Multi-Factor Authentication Primer

Author: Brian Rhodes, Published on Feb 04, 2013

Can a stranger use your credentials? One of the oldest problems facing access control is making credentials as easy to use as keys, but restricting them to certain individuals. The technique of 'multi-factor authentication' is applied when the end-user is concerned about who actually can use access control credentials. In this note, we examine the concept and detail the ways many access control designers choose to use it.

Multi-Factor Authentication Defined

** ****** *****, *** ******* ***** **** **** **** *** credential **** ** ********* ** ***** ** **** ******. *******, the *********** **** ** '*******' ** * *** **** **** validate **** *****. **** ***** **** *** '*****-******' *******, **** than *** ********** **** ** ************** ********, *** ****** ** option ** **** **** *** **** ** ***** ****.

** * ***** **** ***** ****** ******** ********* *****, *********** scans, ** * ****** **** ** ***** ** ** '***********', two ** **** *********** ***** ** ******* *** *****, *** just ********* ********** ****** *** ********** *** *** **** ** present ** *** ****. *** ***** ***** ***** ** ******* of * ******* '***** ******' ****** ******:


*** ********** ************** '*******' ****** ** *** ** *** **** type, *** **** ** *******, ********, *** ********** ******* ***** of ***********. ***** '****** ******' *** ******** ***** **:

  • ********* *** **** ***: * **********/********** ******* **************** ** *** ****. ********* ** access ******* *****, *****, ** ***. **** ******** * ********** key, ********** **, ** ********.
  • ********* *** **** *****: ********* * **** ** ******** **** ******* ** *** user. ********* * *** ******, *** **** ******* '******** *********' or '**** * ****** ******** *****' *************.
  • ********* *** **** **: ********* ******** **** *** **** ** **** ** *******. Typically ************ ** **** ******, *** ***** ******** ******** ********* face ***********, **********, ******/**** *****, *** **** ****.
  • ******* ******* ******** *** ****: ***** ******* **********, ******* ***** ********** *** *** ******* for *** ****. **** ***** ** * ****** *****, ** even * ************ **** ****** ****** ***** ** ***********.

Different *****

*** ****** ****** ** ******* ******* **** ********* ** ** end-user's ******** ********. ***** ****** ********* ***** *** ******** *** of **** *********** *** ******* *** *******, ***** ****-******** ************* may ******* ***** ** ****. ** ****** *** ******* ***** tiers *****:

*** ******:**** ***** * *********** ** '********* *** **** ***' *** '********* ** *****', **** ** ****** ******* ****** **** *** ************ *** number. **** ** *** **** ***** *** ****, ** ************ finder ****** *** ** ** **** ****** ****** **** **** know * ****, ***** ** ***** **** ** *** ****.

******* *********** ********** ****** *** **** *********, ** ** **** common ** *** *********** ** ***** ************* ******* **** **'********* *** **** **' ** *** ****** **************.

***** ******: **** ******** ******** ** **** ****** ***** ** **********, three ******* *** ********. **** ***** **** ** * *********** of **********, *** *****, *** ****** ******* ***********, *** ****** significantly **** ****** ** ********* *** ****** **** ****** '****** factor' **************.


** * ****** ** **** **** *** **** ** *** this ***** ** **************, ** ** **** ** ******** **************, military, *** ******** ********** *** *** ********* *** ********** ***-*****.

**** ******: *** ******* ***** ** ************** ** ***** **** ** military *** ***** ********* *********, ***** ****** *********** *** **** in *********** **** *** ***** *******. ******* **** ******* ***** the **** **** *** ** *** **** ***** *********, ** typically ** *** ******** ****** *** ******** **** ** **** high *** ******** ******** ** *********.


Multi-Factor ************

**** ***** ****** '****** ******' ************** ** **** ******, *** multiple ******* *** ******** ******** ** ******* ************* ******* ** access *******. **** ***** ******** ********:

  • ATM ********: Not only are debit cards required to be swiped, but PIN numbers are required every time a cash transaction takes place at one of these machines.
  • ******: ********** **** ****** *****, *****, ** *** ***** ******* takes ********* ** ********* '********* *** ****' *** ********* '********* *** ****' ** ******* ****** **********.

**** ** ***** ** ******** ******, *********** **** * ***** role. **** ** ***** ** ******** ***********, ******** ******* *** required.

Single ****** ***** **** ******

* ******** ** ********** ****** ******* ******* *** '****** ******' authentication, *** **** ** ********** *** *** *********** ******** ** most ***-*****. *** ****** ********** **** ** **** ** **** to *** ******** ** *** ******, *** *** ****** ******** (ie: *******, *****) ** ****** ******* **** ******.

