film), an Iranian film
* ''Identity'' (2003 film), ...
of a computer system user. In contrast with
identification, the act of indicating a person or thing's identity, authentication is the process of verifying that identity. It might involve validating personal
identity document
An identity document (also called ID or colloquially as papers) is any documentation, document that may be used to prove a person's identity. If issued in a small, standard credit card size form, it is usually called an identity card (IC, ID c ...
s, verifying the authenticity of a
website
A website (also written as a web site) is a collection of web pages and related content that is identified by a common domain name and published on at least one web server. Examples of notable websites are Google Search, Google, Facebook, Amaz ...
with a
digital certificate
In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the validity of a Key authentication, public key. The certificate includes information about the key, i ...
,
determining the age of an artifact by
carbon dating
Radiocarbon dating (also referred to as carbon dating or carbon-14 dating) is a method for determining the age of an object containing organic material by using the properties of radiocarbon, a radioactive isotope of carbon.
The method was dev ...
, or ensuring that a product or document is not
counterfeit
To counterfeit means to imitate something authentic, with the intent to steal, destroy, or replace the original, for use in illegal transactions, or otherwise to deceive individuals into believing that the fake is of equal or greater value tha ...
.
Methods
Authentication is relevant to multiple fields. In
art
Art is a diverse range of human activity, and resulting product, that involves creative or imaginative talent expressive of technical proficiency, beauty, emotional power, or conceptual ideas.
There is no generally agreed definition of wha ...
,
antiques, and
anthropology
Anthropology is the scientific study of humanity, concerned with human behavior, human biology, cultures, societies, and linguistics, in both the present and past, including past human species. Social anthropology studies patterns of behavi ...
, a common problem is verifying that a given artifact was produced by a certain person or in a certain place or period of history. In
computer science
Computer science is the study of computation, automation, and information. Computer science spans theoretical disciplines (such as algorithms, theory of computation, information theory, and automation) to Applied science, practical discipli ...
, verifying a user's identity is often required to allow access to confidential data or systems.
Authentication can be considered to be of three types:
The first type of authentication is accepting proof of identity given by a credible person who has first-hand evidence that the identity is genuine. When authentication is required of art or physical objects, this proof could be a friend, family member, or colleague attesting to the item's provenance, perhaps by having witnessed the item in its creator's possession. With autographed sports memorabilia, this could involve someone attesting that they witnessed the object being signed. A vendor selling branded items implies authenticity, while they may not have evidence that every step in the supply chain was authenticated. Centralized authority-based trust relationships back most secure internet communication through known public certificate authorities; decentralized peer-based trust, also known as a
web of trust
In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to establish the authenticity of the binding between a public key and its owner. Its decentralized trust model is an alternative to the centr ...
, is used for personal services such as email or files (
Pretty Good Privacy
Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partition ...
,
GNU Privacy Guard
GNU Privacy Guard (GnuPG or GPG) is a free-software replacement for Symantec's PGP cryptographic software suite. The software is compliant with RFC 4880, the IETF standards-track specification of OpenPGP. Modern versions of PGP are interoperable ...
) and trust is established by known individuals signing each other's
cryptographic key
A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Based on the used method, the key c ...
at
Key signing parties
In public-key cryptography, a key signing party is an event at which people present their public keys to others in person, who, if they are confident the key actually belongs to the person who claims it, digitally sign the certificate containin ...
, for instance.
The second type of authentication is comparing the attributes of the object itself to what is known about objects of that origin. For example, an art expert might look for similarities in the style of painting, check the location and form of a signature, or compare the object to an old photograph. An
archaeologist
Archaeology or archeology is the scientific study of human activity through the recovery and analysis of material culture. The archaeological record consists of artifacts, architecture, biofacts or ecofacts, sites, and cultural landscap ...
, on the other hand, might use
carbon dating
Radiocarbon dating (also referred to as carbon dating or carbon-14 dating) is a method for determining the age of an object containing organic material by using the properties of radiocarbon, a radioactive isotope of carbon.
The method was dev ...
to verify the age of an artifact, do a chemical and spectroscopic analysis of the materials used, or compare the style of construction or decoration to other artifacts of similar origin. The physics of sound and light, and comparison with a known physical environment, can be used to examine the authenticity of audio recordings, photographs, or videos. Documents can be verified as being created on ink or paper readily available at the time of the item's implied creation.
Attribute comparison may be vulnerable to forgery. In general, it relies on the facts that creating a forgery indistinguishable from a genuine artifact requires expert knowledge, that mistakes are easily made, and that the amount of effort required to do so is considerably greater than the amount of profit that can be gained from the forgery.
In art and antiques, certificates are of great importance for authenticating an object of interest and value. Certificates can, however, also be forged, and the authentication of these poses a problem. For instance, the son of
Han van Meegeren
Henricus Antonius "Han" van Meegeren (; 10 October 1889 – 30 December 1947) was a Dutch painter and portraitist, considered one of the most ingenious art forgers of the 20th century. Van Meegeren became a national hero after World War II when ...
