Previous Table of Contents Next


Authentication

Authentication means establishing an identity within a transaction. Consider a very simple (non-electronic) transaction such as a student providing homework to a teacher. In general, the teacher wants to confirm that a specific set of homework comes from a specific student. What’s involved in establishing identities in such a transaction? Well, when the homework is turned in to the teacher, the teacher will likely visually recognize the student and accept the homework. In order to identify the homework of a specific student, the teacher may inspect the homework when it is turned in to confirm that the student’s name is on it. Later, after the teacher has reviewed the homework and graded the paper, the grade can be recorded next to the name. In such a transaction, an environment of trust must be established. The teacher can associate (visually) a student, the student’s homework, and the student’s name on the homework, and the teacher believes this association to be true. Establishing this trust environment for a classroom setting is typically subtle and is not usually a rigorous procedure.

The rigor applied to establishing trust is generally commensurate with the value of the transaction. If the transaction does not involve simply homework, but something much more valuable (to one or both parties), such as a final examination or an SAT examination, then establishing the trust environment can be much more involved. Verification of identity may be required at the door of the testing facility; the form of this verification might be a student ID card or a state driver’s license. Such forms of authenticated identity suffice to introduce the concept of a trust broker or a trusted third party that both of the parties in the transaction can look to for establishing a trust environment, if they don’t know each other. The test monitor may not be able to recognize a student visually, but does know what a valid student ID looks like. So if the student presents such an ID with a picture on it that matches the bearer of the card and a name on it that matches a name on the test list, the monitor can believe that the bearer of the ID card is really the person authorized to take the examination and receive the grade derived from the examination.

If the transaction in question involves something of even greater value (to one or both parties), then establishing the trust environment may be even more involved. For example, purchasing a house with a mortgage loan may require that a wide variety of information be collected and the validity of that information be attested to in legally binding ways.

The object, then, of a security system is to provide authentication mechanisms through which a trust environment can be established among all the participants in a transaction. The participants may not know each other, may not be physically together during the transaction, and may even be participating in the transaction at widely different times (that is, the transaction requires a significant elapsed time to complete).

Authorization

Authorization is the establishment of privileges within a transaction. That is, once the identity of a participant in a transaction has been authenticated, what that participant is allowed to do as part of the transaction must be established. In a financial transaction, this authorization might consist of simply confirming that the authenticated individual has enough money to make the desired purchase or enough money to provide the desired loan. In the earlier exam example, authorization might consist of finding a student’s name on the class roster. If the student can authenticate that her identity is Jane Doe and the name of Jane Doe is found by the monitor on the class roster, then that student will be allowed to take the final examination.

Just as in establishing identity (authentication), the length to which various parties in the transaction will go to establish authorization is generally related to value ascribed to the transaction by one or more parties. To gain entry to a room containing particularly sensitive information in a high-security facility, your name might have to be on an access list that can be checked by a guard at that room. To enter the room, you must meet at least two criteria. First, you must present the correct identification information to the guard to establish (authenticate) your identity. Then the guard must find your identity on the list of individuals allowed access to the room.

In some situations, the concepts of authentication and authorization might be merged together. In many office buildings, each office has a physical key. The key patterns may be such that a master key can open any office door. In this case, authentication is established by physical possession of the key. From the standpoint of the lock on the door (which is one of the participants in the transaction of unlocking and opening the door), both the authenticated identity of the individual and that individual’s authorization to enter the room guarded by the door is satisfied by that individual physically presenting the key.

Privacy

Privacy is the concept of allowing only the participants in a transaction to know the details of the transaction, and it might even mean that only the participants know that a transaction is occurring.

When a credit card purchase is made, the protocol of presenting the card to the vendor, performing the financial transaction, and returning a receipt of the transaction to the cardholder is set up to minimize the conveyance of sensitive information such as the account name, number, or validation number to those who may be casually observing the transaction. Similarly, when using a telephone calling card at a public telephone, conventional wisdom mandates that one be very cautious to hide the entry of the card number, lest it be seen by someone who will make note of it and use it to make cardholder telephone calls that the cardholder has not authorized.


Previous Table of Contents Next