Authentication: The Ultimate Guide

Authentication enables organizations to maintain the security of their important network by allowing only authenticated users or processes to access protected resources. Authentication relies on systems, networks, databases, websites, and applications, end-users, or other network-based services.

Once authenticated, the user or process typically undergoes an authorization process to determine whether the authenticating entity should be allowed to access certain resources or systems. The user can be authenticated but not granted access tokens to certain resources if the user is not permitted to access them.

But there are significant differences in authentication types, and also with something we called authorization. In this article, we will discuss all of those issues and also more about understanding authentication. What is authentication? How does it work? What are the factors? How to use a third-party platform to get it? Let’s discover all below.

What is authentication?

Authentication is the process of verifying that users are who they claim to be. This is the first step in any security process.

There are a lot of things that should complete an authentication process, such as: 

• Passwords. Usernames or passwords are the most common factors. If the user enters the correct data, the system will assume that the identity is valid and grants access.
• One-time pins. Granting authentication for one time/session only.
• Authentication applications. Generate security tokens via a third party that grants access to an authenticated user
• Biometric. The user provides a fingerprint or eye scan to log into the system.

In some cases, authentication systems will require the validation of more than one factor before granting access. Multi-Factor Authentication (MFA) requirements are often implemented to increase security beyond what passwords alone can provide.

Authentication consists of validating your credentials such as user name/user id and password to verify your identity. The system then checks to see if you claim to be using your credentials. Whether it is public or private networks, the system authenticates user identity or user data utilizing a login password. Authentication is usually performed by a username/ user id and password, although there are other different methods for gaining access.

Authentication factors define many different elements that the system uses to verify an individual's identity before granting an individual access to anything. An individual can be identified by what the person knows, and when it comes to security, at least two or all three of the authentication factors must be verified to allow someone to access the system. Depending on the security level, the authentication factors can differ from one of the following:

1. Single-Factor Authentication:

This is the simplest form of authentication method. This method only requires a password to allow the user to log into a specific system such as a website or network. In single-factor authentication, A person can request access to the system using a single credential to verify a person's identity. For example, requiring a password only for a username would be a way to verify log-in credentials using one-factor authentication.

2. Two-Factor Authentication:

Two-factor authentication requires a two-step verification process that requires not only a username and password but also information known only to the user. The term which also known as 2FA, is using usernames and passwords along with confidential information makes it more difficult for hackers to steal valuable and personal data.

3. Multi-Factor Authentication:

This is the most advanced authentication method that requires two or more levels of security from independent authentication classes to allow the user to log into the system. 

How does authentication work?

During authentication, the credentials provided by the user are compared to those in a file in the authorized user's information database either on the local operating system server or through the authentication server. If the credentials entered match those in the file and the authenticated entity is authorized to use the resource, the user will be granted access. User permissions define the resources the user can access as well as other access rights associated with the user, such as the hours during which the user can access the resource and the number of resources the user is allowed to consume.

Traditionally, authentication is performed by the system or resource being accessed. For example, the server will authenticate the user using the system password, login ID, or username and password.

However, the web application protocols - Hypertext Transfer Protocol and HTTP Secure - are stateless, which means that strict authentication will require end-users to re-authenticate each time they access resources using HTTPS. To simplify user authentication for web applications, the authentication system issues a signed authentication token for the end-user application; This token is added to every order from the customer. This means that users do not have to log in every time they use the web application.

Also read: What is One Time Password and How It Can Help Your Business

Authentication and Authorization

Despite the similar terminology, authentication and authorization are two separate steps in the login process. 

So what’s the difference between authentication and authorization?

Let's use an analogy to determine the difference between authentication and authorization.

Consider someone walking into a closed-door to care for a pet while the family is on vacation. This person needs:

Authentication, in the form of a key. The locks on the doors only grant access to someone with the correct keys in the same way that the system grants access only to users with the correct credentials.

So, in the form of a permit. Once inside, the person has permission to enter the kitchen and open a cupboard containing pet food. The person may not have permission to go to the bedroom for a quick nap.

Authentication and authorization work together in this example. Pet sitters have the right to enter the house (authorization), and once there, they can access certain areas (permission).

How do you utilize both?

• Authentication. Allow each employee to access your workplace systems if they provide the correct credentials in response to the authentication requirements you selected.
• Authorization. Grant permission to department-specific files, and maintain access to confidential data, such as financial information, if needed. Make sure that employees have the access they need to the files they need to do their jobs.

Authentication types

1. Strong Authentication

Strong authentication is a multi-layered authentication approach that relies on two or more authentication methods to identify the originator or recipient of information.

