1. What is user authentication?
2. What is strong authentication?
3. Why is there a need for strong authentication?
4. What kind of intruding attacks are there?
5. What is a smart card?
6. What is hardware token?
7. What is biometrics?
8. What is authorization?
9. What is Authernative’s foundation?
10. How does Authernative address the challenge of Internet authentication?
11. How secure is Authernative’s solution?
12. Why not just use passwords?
13. Why not just use hardware tokens?
14. Why not just use smart card?
15. Why not just use biometrics?
16. What is unique about Authernative’s authentication technology?
17. What is unique about Authernative’s authorization technology?
18. How does Authernative’s authentication compare to other types of solutions?
19. What are mandatory requirements to business IT security?
20. Why do you need online self-reset of authentication credentials?
21. Why do you need online account setup capabilities?
22. Why do you need automated security and system administration event logs / databases?
23. Why do you need encryption of authentication credentials on communication lines?

User Authentication is the process of verifying the identity of a person. A legitimate user accessing a network through the Internet, Extranet, or Intranet must be positively identified and verified through digital means. Below are the types of means, known as authentication factors, used to establish the truth of or identity claimed by the user:

Back to Top

Strong authentication is any combination of the above mentioned factors and perhaps other ones, also called two- or three-factor authentication. By combining several independent authentication factors, much stronger security against intruding attacks is assured. For example, one factor may be something that the user knows such as a password or PIN, while the second factor may be something the user has, such as a token, or a smart card. If one of the factors is lost or stolen, the user’s identity cannot be compromised.

Back to Top

More and more businesses are utilizing the speed and economic advantages of the Internet to transact and exchange sensitive or confidential information. While expanding their e-business environments to employees, customers, and partners, businesses become exposed and vulnerable to many risks including unauthorized access, fraud, IP theft, information leaks, and malicious harm. If users’ identities are not properly authenticated, an organization has no assurance that access to resources and services is properly controlled. Businesses with Internet presence can have a potentially large community of customers and partners in various diverse geographic locations, connected through only the browser. Therefore, strong authentication is of critical importance to positively identify such participants.

Back to Top

Below is a table outlining common intruding attacks used to gain authentication credentials or access to resources.

Back to Top

A smart card is a credit card-like device with both memory and CPU on board enabling client/server communication and client side data processing. It is used to store personal credentials and / or other information. The smart card often requires a PIN to unlock the card.

Back to Top

A hardware token is a device that generates a one-time password to access secure resources. It is time or event pre-synchronized with the server. The device can take a form of:

• the size of a credit card but thicker,
• small handheld device with LCD window, a key fob with LCD window,
• USB fob,
• calculator,
• PDA or smart phone running vendor-supplied software.

Back to Top

Biometrics provides a method of generating authentication information for a person by digitizing measurements of a physiological or behavioral characteristic. Whatever the characteristic is used, (i.e. fingerprint, retina scan, hand geometry, voice pattern), the identity of a user is verified by comparing a “live” sample, encoded from the captured image or data, with a reference template that was created during an enrollment process.

Back to Top

Authorization is the process of allowing a specific user access to certain resources, based on a pre-determined set of rules called a user profile or policy. Authorization should be granular, meaning it is able to differentiate between users, so that they are only able to access their own specific information.

Back to Top

Authernative developed a portfolio of Intellectual Property giving way to next generation technologies and original products. Authernative addresses key security and business challenges of the Identity Management, 3A (authentication, authorization, administration) and Encryption market segments.

Back to Top

Authernative’s secure authentication technology provides companies with an effective and economical means of ensuring that access to protected networks and resources is granted to the authorized users only, regardless of the network infrastructure or location of users.

• It provides strong authentication that is highly secure, yet electronically deployable, cost effective, user friendly and convenient.
• It positively identifies the individual attempting to access the network or resource.
• It prevents somebody from assuming the identity of a valid user through the use of a guessed or stolen password.
• It greatly reduces the administration headache and user resistance to password management.
• It is a highly scalable, easy to implement solution that is well within the technical and financial capability of small and large corporations, often generating a return on investment measured in months.

Back to Top

Authernative AuthGuard® solution offers several legacy and advanced authentication methods to choose from. In particular, the advanced authentication methods utilize customizable Random Partial Shared Secret algorithms minimizing credentials’ entropy leakage and enhancing credential combinatorial capacity for stronger protection against known attacks. The authentication server never challenges the user to provide the full shared secret, but instead requests a session-only random subset of the graphics based shared secret. This one-time authentication challenge initiates a one time authentication response that cannot be reused if intercepted by an intruder.

