by Gavin Kerrigan

Created on: May 21, 2009

WHAT IS STRONG AUTHENTICATION?

Strong Authentication is the authentication (identification and authorization checking) by one entity on another entity on the basis of a digital attribute. It is usually used to identify users (and client components) to systems (and server components).

Strong Authentication differs from regular (conventional) authentication in that the latter is based on a shared secret known by the two parties. The two parties are: the to-be authenticated party (users and client components) and the authenticator party (system and server components). Strong Authentication does not use a shared secret. Strong Authentication uses, instead, asymmetric encryption, meaning the to-be-authenticated party (users and client components) knows a secret (Private Key), which nobody else knows. The authenticator party (system and server components) knows the corresponding Public key but not the Private Key.

WHAT IS THE PROBLEM OF A SHARED SECRET?

(Conventional authentication scheme)
If the user is not the only one who knows the secret, the administrator or the corporation has a problem. The user will be able to claim that he did not access the network. Somebody else accessed the network (authentication server) and knows my secret. Unfortunately he may be right. Nobody can refute his claim.

HOW CAN YOU BENEFIT FROM STRONG AUTHENTICATION?

The main benefit is that users can securely authenticate themselves to an application or system component. Securely means that no one can impersonate the authorized user, including the system administrator himself! The system administrator does not know the user's private key! The administrator can surely corroborate that the user is, indeed the user, by simply opening a message signed by the user with the user's Public Key. But he cannot sign a message with the user's public key! To do so he would need the user's Private Key. The administrator doesn't know the Private Key; in fact no one knows it, only the user.

In others words the user cannot be impersonated. This means that the access granted to him is not repudiable. The user cannot deny that he accessed the network. This is a very important and valuable feature. If a hacker penetrates the authentication server, he cannot steal the user's secrets, simply because they are not there.

Also Strong Authentication eliminates the need to enter a user name and password as required by a conventional sign-on procedure. This provides a higher level of security access to applications.

• 1
• 2
• Next Page >>