, the well-known art-forger, forged the work of his father and provided a certificate for its provenance as well; see the article
Jacques van Meegeren
Jacques Henri Emil van Meegeren (26 August 1912 – 26 October 1977) was a Dutch illustrator and painter.
He is also considered to be a forger of the work of his father, Han van Meegeren, convicted of forging old masters and fraud. He was, ho ...
.
Criminal and civil penalties for
fraud
In law, fraud is intentional deception to secure unfair or unlawful gain, or to deprive a victim of a legal right. Fraud can violate civil law (e.g., a fraud victim may sue the fraud perpetrator to avoid the fraud or recover monetary compens ...
,
forgery
Forgery is a white-collar crime that generally refers to the false making or material alteration of a legal instrument with the specific intent to defraud anyone (other than themself). Tampering with a certain legal instrument may be forbidd ...
, and
counterfeit
To counterfeit means to imitate something authentic, with the intent to steal, destroy, or replace the original, for use in illegal transactions, or otherwise to deceive individuals into believing that the fake is of equal or greater value tha ...
ing can reduce the incentive for falsification, depending on the risk of getting caught.
Currency
A currency, "in circulation", from la, currens, -entis, literally meaning "running" or "traversing" is a standardization of money in any form, in use or circulation as a medium of exchange, for example banknotes and coins.
A more general def ...
and other
financial
Finance is the study and discipline of money, currency and capital assets. It is related to, but not synonymous with economics, the study of production, distribution, and consumption of money, assets, goods and services (the discipline of fina ...
instruments commonly use this second type of authentication method. Bills, coins, and
cheque
A cheque, or check (American English; see spelling differences) is a document that orders a bank (or credit union) to pay a specific amount of money from a person's account to the person in whose name the cheque has been issued. The pers ...
s incorporate hard-to-duplicate physical features, such as fine printing or engraving, distinctive feel, watermarks, and
holographic
Holography is a technique that enables a wavefront to be recorded and later re-constructed. Holography is best known as a method of generating real three-dimensional images, but it also has a wide range of other applications. In principle, i ...
imagery, which are easy for trained receivers to verify.
The third type of authentication relies on documentation or other external affirmations. In criminal courts, the
rules of evidence
The law of evidence, also known as the rules of evidence, encompasses the rules and legal principles that govern the proof of facts in a legal proceeding. These rules determine what evidence must or must not be considered by the trier of f ...
often require establishing the
chain of custody
Chain of custody (CoC), in legal contexts, is the chronological documentation or paper trail that records the sequence of custody, control, transfer, analysis, and disposition of materials, including physical or electronic evidence. Of particula ...
of evidence presented. This can be accomplished through a written evidence log, or by testimony from the police detectives and forensics staff that handled it. Some antiques are accompanied by certificates attesting to their authenticity. Signed sports memorabilia is usually accompanied by a certificate of authenticity. These external records have their own problems of forgery and
perjury
Perjury (also known as foreswearing) is the intentional act of swearing a false oath or falsifying an affirmation to tell the truth, whether spoken or in writing, concerning matters material to an official proceeding."Perjury The act or an inst ...
and are also vulnerable to being separated from the artifact and lost.
In computer science, a user can be given
''access'' to secure systems based on user credentials that imply authenticity. A network administrator can give a user a password, or provide the user with a key card or other access devices to allow system access. In this case, authenticity is implied but not guaranteed.
Consumer goods
A final good or consumer good is a final product ready for sale that is used by the consumer to satisfy current wants or needs, unlike a intermediate good, which is used to produce other goods. A microwave oven or a bicycle is a final good, but ...
such as pharmaceuticals, perfume, fashion clothing can use all three forms of authentication to prevent counterfeit goods from taking advantage of a popular brand's reputation (damaging the brand owner's sales and reputation). As mentioned above, having an item for sale in a reputable store implicitly attests to it being genuine, the first type of authentication. The second type of authentication might involve comparing the quality and craftsmanship of an item, such as an expensive handbag, to genuine articles. The third type of authentication could be the presence of a
trademark
A trademark (also written trade mark or trade-mark) is a type of intellectual property consisting of a recognizable sign, design, or expression that identifies products or services from a particular source and distinguishes them from others ...
on the item, which is a legally protected marking, or any other identifying feature which aids consumers in the identification of genuine brand-name goods. With software, companies have taken great steps to protect from counterfeiters, including adding holograms, security rings, security threads and color shifting ink.
Authentication factors
The ways in which someone may be authenticated fall into three categories, based on what is known as the factors of authentication: something the user ''knows'', something the user ''has'', and something the user ''is''. Each authentication factor covers a range of elements used to authenticate or verify a person's identity before being granted access, approving a transaction request, signing a document or other work product, granting authority to others, and establishing a chain of authority.