Additional security capabilities include two-channel (out-of-band) authentication, strong mutual authentication, as well as combinations of authentication factors for layered security or “what user knows” and “what user has” two-factor authentication. AuthGuard® also includes a proprietary client-server session encryption key management system and separately, RDBMS- or LDAP-based user store encryption scheme. Each of them protects user authentication credentials. The product also applies SSL to protect the content exchanged between client and server during the communication session. Integrated into one product, these capabilities provide end-to-end security protecting against multiple intruding attacks at credentials’ input devices, communication lines, and back-office user stores.

Back to Top

Passwords offer inadequate security and have hidden costs. Passwords do not assure conclusive identity of users that is so necessary for sensitive, valuable, or private information access or transaction. The risks associated with passwords are many and well known (see the table below). Other issues with passwords are the associated high costs and complexities required to make them secure. Due to the lack of security of passwords, organizations typically require users to choose longer or complex passwords and change them on a frequent basis. This creates administration and maintenance complexities and hassles both for the organization and for the end user that results in higher operating and hidden costs, as well as productivity loss.

Back to Top

Ubiquitous Internet resources, transactions, and applications are accessed by a large number of users dispersed around the world. The costs, hassles, and inconvenience of acquiring, distributing, and maintaining hardware tokens for mass users make it an impractical solution. Below are the reasons why:

• Hardware tokens are difficult and/or costly to distribute securely.
• Requires manual distribution.
• Hardware tokens are required to be carried with the user, which is inconvenient.
• Can’t force customers to carry or use hardware tokens.
• Tokens may require appropriate peripherals, readers and/or software on the workstation.
• Impractical for mass deployment.
• Hassle to replace.
• A hardware token may be lost or stolen, maybe without the user’s knowledge.
• Software tokens have a particular risk: a software token alone authenticates the workstation, not the user.
• Increase in number of steps for the user when using challenge/response hardware token.

Back to Top

Ubiquitous Internet resources, transactions, and applications are accessed by a large number of users dispersed around the world. The costs, hassles, and inconvenience of acquiring, distributing, and maintaining smart cards for mass users is impractical. Below are the reasons why:

• Smart cards security has been known to be compromised.
• Smart cards require user’s devices to include a smart card reader.
• Smart card readers are costly and not widely distributed in devices, requiring the user to purchase and install them.
• Smart cards are difficult and/or costly to distribute securely.
• Smart cards require manual distribution.
• Smart cards are required to be carried with the user, which is inconvenient.
• Can’t force customers to carry or use smart cards.
• Mobile end-users access to smart card readers is even more problematic.
• Smart cards are impractical for mass deployment.
• Hassle to replace.
• A smart card may be lost, stolen, left or forgotten in the workstation.
• PIN protection is clearly indicated, but even so, strong, two-factor authentication has been reduced to a single factor: anyone with physical access to the smart card need only discover the user’s PIN to be able to masquerade as that user.
• Smart card authentication conflicts with the accepted Internet model for application use where the end-user simply needs a browser.

Back to Top

There are several reasons why biometrics is an unpractical solution.

• Biometric authentication is known to be compromised.
• Requires biometric devices that are expensive and as yet not sufficiently reliable.
• Biometric devices are costly and not widely distributed in devices, requiring the user to purchase and install them.
• User acceptance is an issue, especially with regard to privacy, religious, and civil rights issues.
• Biometric authentication relies on close matches. Depending on the match required, a bogus user might be falsely accepted or a legitimate user might be falsely rejected. False acceptance rates and false rejection rates require balancing security against ease of use.
• The biometric characteristic itself might change from time to time. For example, a person’s voice may change if he or she is not feeling well. The sample might vary depending on how the scanner is used. How close a match is required to verify a user depends on what biometric technology is used and how it is configured in a particular implementation?
• An organization must ensure that scanners cannot be fooled by prosthetics, images, and so on.
• Between one and three percent of the public does not have the body part required for any one biometric.
• Is biometrics truly unique?, DNA, for example, is shared by identical twins. Is the encoded sample unique? Poor resolution or a poor algorithm might give rise to samples that collide.
• Once a biometric trait is compromised, it cannot be reissued. Furthermore, a user will tend to use the same finger, iris, etc., with different systems using the same biometric technique. If one the biometric trait is compromised on one system, all systems are exposed. Even an encrypted biometric password may be “cracked” years in the future, which would render that password useless.
• Confidentiality of the user's biometric sample and template is crucial and must be robust over the lifetime of the user. That is, any cryptography must be designed to withstand foreseeable cryptanalysis 30 to 40 years from now, so will most likely involve unusually long keys.

