Authentication

What is authentication?

Authentication is a multi-stage process in identity management. Authentication in an IT system implements IT security functions that are realized by various security services and components.

What is authentication? – How do the Auth processes of authentication, authentication and authorization differ?

Within the framework of authentication processes, a distinction is made between

Authentication

A user authenticates himself to an IT system (IT service, server, …) by providing proof of his identity, the user name.

Authentication

With authentication, the system checks the authenticity of the proof provided in order to verify the identity of a user. Authentication can be performed by a cloud service, a dedicated server or another component connected to the network through which authentication is performed.

Authorization

If the authenticity of a user’s identity could be successfully verified, the IT system (IT service, server, …) can grant the user defined rights for the IT service/server.

Methods for authenticating digital identities

Basic principle: access is granted after proof.

Most common authentication method: password entry

Authentication through knowledge

Authentication using knowledge verifies knowledge of a secret.

Text secrets

• Password
  • PIN, TAN
  • …

Graphic secrets

• QR code (= indirect text)
• Select pictures on which friends can be recognized

Advantages:

• established => everyone knows about the method, easy to use
• Secret can be changed at any time
• no special hardware necessary

Disadvantages / Weaknesses:

• Security depending on complexity
  • • the more complex, the safer
    • the more complex, the more difficult to remember
  • too many secrets are difficult to remember
  • only safekeeping of the secret provides protectio

Authentication through ownership

Authentication using possession involves checking the presence of a specific object.

• ID card
• USB token

Advantages:

• no special knowledge required

Disadvantages / Weaknesses:

• Object can be lost
• Theft possible and enables access to digital identity
• mostly additional hardware required, e.g. card reader

However, it is also important to note that haptic cards and the associated readers will not necessarily be replaced entirely in the course of digitization. Rather, virtual authentication solutions are intended to serve as a practical supplement to facilitate globally mobile working. In addition, virtual card images can serve as a backup should haptic cards be lost or damaged.

Authentication through biometric feature

Authentication by biometric features involves checking physical characteristics of a person.

Physical Characteristics:

• Fingerprint
• Face shape
• Iris
• …

Behavior:

• Movement patterns
• …

Advantages:

• unique per person

Disadvantages:

• Special hardware required for capture
• biometric information is SENSIBLE information
• Testing not possible exactly, but only on the basis of probabilities
• enables counterfeiting, this must only be “good enough
• Once a feature is compromised, it is difficult to change the feature

Multi-factor authentication (MFA)

In multi-factor authentication, different authentication methods OR authentication factors are checked simultaneously, i.e. simultaneously during the execution of an identification process.

Physical Characteristics:

• Fingerprint
• Face shape

2-factor authentication (2FA)

In 2-factor authentication, TWO authentication methods OR authentication factors are checked simultaneously, i.e. at the same time during the execution of an Ident operation.

2FA example:

1st factor: Knowledge: Password
2nd factor: Possession: smartphone, through which second code is provided.

TOTP-based MFA

Multi-factor authentication with a time-based one-time password (TOTP) is an MFA variant that realizes an improved level of protection if the time period of the one-time password is sufficiently short (typically around 60sec or even less than 30sec) and can be combined with an additional Auth-App such as the Google Authenticator app can be realized.

The TOTP MFA procedure was published back in 2011 by the Internet Engineering Task Force (IETF) as RFC 6238. The TOTP algorithm is a hash function in which a secret password is hashed together with the current time.

This HMAC-based algorithm generates a one-time password and is specified according to RFC 4226; the RFC defines exactly this standard according to which the hash values are formed. The procedure can be implemented in such a way that slight deviations of the time between client and server are accepted.

Basic rules for a secure TOTP MFA implementation

The following basic rules apply for a secure TOTP MFA implementation:

• Quality of random numbers: For a cryptographically secure password, actually randomly chosen elements for the one-time password are also important
• Secret Key for each user: Each user needs his or her personal, secret access key (Secret Key)
• Brute force protection: A 6 or even 8 digit one-time password is short. Additionally, it MUST be ensured that the user has only a few attempts per interval to authenticate. Otherwise, a brute force attack by a potential attacker will succeed within a very short time.
• Protection against replay attacks: An accepted key must not be accepted a second time within the same time interval.
• HTTPS/TLS encryption: The encryption service SHALL be protected via HTTPS protocol and TLS certificate, so that the key transport is protected.
• Protection of QR codes: QR codes used in the MFA process MUST be generated in a protected environment. No Secret Key may be distributed in an uncontrolled manner.

Processes: Login with authentication + authorization

Trust level based processes: Authentication + authorization based on trust level

When establishing identities, it is strongly recommended that entities that want to access digital identities – similar to the eIDAS-based technical implementation of the AusweisApp 2 – verify them beforehand and make this verification transparent for users. For this purpose, different confidence levels are to be used, depending on the type of data to be queried.

History of authentication:

The history of authentication goes back a long way, long before digital technologies entered our daily lives. In ancient civilizations, seals and signatures were used as a form of identity confirmation. With the emergence of commercial banks in the Middle Ages, the first rudimentary passwords and pins were developed to allow customers to access their vaults or accounts. In the 20th century, especially with the advent of computers, digital authentication became increasingly relevant. The introduction of usernames and passwords in the 1960s was a significant step, followed by the development of token-based systems and smart cards in the 1980s and 1990s. Biometric authentication, which uses physical or behavioral characteristics such as fingerprints or voice recognition, became increasingly popular in the late 20th and early 21st centuries. Today, in an era of cloud technology and the Internet of Things, authentication is realized through a combination of traditional passwords, biometrics and two-factor authentication methods to ensure security in an increasingly connected world.