Security research has determined that for a positive authentication, elements from at least two, and preferably all three, factors should be verified. The three factors (classes) and some of the elements of each factor are:
* the knowledge factors: Something the user knows (e.g., a
password
A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
,
partial password
A partial password is a mode of password authentication intended to make keystroke logging and shoulder surfing less effective.
By asking the user to enter only a few specific characters from their password, rather than the whole password, parti ...
,
passphrase
A passphrase is a sequence of words or other text used to control access to a computer system, program or data. It is similar to a password in usage, but a passphrase is generally longer for added security. Passphrases are often used to control ...
,
personal identification number
A personal identification number (PIN), or sometimes redundantly a PIN number or PIN code, is a numeric (sometimes alpha-numeric) passcode used in the process of authenticating a user accessing a system.
The PIN has been the key to facilitat ...
(PIN),
challenge–response (the user must answer a question or pattern),
security question
A security question is form of shared secret used as an authenticator. It is commonly used by banks, cable companies and wireless providers as an extra security layer.
History
Financial institutions have used questions to authenticate custome ...
).
* the ownership factors: Something the user has (e.g., wrist band,
ID card,
security token
A security token is a peripheral device used to gain access to an electronically restricted resource. The token is used in addition to or in place of a password. It acts like an electronic key to access something. Examples of security tokens incl ...
,
implanted device,
cell phone
A mobile phone, cellular phone, cell phone, cellphone, handphone, hand phone or pocket phone, sometimes shortened to simply mobile, cell, or just phone, is a portable telephone that can make and receive calls over a radio frequency link whil ...
with a built-in
hardware token,
software token A software token (a.k.a. ''soft token'') is a piece of a two-factor authentication security device that may be used to authorize the use of computer services. Software tokens are stored on a general-purpose electronic device such as a desktop comput ...
, or
cell phone
A mobile phone, cellular phone, cell phone, cellphone, handphone, hand phone or pocket phone, sometimes shortened to simply mobile, cell, or just phone, is a portable telephone that can make and receive calls over a radio frequency link whil ...
holding a
software token A software token (a.k.a. ''soft token'') is a piece of a two-factor authentication security device that may be used to authorize the use of computer services. Software tokens are stored on a general-purpose electronic device such as a desktop comput ...
).
* the inherence factors: Something the user is or does (e.g.,
fingerprint
A fingerprint is an impression left by the friction ridges of a human finger. The recovery of partial fingerprints from a crime scene is an important method of forensic science. Moisture and grease on a finger result in fingerprints on surfac ...
,
retina
The retina (from la, rete "net") is the innermost, light-sensitive layer of tissue of the eye of most vertebrates and some molluscs. The optics of the eye create a focused two-dimensional image of the visual world on the retina, which then ...
l pattern,
DNA sequence (there are assorted definitions of what is sufficient),
signature
A signature (; from la, signare, "to sign") is a handwritten (and often stylized) depiction of someone's name, nickname, or even a simple "X" or other mark that a person writes on documents as a proof of identity and intent. The writer of a ...
, face, voice, unique bio-electric signals, or other
biometric
Biometrics are body measurements and calculations related to human characteristics. Biometric authentication (or realistic authentication) is used in computer science as a form of identification and access control. It is also used to identify in ...
identifiers).
Single-factor authentication
As the weakest level of authentication, only a single component from one of the three categories of factors is used to authenticate an individual's identity. The use of only one factor does not offer much protection from misuse or malicious intrusion. This type of authentication is not recommended for financial or personally relevant transactions that warrant a higher level of security.
Multi-factor authentication
Multi-factor authentication involves two or more authentication factors (''something you know'', ''something you have'', or ''something you are''). Two-factor authentication is a special case of multi-factor authentication involving exactly two factors.
For example, using a bank card (something the user has) along with a PIN (something the user knows) provides two-factor authentication. Business networks may require users to provide a password (knowledge factor) and a pseudorandom number from a
security token
A security token is a peripheral device used to gain access to an electronically restricted resource. The token is used in addition to or in place of a password. It acts like an electronic key to access something. Examples of security tokens incl ...
(ownership factor). Access to a very-high-security system might require a
mantrap screening of height, weight, facial, and fingerprint checks (several inherence factor elements) plus a PIN and a day code (knowledge factor elements), but this is still a two-factor authentication.
Authentication types
The most frequent types of authentication available in use for authenticating online users differ in the level of security provided by combining factors from one or more of the three categories of factors for authentication:
Strong authentication
The
U.S.
The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territori ...
government
A government is the system or group of people governing an organized community, generally a state.
In the case of its broad associative definition, government normally consists of legislature, executive, and judiciary. Government is a ...
's
National Information Assurance Glossary Committee on National Security Systems Instruction No. 4009, National Information Assurance Glossary, published by the United States federal government, is an unclassified glossary of Information security terms intended to provide a common vocabul ...
defines ''
strong authentication
Strong authentication is a notion with several definitions.
