1 Introduction

The purpose of authentication is to verify the identity of an entity. The number of factors required to authenticate an entity determines the type of authentication—single-factor, two-factor, or multi-factor. The section delves into the trends and advancements in the field of authentication, with a focus on security and usability. The section covers topics such as the current state of password security, the emergence of passwordless authentication, and the future potential of biometric authentication. The section also discusses current authentication trends, including adaptive and continuous authentication.

2 Analysis

2.1 Definition

An authentication process is a process of verifying an entity’s identity based on one or multiple factors [1]. A factor can be something the entity is (e.g., device fingerprinting for devices or biometrics such as a retina, face, or behavior for a person), possesses (e.g., a token or a bank or ID card), or knows (e.g., a password or algorithm) [2]. Sometimes a location factor is listed as a fourth category [3]: Location and/or time of the entity’s login, e.g. GPS coordinates, IP address, or cellular triangulation. An entity may be, for instance, a computer or smartphone or a user using such a device. Depending on the number of credentials (or factors) required, the authentication process is referred to as single-factor authentication (SFA), two-factor authentication (2FA), or multifactor authentication (MFA). Note that MFA includes two-factor authentication. Behavior can also be a factor in behavior-based authentication and continuous authentication systems.

2.2 Trends

Security Factors

Password security has inherent weaknesses [4], particularly sensitivity to social engineering (for example, phishing) and dictionary attacks. However, passwords remain the most popular authentication method worldwide, according to an Okta Inc. study conducted in 2021 [5]. According to this study, 5% of organizations worldwide use passwords as their primary security measure. Moreover, the password management market revenue is expected to increase from 1.25 billion U.S. dollars in 2020 to 3.07 billion U.S. dollars by 2025 [6].

Although the knowledge factor is still omnipresent, the opposite trend of passwordless authentication is emerging. Passwordless authentication eliminates the knowledge factor and relies on more substantial security factors such as ownership and biometrics. In 2020, the worldwide market revenue for passwordless authentication was approximately 10.3 billion U.S. dollars and was expected to reach 25.2 billion U.S. dollars by 2025 [7]. However, biometrics is often just an add-on for better usability, especially in the mobile domain. For example, Android and iPhones still rely on a pin or strong password in the background. A promising approach to passwordless authentication is the authentication standard FIDO2, which was developed by the FIDO alliance, an open industry association. FIDO2 is based on public key cryptography, stores credentials on a user’s device, and uses unique credentials for every website [8]. This makes it not only resistant to replay attacks and password theft but also against some phishing attacks [8], to which other forms of MFA are still susceptible. However, this does not prevent online-phishing attacks where the attacker is the proxy to the actual service.

With the surge of wearables and other IoT devices, biometric factors in the future as wearables could be the only workable solution. This might be problematic because these new devices will need a strong password. By 2027, the worldwide biometric authentication and identification market is expected to reach almost 100 billion U.S. dollars, up from 33 billion U.S. dollars in 2019 [9]. The significant barriers to large-scale use of passwordless authentication are considered to be legacy systems and applications: 61% of IT staff and 58% of IT security leaders worldwide in 2022 reported that legacy systems and applications did not support the technology as one of the main barriers to using passwordless [10].

Authentication Approaches

Current trends attempt to enhance security and usability. These include:

  • Adaptive authentication [11]: The authentication procedure in adaptive or risk-based authentication is determined by an entity’s context. Contextual factors, such as a device’s location or the data sensitivity a user requests, are considered during authentication. Following this, an authentication risk score is calculated, often utilizing machine-learning techniques. This risk score determines how many security measures are required. We are staying on top of security by using adaptive authentication when increasing usability. This approach was recommended in the NIST Digital Identity Guidelines from 2017 [12].

