|
tokens
Computer systems
authenticate identity and validate access privileges using
three basic methods: something you know (passwords),
something you "are" (biometrics),
or something you possess. The last of these are generally
referred to as tokens.
In the physical
world, physical tokens have long been used to authenticate
identity and gain access. A key that fits a particular lock
authenticates you to gain access to your house, car, etc.
An identification badge may be required to authenticate your
access to your work site. An ATM card is part of authenticating
your access to funds in your bank accounts.
With an old-fashioned
key and identification badge, simple possession is enough
(unless someone looks at the photograph). ATM cards generally
combine two methods -- you must have the physical card, and
you must also know something (a PIN number). "Combination"
-- sometimes called two- or three-factor -- methods of authentication
are more secure than one alone.
Token cards like
identification badges often contain a magnetic or optical
strip that verifies the information physically inscribed on
the card. More sophisticated models contain an internal microchip,
which can store complex information -- e.g., a digital representation
of a fingerprint or retinal scan, offering another form of
combination authentication.
Even more sophisticated
tokens may accept input of a "challenge" (a string
of letters and digits) provided by the computer system one
is attempting to access, and then display a corresponding
string of characters. That string is then input to the computer
by the user as a response to the challenge. Other tokens may
display a time-sensistive password (synchronized when the
card is created) which the user must enter to gain system
access. Both methods are a way of defeating fraudulent tokens.
See also:
|
