Strong authentication

Strong Authentication is a notion with several unofficial definitions. However, since January 2013, it has been defined by regulation and incoming legislation within the European Union and the SEPA payment zone for remote payment transactions. Strong Authentication and Strong Customer Authentication are used interchangeably in banking and financial services, particularly where access to an account must be linked to an actual person, corporation or trust.

Strong (Customer) Authentication Definitions

Strong authentication is often confused with two-factor authentication or more generally multi-factor authentication. However, strong authentication is not necessarily multifactor authentication. Soliciting multiple answers to challenge questions may be considered strong authentication but, unless the process also retrieves 'something you have' or 'something you are', it would not be considered multi-factor authentication. The FFIEC issued supplemental guidance on this subject in August 2006, in which they clarified, "By definition true multifactor authentication requires the use of solutions from two or more of the three categories of factors. Using multiple solutions from the same category ... would not constitute multifactor authentication."^[1]

Another commonly found class of definitions relates to a cryptographic process, or more precisely authentication based on a challenge response protocol. This type of definition is found in the Handbook of applied cryptography.^[2] This type of definition does not necessarily relate to two-factor authentication, since the secret key used in a challenge-response authentication scheme can be simply derived from a password (one factor).

A third class of definitions says that strong authentication is any form of authentication in which the verification is accomplished without the transmission of a password.^{[citation needed]} This is the case for example with the definition found in the Fermilab documentation.^[3]

The fourth class, which has legal standing within the EU28 and SEPA zone countries, is that as defined by the European Central Bank for remote (online or mobile) authentication. On the 31st January 2013, the European Central Bank (ECB) issued mandatory guidelines^[4] that require all payment gateways, issuing, joint issuing/acquiring, and acquiring institutions, who jointly form the group defined as Payment Service Providers (PSPs), to adopt 'strong (customer) authentication' by 1 February 2015. These requirements are for remote (online, mobile and internet) credit card transactions including and extend to e-mandates, eWallets, stored value cards, and credit transfers.

The ECB mandatory guidelines are applicable within the Single Euro Payment Area (SEPA), which includes the EU28 member states, plus Switzerland, Norway, Lichtenstein, Iceland and Monaco. Of particular note is that PSP's that do not implement strong authentication will be liable for credit card and other fraud on their networks, with the e-merchant released from liability. 

The European Commission released draft legislation of the Payment Services Directive^[5] Version 2 (PSD2), which requires all online transactions to use strong authentication in accordance with the ECB guidelines. Articles 85-87 of the draft legislation mandate the requirement for strong authentication, with Articles 65 & 66 providing the liability shift mechanism. This is a major change to the operation of online transactions within the SEPA zone, and a global first, as EU legislation will replace what was once the domain of the Card Scheme^[6] rules. The PSD2 is making passage through the European Parliament at present.

The ECB definition of strong customer authentication is " a procedure based on the use of two or more of the following elements– categorised as knowledge, ownership and inherence: (i) something only the user knows, e.g. static password, code, personalidentification number; (ii) something only the user possesses,e.g.token, smart card, mobile phone; (iii) something the user is, e.g. biometric characteristic, such as a fingerprint. In addition, the elements selected must be mutually independent, i.e. the breach of one does not compromise the other(s). At least one of the elements should be non-reusable and non-replicable (except for inherence), and not capable of being surreptitiously stolen via the Internet.The strong authentication procedure should be designed in such a way as to protect the confidentiality of the authentication data."

Where the ECB differs in its application of strong customer authentication from the two factor authentication recently deployed by Twitter, Apple and Google, is that the ECB's strong authentication is always traceable back to an individual (or company), that has been identified in accordance with Anti-Money Laundering / Counter Terrorism Funding (AML/CTF) laws applicable to an account being opened with a financial services provider. Thus, whilst is prossible to open an account under a pseudonym with Twitter, Apple, Google etc., and add in layers of different factors such as mobile phone, biometrics, other email addresses or knowledge based authentication, it is not possible to open a bank account or credit card account without first having been identified in accordance with AML/CTF legislative requirements.^[7] Subsequent factors are added to the account after it has been opened and the person identified.

The ECB's requirements are technologically neutral, in order to foster innovation and competition. The public submission process to the ECB has identified three solutions, two of which are based on Reliance authentication, and the other being the new variant of 3-D Secure which incorporates one time passwords.

The ECB requirements apply to the following card schemes in operation in the EU /SEPA : 4B, American Express, Bancomat, Bancontact/MisterCash, Banque Accord, BNP Paribas Personal Finance, Carrefour Banque, Cartes Bancaires, Cashlink, China Union Pay, Cofidis, Cofinoga, COGEBAN/Pagobancomat, Crédit Agricole Consumer Finance, Diners Club International, Euro6000, Franfinance, girocard, JCB International, Korean BC, LaserCard, MasterCard Europe, PIN, Quikcash, Servired, SIBS’ Multibanco, and VISA Europe.

Apple's new iPhone 5 series, with fingerprint scanner, would not meet the ECB requirements, unless there was also a dynamic element associated with it.

The Reserve Bank of India has also followed the ECB's lead and mandated^[8] strong authentication for online transactions.

Thus, the term strong authentication can be used as long as the notion strong is defined in the context of use.

See also

• Initiative For Open Authentication
• Multi-factor authentication
• 3-D Secure
• Reliance authentication

References