*** *********** *** ******* *** **** ****** '****** ******' **********. No ***** ************ ** *** ****** ** ******** **** *** key *** **** ******. ***** ********* ******** ** ****-**** ********** access ***********, ********** **** ***** ******* ** ******** '***** *****' of ******** *** **** ******** ** **********.

*** ***** *******, ***** ******** ******* ** ****** ******** ***** be ********** ******. ******* ******* ********** ***** ****** *** **** expensive, *** ****** ****** ************ ***** ** ******** *** ****** justified ******* ******** *************, ****** ****** ******* *** ******** ****** used.

Comments (15)

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Other Reports on Access Control

Access Control IBC International Rules on Apr 28, 2016
Dealing with fragmented local codes is one of the most frustrating parts of electronic access control design. However, the 'International Code...
Last Day - Access Course on Apr 21, 2016
This is the last day to register for the Spring Access Control Course. Ends today, Thursday and the first class is next week. IPVM offers the most...
Access Control Book 2016 Released on Apr 18, 2016
This is the best, most comprehensive access control book in the world, based on our unprecedented research and testing, with 100+ new pages for...
PoE Powered Access Control Guide on Jan 18, 2016
The popularity of Power over Ethernet applications has spilled over into Access Control.  Taking advantage of the general popularity of powering...
RS2 Access Control Company Profile on Jan 13, 2016
Inside we examine RS2 Technologies Access It! line for best customer fit, key features, pricing, and main weaknesses. Profile RS2 is a US access...
New Siri Powered Kwikset Lock on Jan 08, 2016
Your voice is your key with a new residential doorlock, Kwikset's Premis. Using your Apple phone, you can command your door to lock and unlock even...
Honeywell NetAXS Access Control Profile on Jan 06, 2016
Honeywell is one of the biggest names in security, and one of their most popular offerings is web based access. Inside we examine Honeywell's...
Avigilon Access Control Company Profile on Jan 04, 2016
Inside we examine Avigilon Access Control Manager (ACM)'s overall strengths, ideal customer market, pricing, and biggest gaps for access...
Keyscan Access Control Company Profile on Dec 17, 2015
Access company Keyscan is part of one of the biggest access companies in the world, and they sell a 'one size fits all' access platform.  We...
Milestone XProtect Access 2016 Release - New Features, Major Price Drop on Dec 15, 2015
With continued video surveillance price pressure, access is getting more attention, as shown in 2016 Top Security Expansion Targets and argued in...

Most Recent Industry Reports

Ubiquiti Cloud Video Tested on Apr 29, 2016
  The cloud continues to expand in video surveillance. Ubiquiti's newest release offers a free upgrade adding cloud capabilities. In this test,...
Quantum Storage Company Profile on Apr 28, 2016
Storage vendor Quantum is bringing their multi-tier storage architecture to the security industry, claiming cost-effective long-term data...
Manufacturers Don't Want to 'Bad Mouth' The Competion on Apr 28, 2016
Sure, you do not want to be the like the Avigilon sales guy who said all his competitors 'suck'.  Not convincing and you look bad. However, that...
Access Control IBC International Rules on Apr 28, 2016
Dealing with fragmented local codes is one of the most frustrating parts of electronic access control design. However, the 'International Code...
Cyber Security For Video Surveillance Study Released on Apr 27, 2016
This study provides the foundations for video surveillance professionals to understand the importance of cybersecurity, what is being done to...
Anixter Security Slow Sales Continues Q1 2016 on Apr 27, 2016
Anixter shook things up in 2015, paying $420 million for Tri-Ed. Now, nearly 2 years later, Anixter's slow security sales continue. In this note,...
Vivint Gets $100M from Peter Thiel And Mitt Romney on Apr 27, 2016
One of the most prominent Silicon Valley investors and a former presidential candidate are backing Vivint with a $100 million investment.  In this...
Hikvision Exec Simultaneously Chinese Government Security Leader on Apr 27, 2016
New information shows a Hikvision executive is simultaneously a leader within the Chinese government national security ministry. This runs counter...
Favorite Video Storage / Servers 2016 on Apr 26, 2016
150 integrators answered this question: "What is your favorite storage device / server manufacturer for recording video? Why?" 4...
Avigilon H4 5MP and 4K Cameras Tested on Apr 25, 2016
Avigilon has released their H4 HD line, with promised improvements including their most sensitive low light camera (the 5.0L-), analytics on all...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact