One familiar use of authentication and authorization is access control. A computer system that is supposed to be used only by those authorized must attempt to detect and exclude the unauthorized. Access to it is therefore usually controlled by insisting on an authentication procedure to establish with some degree of confidence the identity of the user, granting privileges established for that identity. Common examples of access control involving authentication include:
- Asking for photoID when a contractor first arrives at a house to perform work.
- Using captcha as a means of asserting that a user is a human being and not a computer program.
- A computer program using a blind credential to authenticate to another program
- Entering a country with a passport
- Logging in to a computer
- Using a confirmation E-mail to verify ownership of an e-mail address
- Using an Internet banking system
- Withdrawing cash from an ATM
In some cases, ease of access is balanced against the strictness of access checks. For example, the credit card network does not require a personal identification number for authentication of the claimed identity; and a small transaction usually does not even require a signature of the authenticated person for proof of authorization of the transaction. The security of the system is maintained by limiting distribution of credit card numbers, and by the threat of punishment for fraud.
Security experts argue that it is impossible to prove the identity of a computer user with absolute certainty. It is only possible to apply one or more tests which, if passed, have been previously declared to be sufficient to proceed. The problem is to determine which tests are sufficient, and many such are inadequate. Any given test can be spoofed one way or another, with varying degrees of difficulty.
Read more about this topic: Authentication
... manipulation using a set of custom mandatory access control rules, with simplicity as its main design goal ... It has been officially merged since the Linux 2.6.25 release, and was the main access control mechanism for the MeeGo mobile Operating System ...
... In public policy, access control to restrict access to systems ("authorization") or to track or monitor behavior within systems ("accountability") is an implementation feature of using trusted systems for ...
... To ensure correct implementation of complex access control requirements, it is important that the validated and verified requirements are effectively integrated with the ... An integrated, role-based access control model has been developed ... Using this model, access control requirements can be integrated with the rest of the system from the outset, because a single notation is used to express both access control and functional ...
... The Interstate Highway System is the largest controlled-access highway network in the USA ... is defined by the federal government's Manual on Uniform Traffic Control Devices as a divided highway with full control of access ... First, adjoining property owners do not have a legal right of access, meaning that they cannot connect their lands to the highway by constructing driveways, although frontage roads provide access to properties ...
... Security descriptors contain discretionary access control lists (DACLs) that contain access control entries (ACEs) that grant and deny access to trustees such as users or ... They also contain a system access control list (SACLs) that control auditing of object access ... The order of ACEs in an ACL is important, with access denied ACEs appearing higher in the order than ACEs that grant access ...
Famous quotes containing the words control and/or access:
“I have not ceased being fearful, but I have ceased to let fear control me. I have accepted fear as a part of life, specifically the fear of change, the fear of the unknown, and I have gone ahead despite the pounding in the heart that says: turn back, turn back, youll die if you venture too far.”
—Erica Jong, U.S. author. In an essay in The Writer on Her Work, ch. 13 (1980)
“Knowledge in the form of an informational commodity indispensable to productive power is already, and will continue to be, a majorperhaps the majorstake in the worldwide competition for power. It is conceivable that the nation-states will one day fight for control of information, just as they battled in the past for control over territory, and afterwards for control over access to and exploitation of raw materials and cheap labor.”
—Jean François Lyotard (b. 1924)