Multi-factor authentication

Multi-factor authentication (MFA) is a method of computer access control in which a user is only granted access after successfully presenting several separate pieces of evidence to an authentication mechanism - typically at least two of the following categories: knowledge (something they know); possession (something they have), and inherence (something they are).[1]

Authentication Factors

Knowledge factors

Knowledge factors are the most commonly used form of authentication. In this form, the user is required to prove knowledge of a secret in order to authenticate.

A password is a secret word or string of characters that is used for user authentication. This is the most commonly used mechanism of authentication. Many multi-factor authentication techniques rely on password as one factor of authentication.[2] Variations include both longer ones formed from multiple words (a passphrase) and the shorter, purely numeric, personal identification number (PIN) commonly used for ATM access. Traditionally, passwords are expected to be memorized

Many secret questions such as "Where were you born?", are poor examples of a knowledge factor because they may be known to a wide group of people, or be able to be researched.

Possession factors

Main article: Security token

Possession factors ("something only the user has") have been used for authentication for centuries, in the form of a key to a lock. The basic principle is that the key embodies a secret which is shared between the lock and the key, and the same principle underlies possession factor authentication in computer systems.

Several methods are used as possession factors:

    Disconnected tokens

    RSA SecurID token, an example of a disconnected token generator.

    Disconnected tokens have no connections to the client computer. They typically use a built-in screen to display the generated authentication data, which is manually typed in by the user.[3]

    Connected tokens

    Connected tokens are devices that are physically connected to the computer to be used, and transmit data automatically.[4] There are a number of different types, including card readers, wireless tags and USB tokens.[4]

    Inherence factors

    These are factors associated with the user, and are usually biometric methods, including fingerprint readers, retina scanners or voice recognition.[5]

    Legislation

    United States

    Regulation

    Details for authentication in the USA are defined with the Homeland Security Presidential Directive 12 (HSPD-12).[6]

    Existing authentication methodologies involve the explained three types of basic "factors". Authentication methods that depend on more than one factor are more difficult to compromise than single-factor methods. [7]

    IT regulatory standards for access to Federal Government systems require the use of multi-factor authentication to access sensitive IT resources, for example when logging on to network devices to perform administrative tasks[8] and when accessing any computer using a privileged login.[9]

    Guidance

    NIST Special Publication 800-63-2 discusses various forms of two-factor authentication and provides guidance on using them in business processes requiring different levels of assurance.[10]

    In 2005, the United States' Federal Financial Institutions Examination Council issued guidance for financial institutions recommending financial institutions conduct risk-based assessments, evaluate customer awareness programs, and develop security measures to reliably authenticate customers remotely accessing online financial services, officially recommending the use of authentication methods that depend on more than one factor (specifically, what a user knows, has, and is) to determine the user's identity.[11] In response to the publication, numerous authentication vendors began improperly promoting challenge-questions, secret images, and other knowledge-based methods as "multi-factor" authentication. Due to the resulting confusion and widespread adoption of such methods, on August 15, 2006, the FFIEC published supplemental guidelines—which states that by definition, a "true" multi-factor authentication system must use distinct instances of the three factors of authentication it had defined, and not just use multiple instances of a single factor.[12]

    Security

    According to proponents, multi-factor authentication could drastically reduce the incidence of online identity theft, and other online fraud, because the victim's password would no longer be enough to give a thief permanent access to their information. However, many multi-factor authentication approaches remain vulnerable to phishing,[13] man-in-the-browser, and man-in-the-middle attacks.[14]

    Implementation considerations

    Many multi-factor authentication products require users to deploy client software to make multi-factor authentication systems work. Some vendors have created separate installation packages for network login, Web access credentials and VPN connection credentials. For such products, there may be four or five different software packages to push down to the client PC in order to make use of the token or smart card. This translates to four or five packages on which version control has to be performed, and four or five packages to check for conflicts with business applications. If access can be operated using web pages, it is possible to limit the overheads outlined above to a single application. With other multi-factor authentication solutions, such as "virtual" tokens and some hardware token products, no software must be installed by end users.

    There are drawbacks to multi-factor authentication that are keeping many approaches from becoming widespread. Some consumers have difficulty keeping track of a hardware token or USB plug. Many consumers do not have the technical skills needed to install a client-side software certificate by themselves. Generally, multi-factor solutions require additional investment for implementation and costs for maintenance. Most hardware token-based systems are proprietary and some vendors charge an annual fee per user. Deployment of hardware tokens is logistically challenging. Hardware tokens may get damaged or lost and issuance of tokens in large industries such as banking or even within large enterprises needs to be managed. In addition to deployment costs, multi-factor authentication often carries significant additional support costs. A 2008 survey of over 120 U.S. credit unions by the Credit Union Journal reported on the support costs associated with two-factor authentication. In their report, software certificates and software toolbar approaches were reported to have the highest support costs.

    Examples

    Several popular web services employ multi-factor authentication, usually as an optional feature that is deactivated by default.[15]

    See also

    References

    1. ↑ "Two-factor authentication: What you need to know (FAQ) - CNET". CNET. Retrieved 2015-10-31.
    2. ↑ "Securenvoy - what is 2 factor authentication?". Retrieved April 3, 2015.
    3. ↑ de Borde, Duncan. "Two-factor authentication" (PDF). Archived from the original (PDF) on January 12, 2012.
    4. 1 2 van Tilborg, Henk C.A.; Jajodia, Sushil, eds. (2011). Encyclopedia of Cryptography and Security, Volume 1. Springer Science & Business Media. p. 1305. ISBN 9781441959058.
    5. ↑ Biometrics for Identification and Authentication - Advice on Product Selection
    6. ↑ US Security Directive as issued on August 12, 2007 Archived September 16, 2012, at the Wayback Machine.
    7. ↑ "Frequently Asked Questions on FFIEC Guidance on Authentication in an Internet Banking Environment", August 15, 2006
    8. ↑ "SANS Institute, Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches".
    9. ↑ "SANS Institute, Critical Control 12: Controlled Use of Administrative Privileges".
    10. ↑ "Electronic Authentication Guide" (PDF). Special Publication 800-63-2. NIST. 2013. Retrieved 2014-11-06.
    11. ↑ "FFIEC Press Release". 2005-10-12. Retrieved 2011-05-13.
    12. ↑ FFIEC (2006-08-15). "Frequently Asked Questions on FFIEC Guidance on Authentication in an Internet Banking Environment" (PDF). Retrieved 2012-01-14.
    13. ↑ Citibank Phish Spoofs 2-Factor Authentication (Brian Krebs, July 10, 2006)
    14. ↑ The Failure of Two-Factor Authentication (Bruce Schneier, March 2005)
    15. ↑ GORDON, WHITSON (3 September 2012). "Two-Factor Authentication: The Big List Of Everywhere You Should Enable It Right Now". LifeHacker (Australia). Retrieved 1 November 2012.

    External links

    This article is issued from Wikipedia - version of the Sunday, May 01, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.