- In the last video you learned how organizations
achieve multi-factor authentication by combining
authentication approaches from two different categories.
The most common approach is to combine
something you know, such as a password or PIN,
with something you have, such as a physical token.
Let's talk about ways that you can implement authentication
based upon something the user has in his or her possession.
Traditionally, organizations implemented something you have
authentication using physical tokens like this one.
They're small hardware devices
that the user typically carries on a key chain.
When the need to authenticate arises
the user first provides a user name and password
satisfying the something you know criteria.
The system then prompts the user
to provide an authentication code.
The user pulls out his or her token and presses the button.
The token then displays a code that the user enters
into the system proving physical possession of the token
and completing the authentication sequence.
The cost to providing thousands of users
with physical tokens can add up quickly,
and users simply don't like the burden
of carrying a token around with them all the time.
The rapid spread of Smart phones led to the adoption
of soft token technology which has quickly replaced
the use of physical tokens in many organizations.
Soft tokens are simply apps that run on a users Smart phone
such as the Google Authenticator app that you see here.
Soft tokens generate a constantly changing series of codes.
When an authentication system prompts the user
to enter a code from a token the user simply opens
the app and reads off the current code.
The codes provided on both hardware and software tokens
are known as one-time passwords, or OTPs.
There are two different protocols
for generating these codes.
The HMAC-based one-time password algorithm, HOTP,
uses a shared secret and an incrementing counter
to generate the code displayed on the token.
The code changes whenever the button is pushed
and the code is valid until it is used.
This hardware token uses HOTP.
The time-based one-time password algorithm, TOTP,
doesn't use a counter.
Instead, it uses the time of day
in conjunction with a shared secret.
This means that the code changes constantly
and is only valid until the token generates the next code.
The token and the authentication system
must have synchronized clocks
for TOTP to function correctly.
The Google Authenticator soft token uses TOTP.
Another way of providing something you have authentication
is through the use of Smart cards,
which contain embedded microchips.
The U.S. Department of Defense uses Smart cards widely
and branded their program the Common Access Card,
or CAC, shown here.
Notice the small integrated circuit chip on the card.
When the user authenticates with a Smart card
he or she inserts it in a special reader
attached to the computer.
The reader then verifies the information on the chip
to verify the cards authenticity.
Tokens and Smart cards both provide tremendous security
boosts when added to an authentication system.
Combining traditional knowledge-based authentication
with a something you have factor greatly reduces
the risk of account compromise.