Authentication Methods

SurePassID leverages open standard authentication methods to address every use case

  • FIDO2/WebAuthn – phishing-resistant and passwordless MFA
  • Push Authentication – frictionless MFA on mobile devices
  • OTP – event-based and time-based
  • SMS, IVR and backup methods

AUTHENTICATION METHODS

FIDO2/WebAuthn

Based on open standards from the FIDO (Fast IDentity Online) Alliance, FIDO2/WebAuthn is a phishing-resistant, passwordless multi-factor authentication (MFA) method that enables password-only logins to be replaced with secure and fast login experiences across websites and apps.

AUTHENTICATION METHODS

Push Authentication

SurePassID Authentication Server turns any mobile device – BYOD or issued – into a universal authenticator for fast, frictionless MFA. With a single tap, users can verify their identity and begin securely accessing resources. Alternatively, users can easily deny unrecognized login attempts and prevent bad actors from unauthorized access. Best of all, push authentication is highly secure as an MFA out-of-band and anti-replay attack method.

AUTHENTICATION METHODS

One-Time Password (OTP)

One time passwords (OTPs) are an authentication method used as part of two-factor authentication (2FA) and multi-factor authentication (MFA):

  • Something you know (Username/Password); and
  • Something you have (One Time Password)

OTPs are unique passwords that are only valid for a single login session for a defined period of time. OTPs are generated via the open standard OATH HOTP (event-based) or TOTP (time-based) algorithm. A variety of user authenticators can be used to generate OTPs, or they can be generated separately and sent to users via SMS, IVR, email or other means.

SMS OTP

SMS Challenge Response

AUTHENTICATION METHODS

Short Message Service (SMS)

Mobile devices with SMS text capability can be used for authentication via One Time Password (OTP) and Challenge/Response (CR or Y/N). This is a less-secure form of strong authentication because it is vulnerable to man-in-the-middle attacks.

  • SMS OTP sends an OTP to the user’s phone via SMS. The user enters the OTP into their login authentication and is approved.
  • SMS Challenge-Response sends a question asking if the authorization attempt is approved to the user’s phone via SMS. If the user texts back “Yes”, authentication is completed and the user is logged in. If the user texts back “No”, authentication is failed and the user is not logged in.

For organizations requiring compliance with any NIST-based regulatory regime, SMS OTP is no longer a compliant authentication method due to its vulnerability to man-in-the-middle (MITM) attacks.

AUTHENTICATION METHODS

Interactive Voice Response (IVR)

Mobile phones can be used for authentication via One Time Password (OTP) or Challenge-Response (CR or Y/N) delivered via Interactive Voice Response (IVR). This is a less-secure form of strong authentication because it is vulnerable to man-in-the-middle (MITM) attacks.

  • IVR OTP places a voice call to the user, who listens to the OTP. Then the user enters the OTP into their login authentication and is approved.
  • IVR Challenge-Response places a voice call to the user, who listens to a question asking if the authorization attempt is approved. If the user replies “Yes”, authentication is completed and the user is logged in. If the user replies “No”, authentication is failed and the user is not logged in.

For organizations with visually-impaired users, IVR Challenge/Response enables compliance with the Americans with Disabilities Act (ADA). However, IVR authentication is not compliant with NIST-based regulatory regimes due to its security vulnerability.

IVR OTP

IVR Challenge Response

AUTHENTICATION METHODS

Backup Methods

At SurePassID, we know one size doesn’t fit all when it comes to MFA – and backup authentication methods. Different organizations have different use cases and requirements. Thus we offer the widest variety of backup authentication methods.

SurePassID Authentication Server enables any authentication method to be used as a backup authentication method. Administrators can specify the backup authentication method or methods for any given user account. Alternatively, users can be allowed to choose their own backup method or methods from a pre-approved list.

For additional security, backup authentication methods can be specified for emergencies only. Once used, an alert can be sent to IT security or helpdesk staff for human intervention, or the user account can operate on a less-privileged basis according to security policies.

FREQUENTLY ASKED QUESTIONS

FAQs about SurePassID and our Authentication Server solution

  • Software-as-a-Service (SaaS)
  • Windows Installer Package (Microsoft Windows Server 2008/2012/2016/2019/2022)
  • Virtual Machine (Microsoft Hyper-V)
  • Container (Docker/Kubernetes, Microsoft ACI, Amazon ECS)
  • Serverless/Function-as-a-Service (FaaS)
  • Embedded (8, 16, or 32-bit microcontrollers)

Cloud deployments can occur same day. On-prem deployments will vary depending on the complexity of your requirements. Regardless, our Customer Success team is with you every step of the way.

SurePassID is the most hardened authentication solution on the market. Customers choose us because we specialize in securing user access to mission-critical IT/OT systems and critical infrastructure. We never stop innovating to protect our customers from evolving cyberthreats.

As a SAML 2.0 IdP, SurePassID easily and seamlessly integrates with any on-prem (e.g. Ping Identity) or cloud-only (e.g. Okta) IAM solution.

  1. Unmatched on-prem and OT capabilities
  2. Outstanding technical support
  3. Unbeatable value

Visit https://www.surepassid.com/pricing for a complete guide to SurePassID Authentication Server pricing and features.

Discover why leading enterprises choose SurePassID Authentication Server

Talk to one of our MFA experts about your unique requirements. Or request a demo and see how easy it is to secure your universe of apps with SurePassID Authentication Server.