  • Continuous authentication [3]: During continuous or active authentication, the identity of an entity is recurrently verified based on patterns derived from continuous monitoring of the entity. This is achieved primarily by using behavioral or biometric factors such as keystroke patterns, mouse movements, or gait patterns (see also Real-time Biometric Authentication in Chap. 22). With this approach, impersonation attacks can be prevented more effectively than static authentication: the perpetrator must continuously mimic the entity’s behavior. Otherwise, they would be blocked when an untypical behavior is detected [13]. However, the continuous collection of biometric and behavioral data has raised concerns regarding privacy, which must be addressed.

  • Authentication technology for the approval of sensitive user actions: Authentication technology is commonly used to approve financial transactions: the transaction details are sent to the payer via an independent channel to be confirmed via a security factor, for example, via 3D Secure (see Chap. 32.1 for details). This can help secure transactions against the compromise of operating systems or browsers through malware. However, using authentication technology to approve sensitive user actions is not limited to financial transactions but can also be implemented, for example, for changing one’s online account details.

3 Consequences for Switzerland

According to a study conducted by ESET in 2022, most Swiss smartphone users use a PIN to access their smartphones [14], and Swiss people need to manage their passwords better. In the study, 12% of the participants used identical passwords for multiple accounts, but only 5.8% did so in Germany [15]. According to the study, 14% of Swiss participants always use 2FA for online services, which is in line with the recommendation by the Swiss National Cyber Security Centre to use MFA whenever possible [16]. In Germany, however, 27.8% reported always using two-factor authentication. This is still significantly less. Regarding biometric authentication, there seems to be a general interest and openness to this technology among the Swiss people: As of 2019, 85% of Swiss citizens indicated that fingerprint authentication was the most secure method for making credit card payments [17].

Also, authentication is generally well represented in research in Switzerland, e.g., at the Idiap Research Institute ([18], biometric authentication), IBM Zurich ([19] password cryptography). Also, this research has been successfully transferred, leading to spin-offs like Token2 Sàrl (University of Geneva) and Futurae Technologies AG (ETH Zurich).

3.1 Implementation Possibilities: Make or Buy

In choosing a particular authentication solution for organizations, it is crucial to balance security, usability, cost, and privacy considerations. The authentication solution for a particular service can be predetermined for the private individual, although stronger authentication can be enabled if desired. It can also increase security by purchasing additional solutions, such as a password manager or hardware security keys. The following are some considerations for the different security factors:

  • Knowledge factor: Passwords are still prevalent, so it is essential to maintain a secure password management system. A variety of commercial password managers can assist in breaking habits like reusing passwords or writing them down. There are also free options, such as open-source password managers, and numerous options integrated into many browsers and smartphones. According to Grauer and Klosowski [20] 1Password [21] is the best password manager, whereas Bitwarden [22] is the best free solution.

  • Ownership factor: There is an abundance of authenticator applications to choose from, including Authy [23], the Microsoft Authenticator [24], or Duo [25]. The Yubico Security Key series [26] and the Google Titan Security Key [27] can also be purchased as hardware tokens. It is essential to consider whether such devices meet industry standards such as FIDO2 and whether they are compatible with future trends such as passwordless authentication. In addition to hardware tokens, Swiss providers offer software tokens, including Swiss SafeLab, Token2 Sàrl, or Futurae Technologies AG.

  • Biometric factor: The sourcing of biometric authentication solutions can be challenging due to the highly specialized technology required. Furthermore, privacy regulations and data protection regulations need to be considered. One option to address privacy for biometric authentication is to store biometric data only on a user’s device instead of remotely on servers. For more privacy and information about commercial and open-source solutions, please see Chap. 22.

4 Conclusion

Though knowledge-based authentication has been known to have shortcomings, it remains the most popular method for entity authentication. The shortcomings are currently addressed through sophisticated password management and multifactor authentication. Nevertheless, concurrently with the increase in IoT devices and advances in machine learning, there is a trend towards passwordless authentication utilizing biometrics and new authentication approaches such as continuous and adaptive authentication. While these trends suggest a more secure and user-friendly authentication process, they may also introduce new privacy concerns that must be addressed in the future.