Authentication is the process of confirming that a user is who that person claims to be. An authentication protocol is the method you use to accomplish that task.
Several authentication protocols exist. None are 100 percent foolproof. Choose your method carefully, however, and you will reduce the risk of hacking and data theft.
Read Also: Types of authentication protocol
What are authentication protocols?
An authentication protocol allows the receiving party (such as a server) to verify the identity of another party (such as a person using a mobile device to log in). Almost every single computer system uses some kind of network authentication to verify users.
As more critical information is stored electronically, and as hackers become more and more adept at theft, authentication becomes more important. Without it, losses can be significant. For example, Deloitte experienced a data breach in 2017 that exposed client email (including some tied to government agencies). Authentication may never keep your information perfectly secure. But it can make theft harder to accomplish. Hackers may move to a different target if your servers are too difficult to penetrate.
How Does Authentication Work?
In a traditional authentication process, the user types in their credentials, such as a username and a password. The authentication system queries a user directory, which is either stored in the local operating system or on an authentication server. If the credentials match, the user is allowed to access the system. In the second stage, permissions assigned to users determine what objects or operations they are allowed to access, and other access rights, such as allowed access times and rate limits.
- Traditionally, each IT system or application would handle its own authentication. This created a burden on application developers and meant that authentication systems were non-standard, in many cases not secure.
- Applications are increasingly delivered over the web. Today most applications communicate via HTTP and HTTP/S. These are stateless protocols, meaning that in a traditional authentication model, users would have to login to a web application every time they accessed it.
- Password-based authentication is very easily compromised by attackers, and is also inconvenient to users.
There are several types of authentication protocols used in computer networks and systems to verify the identity of users or entities. Here are some of the most common types:
- Password-based Authentication: This is the most common form of authentication where users provide a username and password to gain access to a system.
- Token-based Authentication: Users provide a special token, such as a hardware token or software token (like Google Authenticator), in addition to their username and password.
- Biometric Authentication: Users provide physiological or behavioral characteristics for authentication, such as fingerprints, iris scans, facial recognition, or voice recognition.
- Certificate-based Authentication: This involves the use of digital certificates issued by a trusted Certificate Authority (CA). The user presents a certificate instead of or in addition to a password for authentication.
- OAuth (Open Authorization): OAuth is an authorization protocol that allows a user to grant a third-party application limited access to their resources without sharing their credentials. It’s commonly used for authentication in applications that require access to user data stored on another service (e.g., signing in with Google or Facebook).
- OpenID: OpenID is an authentication protocol that allows users to be authenticated by certain co-operating sites (known as relying parties or RP) using a third-party service.
- Kerberos: Kerberos is a network authentication protocol that uses tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner.
- LDAP (Lightweight Directory Access Protocol): LDAP is often used for centralized authentication and authorization services. It allows a client to query, add, delete, or modify entries in a directory service, such as Active Directory.
- RADIUS (Remote Authentication Dial-In User Service): RADIUS is a networking protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
- SAML (Security Assertion Markup Language): SAML is an XML-based open standard for exchanging authentication and authorization data between parties, particularly between an identity provider and a service provider.
- FIDO (Fast Identity Online): FIDO is an open standard for passwordless authentication. It aims to reduce reliance on passwords by enabling users to authenticate using biometrics, hardware tokens, or other methods without needing to rely on passwords.
Each of these authentication protocols has its own strengths, weaknesses, and specific use cases, and the choice of which one to use depends on the security requirements and constraints of the system being implemented.
How to choose among authentication protocols
With so many options, how can you choose the version that’s right for you?
Consider your:
- Application needs. What systems and resources require access? How significant or private are they?
- Infrastructure. What protocols can you launch without overhauling your existing system?
- Effort. How much training or programming will you need before you can get started?
- Future. Can the system grow and change with your company?