The factors used must be independent of each other and at least one must be "non-reusable and non-repeatable", except in the case of internal factors, and must also not be stolen from the Internet. The Fast IDentity Online Alliance (FIDO) has gone to great lengths to develop technical specifications for strong authentication. 

2. Continuous Authentication

Traditional computer systems only authenticate users in the initial login sessions, which can be the cause of serious security flaws. To solve this problem, the system requires a persistent user authentication method that constantly monitors and authenticates the user based on some biometric properties. Study using behavioral biometrics in writing style as a continuous method.

3. Digital Authentication

This refers to a set of processes by which trust in a user's identity is created and provided via electronic methods of information systems. This process creates technical challenges due to the need to authenticate remote individuals or entities over a network. 

4. Product Authentication

Security hologram sticker on electronic box for authentication

Often counterfeit products are presented to consumers as original products. Counterfeit consumer goods, such as counterfeit electronics, music, clothing, and drugs, were sold as legitimate merchandise. Efforts to control the supply chain and educate consumers help ensure that authentic products are sold and used. Even security printing on packages, labels, and nameplates can be counterfeited.

Authentication factors

Certain categories of credentials, such as usernames and passwords, are usually said to be authentication factors. Even if the password is the most popular type of authentication, there are other authentication factors. There are three authentication factors which are usually categorized as follows:

• - Something you know (Knowledge factor), for example, a password
• - Something you have (Possession factor), for example, a smartphone
• - Something you are (Inherence factor), for example, biometric

Something You Know

This term which is also known as the knowledge factor requires the user to show that they know something. Usually, a password or personal identification number (PIN) is shared between the user and the Identity Access Management (IAM) system.

To use this factor, the system requires the user to provide shared information from the requested resources.

Something You Have

The next one of the three categories of authentication factors is something you have. In this case, the user must prove that he or she owns something, such as a smartphone, smart card, or mailbox. The system is a challenge for users to ensure that they have the required authentication factors. For example, it can send a time-based one-time password (TOTP) in a text message to a user's smartphone. Also, we can send a code via email and even WhatsApp.

Something You Are

This authentication factor is based on a piece of information in the user that is attached to that user (inheritance factor). Typically, this information is a biometrics property such as a fingerprint, facial recognition, voice recognition, or even retina scans.

Also read: WhatsApp Business API: Basics and Ultimate Guidelines

Authentication without password

As the name suggests, passwordless authentication is an authentication mechanism that does not use a password. The main motivation for this type of authentication is to reduce password stress, i.e. the effort required for users to remember and maintain a strong password.

Eliminating the need to remember passwords also helps make phishing attacks useless.

You can do passwordless authentication using any factor depending on what you own and who you are. For example, you can allow users to access a service or application by sending a code via email or through facial recognition.

Using Third-Party to Help Authentication Process

In one of the examples that we discussed above, there are several mentions about One-Time Password, which falls into the category “Something you have”. OTP can be a way to do authentication and is known as one of the more secure options. 

The one-time password is the same as a password but can only be used once so it is called a one-time password. It is often used with regular passwords as an additional mechanism that provides additional security.

A one-time password is exactly what it sounds like: once and done. Once you apply that password once in a session, it is useless and dumped, and the next time you need to log in to this app, you'll use another password. Doing so increases security and makes it more difficult for a malicious person to hack private accounts.

Users can access the OTP of a specific app or website via a mobile phone app, text message, or a proprietary code (such as a key fob). 

There are many industry-standard algorithms, such as SHA-1, that generate OTP. All of these algorithms use two inputs to generate the OTP token: the base operator and the moving operator. The origin is a constant value (secret key) that is generated when a new account is created on the authentication server.

One of the OTP providers to authenticate the login process is SendTalk by Taptalk.io. SendTalk uses WhatsApp as a medium to send OTP code, as a more secure option than text messages. In addition to sending OTP messages, you can also send notifications such as account activity, reminders, purchase confirmations, delivery notifications, and even alerts to your customers.

With SendTalk, the cost to send OTP via WhatsApp is cheaper than via SMS. If you use SMS, you need IDR 350 to send one OTP message. Meanwhile, with SendTalk, the required fee is only starting from IDR 75/message. 

In addition, sending OTP with WhatsApp is more consistent because it doesn't need to rely on a cellular signal. You just need to use the internet.

The authentication process on SendTalk are below:

1. User Login

The user logs into the website or application with the registered mobile number (or with the username and password).

2. OTP to WhatsApp

The OTP is sent to the user's mobile number via WhatsApp.

3. Enter OTP

The user enters the OTP on the website or application page

4. Authenticated

The website or application will check the OTP and will give you login access.

There are so many more features from SendTalk that will make your company more reliable in keeping customers’ data and reduce data security risk. Want to know more about SendTalk? We are happy to talk with you! You can click here to talk with our agent.