Counter IT security risks effectively:

In today’s digitized world, the risks surrounding authentication are diverse and constantly changing. The most common threats include:

• Phishing attacks: Attackers try to trick users into entering their login details on fake websites.
• Man-in-the-middle attacks: In this type of attack, an intruder interacts between two parties and can steal or manipulate information.
• Brute force attacks: This involves systematically trying out all possible password combinations until the attacker gains access.
• Password recovery attacks: If password recovery processes are not secure, attackers can use them as a gateway.

To counter these and other security threats, organizations are turning to advanced authentication methods such as multi-factor authentication, adaptive authentication and continuous authentication. In addition, it is crucial to train users in security practices, conduct regular security audits and keep systems constantly updated to minimize potential vulnerabilities.

Why does Zero Trust play a crucial role in IT security?

In an era where cyberattacks are becoming increasingly sophisticated and traditional security perimeters are no longer sufficient, the Zero Trust model is coming to the fore. This security concept is based on a simple principle: Trust nothing, verify everything. Instead of focusing on perimeter defense, Zero Trust relies on strict identity verification for anyone attempting to access network resources, regardless of whether the access is from inside or outside the network. Combined with advanced authentication methods, Zero Trust ensures that only authorized users and devices have access to critical data and applications. This minimizes the risk of data breaches and ensures that resources are secure even in open and decentralized network environments. If you want to take your IT security to the next level, understanding Zero Trust in combination with effective security measures and modern authentication is key. Dive deeper into this topic and find out now how you can optimally protect your digital ecosystem.

Secure authentication – challenges and best practices

Authentication is at the heart of digital security, as it ensures that only authorized persons or devices have access to sensitive data and systems. In a world where digital identities are playing an increasingly important role, strong and reliable authentication processes are essential.

Overview of key authentication technologies

1. single sign-on (SSO)
SSO systems allow users to gain access to multiple applications or services with a single authentication. This not only improves user-friendliness, but also reduces the attack surface as fewer passwords are used. 2. adaptive authentication
This technology analyzes contexts such as location, device information and user behavior to assess security risks and automatically adjust the required security level. This creates a balance between convenience and security. 3. passkey-based authentication (WebAuthn)
By using cryptographic keys that are stored locally on a device, passkey-based authentication makes traditional passwords obsolete. This approach is supported by modern standards such as FIDO2 and offers significant advantages in terms of security and user-friendliness.

Best practices for secure authentication

• Improve password management
  Use password managers to generate and store complex and unique passwords. Passwords should be checked and changed regularly, especially after security incidents.
• Protect sensitive data with encryption
  Use Transport Layer Security (TLS) to encrypt data during transmission and secure sensitive data such as passwords in hashed form in the memory.
• Regular training
  School users on potential threats such as phishing and safe behavior when dealing with digital identities.

Recommendation from the Rock the Prototype Podcast: Digital identities and identity access management

For further insights into modern security approaches and authentication strategies, we recommend listening to podcast episode 13: Digital Identities and Identity Access Management. In this episode, we take a deep dive into the world of identity verification and shed light on how single sign-on and adaptive authentication are implemented in modern systems.

Why this podcast episode is relevant for you:

• Understanding of authentication systems: Learn how different authentication methods interlock to strengthen IT security.
• Practical insights: Find out how companies overcome challenges such as zero trust and multi-factor authentication.
• Strategic application: Get tips on how to optimize authentication processes and adapt them to the needs of your project.

Rock the Prototype Podcast

The Rock the Prototype Podcast and the Rock the Prototype YouTube channel are the perfect place to go if you want to delve deeper into the world of web development, prototyping and technology.

🎧 Listen on Spotify: 👉 Spotify Podcast: https://bit.ly/41pm8rL

🍎 Enjoy on Apple Podcasts: 👉 https://bit.ly/4aiQf8t

In the podcast, you can expect exciting discussions and valuable insights into current trends, tools and best practices – ideal for staying on the ball and gaining fresh perspectives for your own projects. On the YouTube channel, you’ll find practical tutorials and step-by-step instructions that clearly explain technical concepts and help you get straight into implementation.

Rock the Prototype YouTube Channel

🚀 Rock the Prototype is 👉 Your format for exciting topics such as software development, prototyping, software architecture, cloud, DevOps & much more.

📺 👋 Rock the Prototype YouTube Channel 👈  👀 

✅ Software development & prototyping

✅ Learning to program

✅ Understanding software architecture

✅ Agile teamwork

✅ Test prototypes together

THINK PROTOTYPING – PROTOTYPE DESIGN – PROGRAM & GET STARTED – JOIN IN NOW!

Why is it worth checking back regularly?

Both formats complement each other perfectly: in the podcast, you can learn new things in a relaxed way and get inspiring food for thought, while on YouTube you can see what you have learned directly in action and receive valuable tips for practical application.

Whether you’re just starting out in software development or are passionate about prototyping, UX design or IT security. We offer you new technology trends that are really relevant – and with the Rock the Prototype format, you’ll always find relevant content to expand your knowledge and take your skills to the next level!