User authentication is all about finding out whether users really are who they claim to be. Given that unsuspecting users can fall into the trap of confusing a smartphone with an Internet hotspot, giving the hacker an easy vector for stealing their passwords, relying on usernames and passwords to access confidential information alone, is basically irresponsible. The remedy could lie in the use of additional authentication factors.

Authentication Methods

Various authentication methods can be categorized into the groups "knowledge," "possession," and "biometrics" (Table 1). These groups, also called factors, constitute the basis of any authentication method.

Despite serious drawbacks, passwords remain the most widely used authentication method. After all, practically any software product offers this method free of charge as a standard procedure. However, admins should bear in mind a rule of thumb for information protection and access rights: The greater the value of the protected information is, the more secure the authentication method needs to be. Many of the problems with passwords can be avoided if a dynamic instead of a static password is used and if the dynamic password can be used only once. Perhaps you cannot prevent passwords from being sniffed, but the authentication information stolen in this way will be worthless for the attacker.

Multifactor Authentication

The security of authentication processes can be increased significantly by a combination of several factors (multifactor authentication). For example, the debit card has always combined the factors of "knowledge" and "possession" because the user needs both possession of the card with a magnetic strip/chip and the associated PIN.

Even more secure is a process in which three factors are used – knowledge, possession, biometrics. For example, "QTrust 2go Smart" [1] combines all three factors, with the user first typing a username in the login screen (knowledge) and then scanning a QR code from the screen with a smartphone, from which the smartphone app then generates a one-time password (possession). For final authentication, the user then needs to perform face recognition with the smartphone camera (biometric feature) and type the one-time password into the login box.

Good Enough

For most security requirements, however, two-factor authentication is more than adequate. The Payment Card Industry Data Security Standard (PCI DSS) – a binding regulatory framework for the processing of credit card payment transactions – calls for a two-factor authentication solution for network access by administrators, staff, and external third parties [2].

Many two-factor authentication solutions are available on the market (see the "Commercial Two-Factor Authentication Solutions" box). Anyone planning to use such a solution should, therefore, decide in advance whether they want to work with certificates, one-time passwords, or both. Certificate-based two-factor authentication typically uses digital PKI certificates based on the X.509 standard. These are typically stored on a hardware certificate storage medium known as the security token. To authenticate, the user must connect the security token for the device to the service and then activate the saved certificate by entering a PIN or password. Only then can the VPN client, for example, open a connection to the target system.

Figure 1: DIGIPASS Nano is a thin film that can be placed, together with the SIM card, into a cellphone, thus turning the phone into a hardware OTP token.

Special USB sticks or smart cards are typically used for storing electronic certificates and passwords. The practical advantage of USB tokens over smart cards is that the USB port on the local machine can be used, whereas smart cards require an additional card reader.

One-time password generators (OTP tokens) provide an alternative to certificates. OTPs are available in various form factors: hardware, software, grid cards, and "as a service," which is typically in the form of SMS (see the "Free OTP Systems" box). OTP tokens provide the user with a short-lived one-time password for the login.

Depending on the manufacturer and the method used, a distinction is made between time-based or time-synchronized tokens, TOTP (time-based one-time password algorithm, as defined in RFC 6238 [12]), and event-based tokens, HOTP (HMAC one-time password algorithm, per RFC 4226 [13]). Hardware-based, time-based tokens are usually more expensive because they require an accurate clock as a counter, which must be installed in addition to hardware.