Concept - User Authentication

Definition: “the process of verifying an identity claimed by or for a system entity” (s.4). A fundamental security building block and the basis of access control and user accountability (s.4).

• Two steps: identification (specify an identifier) and verification (bind the entity/person to the identifier) (s.4).
• Not message authentication, which is about the integrity of exchanged messages between communicating parties (s.4).
• Four means: know, possess, are, do (see Concept - Means of Authentication).

Example: typing the login john is identification; supplying the matching password is verification (s.6).

Added context

The example is an illustration; the slides only list “name/login and password” (s.6).

Related: Concept - Access Control (authentication is the step before authorization), Concept - Challenge-Response, Concept - Authentication Security Issues. Appears in 03 User Authentication - Chunk 01 (s.1-33).