Strong (customer) authentication definitions
Strong authentication is often confused with two-factor authentication (more generally known as multi-factor authentication), but strong a ...
'' as a layered authentication approach relying on two or more authenticators to establish the identity of an originator or receiver of information.
The European Central Bank (ECB) has defined ''strong authentication'' as "a procedure based on two or more of the three authentication factors". The factors that are used must be mutually independent and at least one factor must be "non-reusable and non-replicable", except in the case of an inherence factor and must also be incapable of being stolen off the Internet. In the European, as well as in the US-American understanding, strong authentication is very similar to multi-factor authentication or 2FA, but exceeding those with more rigorous requirements.
The
Fast IDentity Online (FIDO) Alliance has been striving to establish technical specifications for strong authentication.
Continuous authentication
Conventional computer systems authenticate users only at the initial log-in session, which can be the cause of a critical security flaw. To resolve this problem, systems need continuous user authentication methods that continuously monitor and authenticate users based on some biometric trait(s). A study used behavioural biometrics based on writing styles as a continuous authentication method.
[Brocardo ML, Traore I, Woungang I, Obaidat MS.]
Authorship verification using deep belief network systems
". Int J Commun Syst. 2017.
Recent research has shown the possibility of using smartphones sensors and accessories to extract some behavioral attributes such as touch dynamics,
keystroke dynamics
Keystroke dynamics, keystroke biometrics, typing dynamics and typing biometrics refer to the detailed timing information that describes when each key was pressed and released as a person is typing on a computer keyboard.
Science
The behavioura ...
and gait recognition. These attributes are known as behavioral biometrics and could be used to verify or identify users implicitly and continuously on smartphones. The authentication systems that have been built based on these behavioral biometric traits are known as active or continuous authentication systems.
Digital authentication
The term ''digital authentication'', also known as ''electronic authentication'' or ''e-authentication'', refers to a group of processes where the confidence for user identities is established and presented via electronic methods to an information system. The digital authentication process creates technical challenges because of the need to authenticate individuals or entities remotely over a network.
The American
National Institute of Standards and Technology
The National Institute of Standards and Technology (NIST) is an agency of the United States Department of Commerce whose mission is to promote American innovation and industrial competitiveness. NIST's activities are organized into physical sci ...
(NIST) has created a generic model for digital authentication that describes the processes that are used to accomplish secure authentication:
# ''Enrollment'' – an individual applies to a credential service provider (CSP) to initiate the enrollment process. After successfully proving the applicant's identity, the CSP allows the applicant to become a subscriber.
# ''Authentication'' – After becoming a subscriber, the user receives an
authenticator
An authenticator is a means used to confirm a user's identity, that is, to perform digital authentication. A person authenticates to a computer system or application by demonstrating that he or she has possession and control of an authenticator. I ...
e.g., a
token and credentials, such as a user name. He or she is then permitted to perform online transactions within an authenticated session with a relying party, where they must provide proof that he or she possesses one or more authenticators.
# ''Life-cycle maintenance'' – the CSP is charged with the task of maintaining the user's credential over the course of its lifetime, while the subscriber is responsible for maintaining his or her authenticator(s).
The authentication of information can pose special problems with electronic communication, such as vulnerability to
man-in-the-middle attack
In cryptography and computer security, a man-in-the-middle, monster-in-the-middle, machine-in-the-middle, monkey-in-the-middle, meddler-in-the-middle, manipulator-in-the-middle (MITM), person-in-the-middle (PITM) or adversary-in-the-middle (AiTM) ...
s, whereby a third party taps into the communication stream, and poses as each of the two other communicating parties, in order to intercept information from each. Extra identity factors can be required to authenticate each party's identity.
Product authentication
Counterfeit
To counterfeit means to imitate something authentic, with the intent to steal, destroy, or replace the original, for use in illegal transactions, or otherwise to deceive individuals into believing that the fake is of equal or greater value tha ...
products are often offered to consumers as being authentic.
Counterfeit consumer goods
Counterfeit consumer goods (or counterfeit and fraudulent, suspect items - CFSI) are goods, often of inferior quality, made or sold under another's brand name without the brand owner's authorization. Sellers of such goods may infringe on eith ...
, such as electronics, music, apparel, and
counterfeit medications
A counterfeit medication or a counterfeit drug is a medication or pharmaceutical item which is produced and sold with the intent to deceptively represent its origin, authenticity, or effectiveness. A counterfeit drug may contain inappropriate qu ...
