Identification and Authentication Flashcards
Identification
Makes a claim about what someone or something is
Authentication
Set of methods to establish whether a claim of identity is true
How can ID and authentication methods be fragile?
Rely on competence of person or system performing authentication
Who we claim to be
Tenuous concept, based on things that can change, are not unique, or can be fabricated or faked
Identity verification
Step beyond identification but short of authentication
Ex: show driver’s license, when send email, ID you provide is taken to be true and not authenticated
Reason for spam
Factors for authentication
Something you know
Something you are
Something you have
Something you do
Where you are
Something you know
Authentication factor
Ex: passwords, PINs
Somewhat weak because information may be exposed
Something you are
Authentication factor
Based on unique physical attributes of someone (biometrics)
Something you have
Authentication factor
Based on physical possession, can extend into logical concepts
Ex: ID cards, software-based security tokens, access to logical devices, ie, email or cell phones
Something you do
Authentication factor
Based on actions or behaviors of individual; overlap with something you are
Ex: gait or handwriting
Higher rate of rejection of legit users
Where you are
Authentication factor
Requires person to be present at a specific location
Multifactor authentication
Uses one or more factors discussed
Mutual authentication
Both parties in a transaction authenticate each other. Typically software-based.
Digital certificates
Better name for a strong password?
Complex
Manual synchronization of passwords
Using the same password everywhere
What do you call the notation of elements of an image in biometrics?
Minutiae
Characteristics of biometric factors (7)
Universality
Uniqueness
Permanence
Collectability
Performance
Acceptability
Circumvention
Universality (biometric factor)
Must apply to majority of users expected to enroll
Uniqueness (biometric factor)
Measure of how unique a characteristic is among individuals
Permanence (biometric factor)
How well a characteristic resists change over time
Collectability
How easy it is to acquire (log) a characteristic
Performance (biometric factor)
How well a system functions based on factors such as speed, accuracy, and error rate
Acceptability (biometric factor)
How acceptable the characteristic is to users of the system
Circumvention (biometric factor)
How easy it is to trick a system by using a falsified biometric identifier
Important metrics in biometric system
False acceptance rate (FAR)
False rejection rate (FRR)
Generally want these to be equal: equal error rate (EER)
Flaws in biometric systems
Easy to forge some biometric identifiers, and once they’re forged it’s hard to re-enroll a user in the system
Biometric identifiers are finite
Once biometric identifier is in the system, you have little control over what happens to it
