Subject: [VoT] Factors used to compare Authentication Technologies

From: Berit Naomi Skjernaa <[email-masked]>
Date: Tue, 21 Apr 2015 14:04:47 +0000

Dear all,

During the last IIW we held a session named "A Guide for Integration of Authentication Technologies" which attempts to define a useful way to compare authentication technologies by analysing many different factors that we considered of relevance.

In order to draft this analysis we made use of the valuable input retrieved from the VoT list and, during the discussion at our IIW session, some of the participants suggested that some of the output from our work could also be useful as input for the VoT discussion...

Therefore, I forward you here the list of authentication factors that could possibly be of interest to consider in terms of the VoT...

The factors presented are grouped in 3 main areas...

Please, take into account that this work is only a first draft that has been prepared with the objective of comparing Authentication Technologies which, although related, it is not exactly the same problem that VoT is trying to tackle... (handle Electronic Authentication).

I just hope that some of this material can be useful to the VoT list and I also really hope that by doing so, I am not introducing too much noise into your existing discussion...

1. Hardware context

+ Context: This indicates the context in which it makes more sense to deploy a particular implementation of an Authentication Technology. It may be:

                             * Personal: The registration and authentication processes are only controlled by one self.

                             * Perimeter: The registration and authentication processes are relevant and controlled under a particular perimeter (business, governmental institution, military base, etc...).

                             * Public: The registration and authentication processes are relevant for general public usage.

+ Proof type: Type of proof implied by the application of a particular authentication technology. There are technologies that may imply several types of proofs at the same time. When applying multifactor authentication mechanisms, it is recommended to assemble together factors providing different types of proof.

                             * Proof of Knowledge: Authentication implies the proof of some knowledge by the user.

                             * Proof of possession: The user proves the possession of some token/device.

                             * Proof of location: The user proves that s/he is located in a specific location.

                             * Proof of inherence: The authentication process proves some inherent feature from the user. We distinguish between:

                                                          o Physical: These are features that are physically inherent to the user and that consequently, can't be easily changed in a voluntary manner by him/her. For example, we have: fingerprint, face, voice, retina, etc...

                                                          o Behavioural: These features may be voluntary changed by a user after more or less training. For example, we have: handwritten signature, typewriting cadence, etc...

+Applicable device: Hardware devices on which an authentication technology is more suited to fit in.

                             * PC: Personal Computer

                             * Mobile: Mobile phone or tablet.

                             * Special hardware: Such as smartcard readers or others.

2. Usability

+ Authentication Usability: This factor measures how easy is for a general person to authenticate with a particular technology.

                             * Trivial: The interface used to authenticate users is so intuitive that in general, normal people have no problems at all to know how to authenticate with the technology.

                             * Easy: The interface used to authenticate is very easy to use but it may require some basic initial training or instruction reading before using it for the first time.

                             * Complex:  The interface used to authenticate may require some complex training and/or instruction reading not only to use it for the first time but also to use it on subsequent situations (or to set it up on different devices).

                             * Technical: The interface used to authenticate is so complex that it may requires some complex training by technical specialists.

+ Authentication responsiveness: This factor measures how fast is for a general person to authenticate.

                             * Immediate: The person authenticating does not even practically notice the time spend on the authentication process.

                             * Fast: The person authenticating normally spends the time required to enter a memorized password on a computer.

                             * Slow: The person authenticating normally spends between one to four seconds on the authentication process. The time spend also includes the time to search for a device or token to authenticate.

                             * Very slow: The time required on the authentication process involves significantly more than 10 seconds.

+ Disability discrimination: Are there any restrictions on disabled people imposed by the authentication technology being used?

                             * None: All users should be able to use such authentication technology.

                             * Visual: Visually impaired users would have problems in using such technology.

                             * Hearing: Users with hearing impairment would have problems.

                             * Language: Users having problems pronouncing certain words could have problems. This could also involve foreigners pronouncing a different language.

                             * Intellectual: Users with intellectual disability may find difficulties using such technology. Given the fact that Intellectual disability is a very broad concept, in some cases it may be relevant to be more specific in terms of this factor such as for           example; specifying memory deficit, learning retardation or communication disorders.

                             * Physical: People with any impairment which limits the physical function of limbs, bones or movement. As this is also such a broad concept, it can also be better described by being more specific such as indicating for example; finger movement,                         leg movement, etc...

3. Security

+ Identity Assurance: This value could be linked to the probability of

+ valid identification by the identity mechanism. It may also be

+ interesting to define a range of probability values and label it as

+ High, Low, etc... Credential Assurance: This factor could be linked to

+ the FIPS conformance level and/or some other related standards...

+ Credential Availability: Central Service, Resilient Service, Highly

+ Resilient, Off-line Credential Revocation: Unavailable, Partial

+ Service (e.g. normal working hours), 24x7, Resilient 24x7 Credential

+ Renovation: Unavailable, Partial Service (e.g. normal working hours),

+ 24x7, Resilient 24x7 Credential Privacy: Unavailable, Consented, Proof

+ of Knowledge

For those interested, the corresponding presentation and notes taken during the session will be soon published by the IIW committee...

Best regards,

_________________________________________

Oscar Manso

Senior Research and Innovation specialist E  [email-masked]<mailto:[email-masked]> W http://www.alexandra.dk PK https://keybase.io/oscman/key.asc _______________________________________

(Mail send on behalf of Oscar Manso)