Four-factor authentication

Question

I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors:

• Knowledge - something you know (e.g. password, PIN, pattern)
• Possession - something you have (e.g. mobile phone, credit card, key)
• Existence - something you are (e.g. fingerprint)

My question is: Does a fourth factor of authentication exist?

A quick search on Google did not bring any interesting results other than a patent document that I didn't bother reading through. Could somewhere you are be considered a fourth factor?

Answer 1

As you noted, the main three are:

• Something you know
• Something you have
• Something you are

I'd argue that there are others:

• Something you can do, e.g. accurately reproducing a signature.
• Something you exhibit, e.g. a particular personality trait, or even neurological behaviour that could be read by an fMRI. These are not strictly "are" features, as they're more fluid.
• Someone you know, e.g. authentication by chain of trust.
• Somewhere you are (or have access to), e.g. locking a session to an IP, or sending a confirmation pin to your address. This one is a bit tenuous in terms of being called an authentication factor, but it's still useful to note.

Answer 2

Absolutely!

Somewhere you are is quite widely used in corporate IT. In many environments, if you are on an office network, you can login using only a password, but if you are out of the office you must use an additional factor, usually a token.

The current time is arguably another authentication factor, a classic example being a time delay safe. Office door passes are often valid only within particular times of day.

Contactability is sometimes viewed as another factor, e.g. receiving a letter at a known address (or an email, phone call) proves identity. Although usually this comes down to one of the factors you already mentioned, e.g. receiving a letter shows that you have the key to that address.

As you think more about this, you realise the distinction between factors is quite blurred - particularly between "something you know" and "something you have". If you write down a password, does that piece of paper become "something you have"? You mention a key is "something you have" - but if a locksmith knows the pattern, they can make a new key. So arguably a key is truly "something you know".

Answer 3

Nope. There are three. All others mentioned here either:

• can be reduced to one of canonical three (e.g. "something you can do" is a personal feature, so classified as "something you are"; "someone you know" means you can present a proof of connection to someone - that's "something you have"!)
• are not part of authentication, but authorization (time, network or physical location do not prove your identity, but can be used to allow you access or not). Classic example with office access only during office hours - during the night most of us don't lose our identity, we just are not allowed to access office (there are still some power users, who can access office 24/7 with the same auth as during the day, right?)

Answer 4

While we assign authenticators into three common categories, it is important to keep in mind that these categories are somewhat loosely defined. Passwords are normally considered ‘what you know’ authenticators, but if you write it down and refer to the paper instead of memory does it become a ‘what you have’ factor? If a system authenticates using keyboard dynamics to monitor the rhythm and speed of your typing is that relying on ‘what you are’ or ‘what you know’? There can be some reasonable disagreement when deciding how to classify specific authenticators.

Location initially seems like it could be a fourth factor, but is it really? How does a system know your location? It likely relies on coordinates or address (either physical or IP) data provided by a device. Is that data then ‘what you know’ since someone else with that same data can duplicate that factor on their own device? Is it ‘what you have’ since the system relies on the trustworthiness of a device to provide legitimate data? We have to decide whether location is distinct enough to be considered its own independent factor category.

I do think it is important to make a distinction about what constitutes a factor since we use terms like “multi-factor authentication” to indicate the benefits of certain systems. Is it multi-factor if you log into a system with a password from an IP address that is associated with past logins? If we consider location a fourth factor then the answer is yes. However, I haven’t seen many people characterize this as a multi-factor authentication system.

In the paper CASA: Context-Aware Scalable Authentication the authors agree that location data can serve as a factor in the authentication process, but specifically define it as a “passive” factor. They distinguish between “passive” factors and “active” factors that require user interaction (e.g. passwords, fingerprint scans, etc.). This seems like a good way to separate out what are true authentication factors from other data that can be used to help make authentication decisions.

In my opinion location data shouldn’t be considered a fourth factor, but that doesn't prevent it from being useful during the authentication process.

Answer 5

Like everything else related to security, determining where you are requires trust. If you have to enter your PIN on the 10 key pad mounted on the door to the secure facility, how do you know the network connection from the data center to the door hasn't been diverted to a phony PIN pad mounted elsewhere? How do you know there isn't a proxy in place, manipulating the keys on behalf of someone else?

Or for a widely used example, consider that there are (many) apps available for iPhones that allow the user to specify a location of their choosing to Location Services. A simple use case could be for someone to pretend to be at work while they're actually on the golf course. However, you could falsify your location to qualify for otherwise restricted benefits: imagine an e-book with a geofence that allows it to be read only when inside a public library. And if you were relying on the phone to self-report location in order to remove the need for using a secure token, an attacker could use this to degrade the security to something more easily broken.

You can certainly add location to a security system, but you also have to consider measures to ensure it isn't being defeated.

Answer 6

The fourth factor would be something the individual does, (dynamic biometrics). Examples include recognition by voice pattern, handwriting characteristics, and typing rhythm.