Authentication is the process that verifies whether the information provided by a person or entity about themselves is truthful. There are various methods for this. The sensitivity of the affected data and digital resources should determine which method users use to confirm their identity.
Information categories for authentication
Knowledge factors
These include information that the user knows, for example:
- Passwords
- One-time passcodes (OTPs)
- Answers to security questions
- Personal Identification Numbers (PINs)
Advantage: Easy to implement.
Disadvantage: Users can forget the information or it can be stolen.
Possession factors
These include objects that the user possesses:
- Key fobs
- Smartcards
- Mobile devices
- Hardware tokens
Advantage: Cannot be stolen remotely.
Disadvantage: An alternative is needed in case of defect or loss.
Inherent factors
These refer to physical or behavioral characteristics of the user:
- Fingerprint
- Voice recognition
- Iris scan
- Facial recognition
- Handwriting
Advantage: Unforgettable.
Disadvantage: May only work with specific devices.
Authentication methods
There are various methods and technologies for authenticating users. Two different goals need to be balanced: On one hand, sensitive data should be protected as well as possible. On the other hand, user-friendliness plays a role, as users should not have to overcome unnecessary hurdles.
The most well-known methods include:
- Single-factor authentication (SFA): Only a single factor is used here.
- Two-factor authentication (2FA): This method combines two factors from different categories.
- Multi-factor authentication (MFA): The user must use multiple factors to identify themselves. This further increases security.
- Passwordless: Methods that do not require passwords to confirm identity.
- Risk-based: Verification is based on a risk analysis that grants or denies access depending on the determined risk.
- Certificate-based: Digital certificates confirm the possession of a private key, allowing users to verify their identity with it.
- Token-based: After verification, users receive a token (German: proof, sign, characteristic) that allows access to certain resources for a limited time.
- Single Sign-On (SSO): Here, users can log in to multiple applications and services with a single set of credentials.