, have been sold as being legitimate. Efforts to control the
supply chain
In commerce, a supply chain is a network of facilities that procure raw materials, transform them into intermediate goods and then final products to customers through a distribution system. It refers to the network of organizations, people, acti ...
and educate consumers help ensure that authentic products are sold and used. Even
security printing
Security printing is the field of the printing industry that deals with the printing of items such as banknotes, cheques, passports, tamper-evident labels, security tapes, product authentication, stock certificates, postage stamps and identity ...
on packages,
label
A label (as distinct from signage) is a piece of paper, plastic film, cloth, metal, or other material affixed to a container or product, on which is written or printed information or symbols about the product or item. Information printed dir ...
s, and
nameplate
A nameplate identifies and displays a person or product's name. Nameplates are usually shaped as rectangles but are also seen in other shapes, sometimes taking on the shape of someone's written name. Nameplates primarily serve an informat ...
s, however, is subject to counterfeiting.
In their anti-counterfeiting technology guide, the
EUIPO Observatory on Infringements of Intellectual Property Rights categorizes the main anti-counterfeiting technologies on the market currently into five main categories: electronic, marking, chemical and physical, mechanical, and technologies for digital media.
Products or their packaging can include a variable
QR Code
A QR code (an initialism for quick response code) is a type of matrix barcode (or two-dimensional barcode) invented in 1994 by the Japanese company Denso Wave. A barcode is a machine-readable optical label that can contain information about th ...
. A QR Code alone is easy to verify but offers a weak level of authentication as it offers no protection against counterfeits unless scan data is analyzed at the system level to detect anomalies. To increase the security level, the QR Code can be combined with a
digital watermark
A digital watermark is a kind of marker covertly embedded in a noise-tolerant signal such as audio, video or image data. It is typically used to identify ownership of the copyright of such signal. "Watermarking" is the process of hiding digital inf ...
or
copy detection pattern
A copy detection pattern (CDP) or graphical code is a small Randomness, random or Pseudorandomness, pseudo-random digital image which is printed on documents, labels or products for counterfeit detection. Authentication is made by scanning th ...
that are robust to copy attempts and can be authenticated with a smartphone.
A
secure key storage device can be used for authentication in consumer electronics, network authentication, license management, supply chain management, etc. Generally, the device to be authenticated needs some sort of wireless or wired digital connection to either a host system or a network. Nonetheless, the component being authenticated need not be electronic in nature as an authentication chip can be mechanically attached and read through a connector to the host e.g. an authenticated ink tank for use with a printer. For products and services that these secure coprocessors can be applied to, they can offer a solution that can be much more difficult to counterfeit than most other options while at the same time being more easily verified.
Packaging
Packaging and labeling
Packaging is the science, art and technology of enclosing or protecting products for distribution, storage, sale, and use. Packaging also refers to the process of designing, evaluating, and producing packages. Packaging can be described as a co ...
can be engineered to help reduce the risks of
counterfeit consumer goods
Counterfeit consumer goods (or counterfeit and fraudulent, suspect items - CFSI) are goods, often of inferior quality, made or sold under another's brand name without the brand owner's authorization. Sellers of such goods may infringe on eith ...
or the theft and resale of products. Some package constructions are more difficult to copy and some have pilfer indicating seals.
Counterfeit
To counterfeit means to imitate something authentic, with the intent to steal, destroy, or replace the original, for use in illegal transactions, or otherwise to deceive individuals into believing that the fake is of equal or greater value tha ...
goods, unauthorized sales (diversion), material substitution and tampering can all be reduced with these anti-counterfeiting technologies. Packages may include authentication seals and use
security printing
Security printing is the field of the printing industry that deals with the printing of items such as banknotes, cheques, passports, tamper-evident labels, security tapes, product authentication, stock certificates, postage stamps and identity ...
to help indicate that the package and contents are not counterfeit; these too are subject to counterfeiting. Packages also can include anti-theft devices, such as dye-packs,
RFID
Radio-frequency identification (RFID) uses electromagnetic fields to automatically identify and track tags attached to objects. An RFID system consists of a tiny radio transponder, a radio receiver and transmitter. When triggered by an electromag ...
tags, or
electronic article surveillance
Electronic article surveillance is a technological method for preventing shoplifting from retail stores, pilferage of books from libraries or removal of properties from office buildings. Special tags are fixed to merchandise; these tags are remove ...
tags that can be activated or detected by devices at exit points and require specialized tools to deactivate. Anti-counterfeiting technologies that can be used with packaging include:
*
Taggant
A taggant is any chemical or physical marker added to materials to allow various forms of testing. Physical taggants can take many different forms but are typically microscopic in size, included at low levels, and simple to detect. They can be u ...
fingerprinting – uniquely coded microscopic materials that are verified from a database
* Encrypted micro-particles – unpredictably placed markings (numbers, layers and colors) not visible to the human eye
*
Hologram
Holography is a technique that enables a wavefront to be recorded and later re-constructed. Holography is best known as a method of generating real three-dimensional images, but it also has a wide range of other Holography#Applications, applic ...
s – graphics printed on seals, patches, foils or labels and used at the point of sale for visual verification
* Micro-printing – second-line authentication often used on currencies
* Serialized
barcode
A barcode or bar code is a method of representing data in a visual, machine-readable form. Initially, barcodes represented data by varying the widths, spacings and sizes of parallel lines. These barcodes, now commonly referred to as linear or o ...
s
* UV printing – marks only visible under UV light
*
Track and trace
In the distribution and logistics of many types of products, track and trace or tracking and tracing concerns a process of determining the current and past locations (and other information) of a unique item or property.
