Authentication

Authentication verifies who or what is requesting access. It is typically performed using one or more factors (something you know, have, or are), and is distinct from authorization (what you are allowed to do).

The process of verifying the identity or other attributes of an entity (user, process, or device).

Also the process of verifying the source and integrity of data.

The process of verifying a claim that a system entity or system resource has a certain attribute value. (See: attribute, authenticate, authentication exchange, authentication information, credential, data origin authentication, peer entity authentication, "relationship between data integrity service and authentication services" under "data integrity service", simple authentication, strong authentication, verification, X.509.)

Tutorial: Security services frequently depend on authentication of the identity of users, but authentication may involve any type of attribute that is recognized by a system. A claim may be made by a subject about itself (e.g., at login, a user typically asserts its identity) or a claim may be made on behalf of a subject or object by some other system entity (e.g., a user may claim that a data object originates from a specific source, or that a data object is classified at a specific security level).

An authentication process consists of two basic steps:

• Identification step: Presenting the claimed attribute value (e.g., a user identifier) to the authentication subsystem.
• Verification step: Presenting or generating authentication information (e.g., a value signed with a private key) that acts as evidence to prove the binding between the attribute and that for which it is claimed. (See: verification.)