So now let's talk about how authentication can be implemented.
It could be something that the user knows.
So this has to be a secret, a secret that is shared between the user and
the system.
The fact that you are able to produce that secret that's associated with
the user, that means you are that person.
That is the evidence that you are who you claim to be.
A password for example is a secret, isn't it?
We say ask people to pick a password that others can not guess or
easily guess.
Well, that's your secret.
So one way to do authentication is that users
have a secret that they can produce to the system and the system is able
to check that the secret really is the one that is associated with that user.
The other possibility is something the user has.
So think of this some sort of a token or a smart card or something
that you use and the fact that you have it means you have possession of it.
So, possession of that token, we have to talk about how this could be used for
authentication.
The fact that it's with you, smart card or token is with you, a fob, for
example, people use that.
That's with you, that means it must be the user who you're claiming to be or
the user who should be possessing this particular thing.
The first thing is something you would know.
The second is something you have on you, or with you.
The third thing we can think of is something the user is or
something you are.
So this could be for example your finger print.
This could be your voice, for example, people talk about voice biometric,
or their smartphone devices that you can talk to, for example.
So this would be a biometric, something that is unique, hopefully,
to the user, because we don't want somebody else to become you, so
this biometric has to be something that's specific to you.
And if you're able to produce that, the system you're able to give that to
the system and the system is able to check that actually it is your
fingerprint then the authentication is based on something the user is.
Something you know, something you have, or something you are.
These are sort of the three basic methods that are used in almost all
the authentication techniques that we use in computer systems.
So we are going to again look a little bit more deeply into how authentication
is implemented, using one of these methods that we talked about.
A secret you share with the system, or something you have, or
something you are.
So the basic sort of sequence of steps that we're going to have is
that the user is actually going to come to the system and
is going to request access to it.
And we know that is going to start with request for
authentication, you first have to authenticate yourself.
The system, the operating system here is going to take whatever claim about
identity you make, so for example you may be saying this is my log in name.
So it's going to read those keystrokes and that's who you are.
And if you're providing, for example, a password,
then the operating system at this point is going to run this login program and
the login program is going to check that information that you provide.
For example, the password you provide Is really your password.
Is the password we have associated with this user?
If there's a match with what the system knows and
what you provide, that is a true positive.
If it's the right user then that's a true positive, the outcome is positive.
Here, so the user is authenticated and when the user is authenticated,
this is how you can now initiate any further actions you want to perform.
So this is sort of the case where the right user
provides the right kind of evidence.
The log in program is able to check and successfully log in the user.
Well, the check could fail and if it fails then the system believes that
the user has not provided the correct information.
And if the user has not provided the correct information,
it's probably not the user who is being claimed.
The identity that is being claimed
probably doesn't belong to the user who is asking for authentication.
So this could be impersonation for example.
So in this case, the system doesn't have the right evidence,
doesn't have this match, so it's not going to authenticate the user.
So in this case, authentication fails.
Maybe you retype your password.
If you're not the right user, then that's a good thing.
So then, that if you are not the right user, even you are trying to
login as Alice and the system says no, that's good.
That is a true negative actually because outcome is negative and
it's the right thing.
Okay so Eve tries to login as Alice and we end up here.
That's a true negative.
When Alice tries to login as Alice.
We come here, that is a true positive.
So this is how the authentication process is implemented.
Couple of things to note here is that we have to read the evidence or
capture the evidence.
We have to compare it and then decide whether there's a match or
not and go either this path or the other path.