Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) is a method of computer access control that adds an extra layer of protection on top of your user name and password. With MFA a user is granted access only after successfully presenting several separate pieces of evidence to an authentication mechanism – typically at least two of the following categories: knowledge (something you know such as a password or personal identification number (PIN)), possession (something you have such as a cryptographic identification device, smart card or secure token), and inherence (something you are: Biometrics such as fingerprints, iris, face, palmprint, etc.). The goal of MFA is to create a layered defense and make it more difficult for an unauthorized person to access a target such as a physical location, computing device, network or database. If one factor is compromised or broken, the attacker still has at least one more barrier to breach before successfully breaking into the target.

A good example from everyday life is the withdrawing of money from a ATM; only the correct combination of a bank card (something that the user possesses) and a PIN (personal identification number, something that the user knows) allows the transaction to be carried out.

The use of multiple authentication factors to prove one’s identity is based on the premise that an unauthorized actor is unlikely to be able to supply the factors required for access. If, in an authentication attempt, at least one of the components is missing or supplied incorrectly, the user’s identity is not established with sufficient certainty and access to the asset (e.g., a building, or data) being protected by multi-factor authentication then remains blocked. The authentication factors of a multi-factor authentication scheme may include:

• Something the user has: Any physical object in the possession of the user, such as a security token (USB stick), a bank card, smart card, a key, etc.
• Something the user knows: Certain knowledge only known to the user, such as a password, PIN, TAN (transaction authentication number), etc.
• Something the user is: Some physical characteristic of the user (biometrics), such as a fingerprint, eye iris, voice, typing speed, face, electronic signature, pattern in key press intervals, etc.
• Somewhere the user is: Some connection to a specific computing network or using a GPS signal to identify the location.