Back to Top

Authernative’s solution is the first commercial offering providing multiple legacy and advanced innovative authentication methods integrated into a single web based login GUI console. Particular authentication methods can be mandated by system administrator or made available to end-users for selecting themselves. This flexibility allows personalizing the level of security and the ease of use particular to the user’s needs or company’s policies. The legacy, one-time challenge-response, multi-channel, multi-factor & mutual authentication methods allow to scale the level of security and usability to meet any range of authentication requirements in an electronically deployable and cost effective manner. The web login console also includes self-service capabilities allowing users to establish & set-up their account and self-reset their credentials without contacting help desk. The result is an easy to use, scalable security solution having a low total cost of purchase, deployment and management.

Back to Top

Authernative’s authorization technology incorporates multiple layers of security including native integration with our own authentication engine, a client and server early stage intrusion detection, and encryption schemes. These proprietary strong security layers enhance the product’s resource protection (authorization) engine. Authernative’s authorization engine enforces user privileges and rights across domains and enterprise environments to protect any network resource or corporate data, managing all your users, roles, groups, and security policies.

Back to Top

Security technology is fast becoming a priority for any company in the New Economy, as the number and frequency of security breaches, vicious virus attacks and cyber-attacks skyrocket. A large number of vendors offer various authentication solutions. Here is how Authernative compares to them:

Back to Top

In the past several years there have been a growing number of International, federal, and state regulations passed to increase security, protect consumer privacy against fraud and cyber-terrorism, as well as enact audit and reporting controls. The common compliance factor of these regulations requires that network resource access security systems know who users are and make reasonable efforts to tightly authenticate those users. Once a system knows who the user is, it must then know what the user is permitted to do online. After that, the system is expected to record what the user has done and to provide an auditable record that reconciles user’s privileges and actions.

Unsecured enterprises will face civil liability as well as higher costs from poorly administered, expensive security programs, intellectual property losses, theft and lawsuits. Superior security will become a competitive advantage, and poor security will be increasingly disadvantageous.

Back to Top

Productivity and support costs are the main issues when it comes to calling help desk to reset authentication credentials.

Users, who forget their passwords, waste time on (trying to log in, calling the help desk and waiting for service, proving their identity and waiting for a password reset). Each problem incident may consume 20-30 minutes of user’s time per authentication credential. In many organizations, users experience this problem 2-4 times annually. In a large user population, this generates a huge volume of user problems and help desk calls. These calls normally represent 30% to 40% of total help desk call volume with estimated cost $20-$60 per incident.

Allowing the user to self manage a password reset from any PC at any time, without calling help desk, significantly reduces productivity loss and support costs.

Back to Top

By leveraging the power, efficiency, and mass reach of the Internet, organizations can save enormous amounts of administrative time by allowing users to enroll themselves. Users are able to create accounts online, including login IDs and authentication data, as well as enter personal profile information required by human resources or administration departments. Such personal profiles can be then utilized for further security assurance if the user wants to update or self-reset forgotten authentication credentials online. Accounts having been setup online are on hold and not released until the enterprise security check is completed, and user’s authorization to protected network resources is configured.

Back to Top

In order to provide accountability, non-repudiation, audit trails, proper reporting, and meet regulatory requirements, the system is expected to record what the user or administrator has done, and to provide an auditable record helping to reconcile one’s privileges and actions.

Back to Top

Public electronic networks (like the Internet) have multiple “access points” allowing to intercept digital information, and expose it to powerful computer-processing offline attacks. It is especially dangerous when user authentication credentials are deciphered, giving an intruder (or an intruding organization) an illegal network access. After the authentication part of a communication session is passed, other data, follow-on messages exchanged or files transferred, can be compromised the same way as authentication credentials. In both cases, encryption of data, when in transit on communication lines, is the only line of defense, and it is as strong as the encryption itself.