4.6 Multifactor Authentication

Question 1

Multifactor authentication

Answer 1

• Prove who you are
  –Use different methods
  –A memorized password
  –A mobile app
  –Your GPS location
• Factors
  –Something you know
  –Something you have
  –Something you are
  –Somewhere you are
• There are other factors as well

Question 2

Something you know factor

Answer 2

• Password
  –Secret word/phrase, string of characters
  –Very common authentication factor
• PIN
  –Personal identification number
  –Not typically contained anywhere on a smart card
  or ATM card
• Pattern
  –Complete a series of patterns
  –Only you know the right format

Question 3

Something you have factor

Answer 3

• Smart card
  –Integrates with devices
  –May require a PIN
• USB security key - Certificate is on the USB device
• Hardware or software tokens
  –Generates pseudo-random authentication codes
• Your phone
  –SMS a code to your phone

Question 4

Something you are factor

Answer 4

• Biometric authentication
  –Fingerprint, iris scan, voice print
• Usually stores a mathematical representation of your
  biometric
  –Your actual fingerprint isn’t usually saved
• Difficult to change
  –You can change your password
  –You can’t change your fingerprint
• Used in very specific situations
  –Not foolproof

Question 5

Somewhere you are factor

Answer 5

• Provide a factor based on your location
  –The transaction only completes if you are in a
  particular geography
• IP address
  –Not perfect, but can help provide more info
  –Works with IPv4, not so much with IPv6
• Mobile device location services
  –Geolocation to a very specific area
  –Must be in a location that can receive GPS information
  or near an identified mobile or 802.11 network
  –Still not a perfect identifier of location

Question 6

Biometric

Answer 6

–Fingerprint, iris scan, voice print Authentication

Question 7

Hardware or software tokens

Answer 7

–Generates pseudo-random authentication codes