This concept can be s ...
systems – use codes to link products to the database tracking system
* Water indicators – become visible when contacted with water
* DNA tracking – genes embedded onto labels that can be traced
* Color-shifting ink or film – visible marks that switch colors or texture when tilted
*
Tamper evident
Tamper-evident describes a device or process that makes unauthorized access to the protected object easily detected. Seals, markings, or other techniques may be tamper indicating.
Tampering
Tampering involves the deliberate altering or adultera ...
seals and tapes – destructible or graphically verifiable at point of sale
* 2d barcodes – data codes that can be tracked
*
RFID
Radio-frequency identification (RFID) uses electromagnetic fields to automatically identify and track tags attached to objects. An RFID system consists of a tiny radio transponder, a radio receiver and transmitter. When triggered by an electromag ...
chips
*
NFC
NFC may refer to:
Psychology
* Need for cognition, in psychology
* Need for closure, social psychological term
Sports
* NFC Championship Game, the National Football Conference Championship Game
* NCAA Football Championship (Philippines)
* Nati ...
chips
Information content
Literary forgery
Literary forgery (also known as literary mystification, literary fraud or literary hoax) is writing, such as a manuscript or a literary work, which is either deliberately misattributed to a historical or invented author, or is a purported memoir ...
can involve imitating the style of a famous author. If an original
manuscript
A manuscript (abbreviated MS for singular and MSS for plural) was, traditionally, any document written by hand – or, once practical typewriters became available, typewritten – as opposed to mechanically printing, printed or repr ...
, typewritten text, or recording is available, then the medium itself (or its packaging – anything from a box to
e-mail headers) can help prove or disprove the authenticity of the document. However, text, audio, and video can be copied into new media, possibly leaving only the informational content itself to use in authentication. Various systems have been invented to allow authors to provide a means for readers to reliably authenticate that a given message originated from or was relayed by them. These involve authentication factors like:
* A difficult-to-reproduce physical artifact, such as a
seal
Seal may refer to any of the following:
Common uses
* Pinniped, a diverse group of semi-aquatic marine mammals, many of which are commonly called seals, particularly:
** Earless seal, or "true seal"
** Fur seal
* Seal (emblem), a device to impr ...
,
signature
A signature (; from la, signare, "to sign") is a handwritten (and often stylized) depiction of someone's name, nickname, or even a simple "X" or other mark that a person writes on documents as a proof of identity and intent. The writer of a ...
,
watermark
A watermark is an identifying image or pattern in paper that appears as various shades of lightness/darkness when viewed by transmitted light (or when viewed by reflected light, atop a dark background), caused by thickness or density variations ...
, special
stationery
Stationery refers to commercially manufactured writing materials, including cut paper, envelopes, writing implements, continuous form paper, and other office supplies. Stationery includes materials to be written on by hand (e.g., letter paper) ...
, or
fingerprint
A fingerprint is an impression left by the friction ridges of a human finger. The recovery of partial fingerprints from a crime scene is an important method of forensic science. Moisture and grease on a finger result in fingerprints on surfac ...
.
* A
shared secret
In cryptography, a shared secret is a piece of data, known only to the parties involved, in a secure communication. This usually refers to the key of a symmetric cryptosystem. The shared secret can be a password, a passphrase, a big number, or a ...
, such as a passphrase, in the content of the message.
* An
electronic signature
An electronic signature, or e-signature, is data that is logically associated with other data and which is used by the signatory to sign the associated data. This type of signature has the same legal standing as a handwritten signature as long as i ...
;
public-key infrastructure
A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. The purpose of a PKI is to facili ...
is often used to cryptographically guarantee that a message has been signed by the holder of a particular private key.
The opposite problem is the detection of
plagiarism
Plagiarism is the fraudulent representation of another person's language, thoughts, ideas, or expressions as one's own original work.From the 1995 '' Random House Compact Unabridged Dictionary'': use or close imitation of the language and thought ...
, where information from a different author is passed off as a person's own work. A common technique for proving plagiarism is the discovery of another copy of the same or very similar text, which has different attribution. In some cases, excessively high quality or a style mismatch may raise suspicion of plagiarism.
Literacy and literature authentication
In literacy, authentication is a readers’ process of questioning the veracity of an aspect of literature and then verifying those questions via research. The fundamental question for authentication of literature is – Does one believe it? Related to that, an authentication project is therefore a reading and writing activity in which students document the relevant research process (). It builds students' critical literacy. The documentation materials for literature go beyond narrative texts and likely include informational texts, primary sources, and multimedia. The process typically involves both internet and hands-on library research. When authenticating historical fiction in particular, readers consider the extent that the major historical events, as well as the culture portrayed (e.g., the language, clothing, food, gender roles), are believable for the period.
History and state-of-the-art
Historically,
fingerprint
A fingerprint is an impression left by the friction ridges of a human finger. The recovery of partial fingerprints from a crime scene is an important method of forensic science. Moisture and grease on a finger result in fingerprints on surfac ...
s have been used as the most authoritative method of authentication, but court cases in the US and elsewhere have raised fundamental doubts about fingerprint reliability. Outside of the legal system as well, fingerprints are easily
spoof
Spoof, spoofs, spoofer, or spoofing may refer to:
* Forgery of goods or documents
* Semen, in Australian slang
* Spoof (game), a guessing game
* Spoofing (finance), a disruptive algorithmic-trading tactic designed to manipulate markets
__NOTOC__ ...
able, with
British Telecom
BT Group plc (trade name, trading as BT and formerly British Telecom) is a British Multinational corporation, multinational telecommunications holding company headquartered in London, England. It has operations in around 180 countries and is th ...
's top computer security official noting that "few" fingerprint readers have not already been tricked by one spoof or another. Hybrid or two-tiered authentication methods offer a compelling the solution, such as private keys encrypted by fingerprint inside of a USB device.
In a computer data context, cryptographic methods have been developed (''see''
digital signature
A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the prerequisites are satisfied, gives a recipient very high confidence that the message was created b ...
and
challenge–response authentication
In computer security, challenge–response authentication is a family of protocols in which one party presents a question ("challenge") and another party must provide a valid answer ("response") to be authenticated.
The simplest example of a ch ...
) which are currently not spoofable if and only if the originator's key has not been compromised. That the originator (or anyone other than an
attacker
In some team sports, an attacker is a specific type of player, usually involved in aggressive play. Heavy attackers are, usually, placed up front: their goal is to score the most possible points for the team. In association football, attackers a ...
) knows (or doesn't know) about a compromise is irrelevant. It is not known whether these cryptographically based authentication methods are provably secure, since unanticipated mathematical developments may make them vulnerable to attack in the future. If that were to occur, it may call into question much of the authentication in the past. In particular, a
digitally signed contract
A contract is a legally enforceable agreement between two or more parties that creates, defines, and governs mutual rights and obligations between them. A contract typically involves the transfer of goods, services, money, or a promise to tran ...
may be questioned when a new attack on the cryptography underlying the signature is discovered.
Authorization
The process of
authorization
Authorization or authorisation (see spelling differences) is the function of specifying access rights/privileges to resources, which is related to general information security and computer security, and to access control in particular. More for ...
is distinct from that of authentication. Whereas authentication is the process of verifying that "you are who you say you are", authorization is the process of verifying that "you are permitted to do what you are trying to do". While authorization often happens immediately after authentication (e.g., when logging into a computer system), this does not mean authorization presupposes authentication: an anonymous agent could be authorized to a limited action set.
Access control
One familiar use of authentication and authorization is
access control
In the fields of physical security and information security, access control (AC) is the selective restriction of access to a place or other resource, while access management describes the process. The act of ''accessing'' may mean consuming ...
. A computer system that is supposed to be used only by those authorized must attempt to detect and exclude the unauthorized. Access to it is therefore usually controlled by insisting on an authentication procedure to establish with some degree of confidence the identity of the user, granting privileges established for that identity.
See also
*
Access Control Service
Access Control Service, or Windows Azure Access Control Service (ACS) was a Microsoft-owned cloud-based service that provided an easy way of authenticating and authorizing users to gain access to web applications and services while allowing the ...
*
Atomic authorization
*
Authentication Open Service Interface Definition
The Authentication Open Service Interface Definition (OSID) is an O.K.I. specification which supports invoking an authentication process. OSIDs are programmatic interfaces which comprise a Service Oriented Architecture for designing and buildi ...
*
Authenticity in art
Authenticity in art is manifest in the different ways that a work of art, or an artistic performance, can be considered authentic. The initial distinction is between ''nominal authenticity'' and ''expressive authenticity''. In the first sense, no ...
*
Authorization
Authorization or authorisation (see spelling differences) is the function of specifying access rights/privileges to resources, which is related to general information security and computer security, and to access control in particular. More for ...
*
Basic access authentication
In the context of an HTTP transaction, basic access authentication is a method for an HTTP user agent (e.g. a web browser) to provide a user name and password when making a request. In basic HTTP authentication, a request contains a header field i ...
*
Biometrics
Biometrics are body measurements and calculations related to human characteristics. Biometric authentication (or realistic authentication) is used in computer science as a form of identification and access control. It is also used to identify in ...
*
CAPTCHA
A CAPTCHA ( , a contrived acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart") is a type of challenge–response test used in computing to determine whether the user is human.
The term was coined in 2003 ...
*
Chip Authentication Program 250px, A Gemalto EZIO CAP device with Barclays PINsentry styling
The Chip Authentication Program (CAP) is a MasterCard initiative and technical specification for using EMV banking smartcards for authenticating users and transactions in online and ...
*
Closed-loop authentication
*
Diameter (protocol)
Diameter is an authentication, authorization, and accounting protocol for computer networks. It evolved from the earlier RADIUS protocol. It belongs to the application layer protocols in the internet protocol suite.
''Diameter Applications'' ...
*
EAP
*
Electronic authentication Electronic authentication is the process of establishing confidence in user identities electronically presented to an information system. Digital authentication, or e-authentication, may be used synonymously when referring to the authentication proc ...
*
Encrypted key exchange
Encrypted Key Exchange (also known as EKE) is a family of password-authenticated key agreement methods described by Steven M. Bellovin and Michael Merritt. Although several of the forms of EKE in this paper were later found to be flawed , the sur ...
(EKE)
*
Fingerprint Verification Competition
*
Geolocation
Geopositioning, also known as geotracking, geolocalization, geolocating, geolocation, or geoposition fixing, is the process of determining or estimating the geographic position of an object.
Geopositioning yields a set of Geographic coordinate s ...
*
Hash-based message authentication code
In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secre ...
*
Identification (information)
For data storage, identification is the capability to find, retrieve, report, change, or delete specific data without ambiguity. This applies especially to information stored in databases. In database normalisation, the process of organizi ...
*
Java Authentication and Authorization Service
Java Authentication and Authorization Service, or JAAS, pronounced "Jazz", is the Java implementation of the standard Pluggable Authentication Module (PAM) information security framework.
JAAS was introduced as an extension library to the Java Pla ...
*
Multi-factor authentication
Multi-factor authentication (MFA; encompassing two-factor authentication, or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting ...
*
OAuth
OAuth (short for "Open Authorization") is an open standard for access delegation, commonly used as a way for internet users to grant websites or applications access to their information on other websites but without giving them the passwords. T ...
– an open standard for authorization
*
OpenID Connect
OpenID is an open standard and decentralized authentication protocol promoted by the non-profit OpenID Foundation. It allows users to be authenticated by co-operating sites (known as relying parties, or RP) using a third-party identity provide ...
– an authentication method for the web
*
OpenID
OpenID is an open standard and decentralized authentication protocol promoted by the non-profit OpenID Foundation. It allows users to be authenticated by co-operating sites (known as relying parties, or RP) using a third-party identity provider ...
– an authentication method for the web
*
Public-key cryptography
Public-key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated with cryptographic alg ...
*
RADIUS
In classical geometry, a radius ( : radii) of a circle or sphere is any of the line segments from its center to its perimeter, and in more modern usage, it is also their length. The name comes from the latin ''radius'', meaning ray but also the ...
*
Reliance authentication
Reliance authentication is a part of the trust-based identity attribution process whereby a second entity relies upon the authentication processes put in place by a first entity. The second entity creates a further element that is unique and speci ...
*
Secure Remote Password protocol (SRP)
*
Secure Shell
The Secure Shell Protocol (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Its most notable applications are remote login and command-line execution.
SSH applications are based on a ...
*
Security printing
Security printing is the field of the printing industry that deals with the printing of items such as banknotes, cheques, passports, tamper-evident labels, security tapes, product authentication, stock certificates, postage stamps and identity ...
*
Self-sovereign identity
Self-sovereign identity (SSI) is an approach to digital identity that gives individuals control over the information they use to prove who they are to websites, services, and applications across the web. Without SSI, individuals with persistent ...
*
SQRL
SQRL (pronounced "squirrel") or Secure, Quick, Reliable Login (formerly Secure Login) is a draft open standard for secure website login and authentication. The software typically uses a link of the scheme or optionally a QR code, where a user ...
*
Strong authentication
Strong authentication is a notion with several definitions.
Strong (customer) authentication definitions
Strong authentication is often confused with two-factor authentication (more generally known as multi-factor authentication), but strong a ...
*
Tamper-evident technology
*
Time-based authentication
Time-based authentication is a special procedure to prove an individual's identity and authenticity on appearance simply by detecting its presence at a scheduled time of day or within a scheduled time interval and on a distinct location.
To enabl ...
*
Two-factor authentication
Multi-factor authentication (MFA; encompassing two-factor authentication, or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting ...
*
Usability of web authentication systems Usability of web authentication systems refers to the efficiency and user acceptance of online authentication systems. Examples of web authentication systems are passwords, federated identity systems (e.g. Google oAuth 2.0, Facebook connect, Mozill ...
*
Woo–Lam
References
External links
*
" New NIST Publications Describe Standards for Identity Credentials and Authentication Systems"
{{Authority control
Applications of cryptography
Access control
Packaging
Notary
Computer access control