If you want to use a service in the digital world, you first have to authenticate yourself to the service provider using suitable factors. This means that you have to provide the clearest possible proof so that the user identity can be authenticated. There are various server-side methods for this, which depend on the respective factors - they can be divided into three categories:

• Knowledge (knowledge factors): This involves proving knowledge of a very specific piece of information, such as knowing a password, a Personal Identification Number (PIN) or the answer to a specific question.
• Possession (Ownership Factors): The service user is in possession of a specific object, such as an ID card, a smartphone with a specific hardware feature or special software, or a security token in the form of a USB stick. An RFID-based microchip implant or digital certificates also fall into this category.
• Physical characteristic/biometrics (inherence factors): This category includes various physical characteristics or biometric features that are evaluated as proof of identity. Measurement and evaluation methods for fingerprint, iris and retina structure as well as facial recognition data can be used for this purpose.

Identity verification methods can be used individually (single-factor authentication) or in combination (multi-factor authentication). For example, a password can be combined with an ID card. On closer inspection, however, the first two categories only enable implicit identity verification by the service provider. The password as a secret that was assigned to a specific person when the user account was created can ultimately fall into the possession of third parties accidentally or through a cyber attack; a smartphone with a SIM card, telephone number and app can be stolen. Only biometrics provides more or less unambiguous proof of identity under reasonably normal circumstances.

Secure practice: e-banking

Two-factor authentication (2FA) is currently the state of the art in the IT world. The first identity verification factor is the user name/password or a PIN, i.e. a classic proof of secret knowledge. The second factor is often formed by possession of a smartphone with or without an app. In the first case, a text message is sent with a one-time password that must be entered within a specified period of time during a login procedure. Alternatively, it is also possible to manually enter a time-based one-time password via an app or even scan a QR code, which is displayed as an image object in the web browser of a second device and becomes invalid after just a few seconds.

As 2FA has been mandatory within the European banking system since 2018, many banks now use the "password plus authenticator app" variant for customer access: For example, the user logs on to a service provider's website from a PC via a web browser using a username/password as the first factor and must then provide the second factor via a smartphone app within a certain period of time. Particularly important: 2FA smartphone apps use a different transmission channel than the web-based login via password. This means that both factors are transmitted to the server via different connections. This is why the app is also referred to as out-of-band authentication (OoBA). OoBA-based 2FA procedures offer additional protection against man-in-the-middle attacks.

Insecure innovation: e-charging stations

With the exception of sending a one-time password via SMS, the 2FA-OoBA combination is considered a relatively secure procedure overall. It should therefore be used at least for applications that involve cashless payments or other money transfers. From a security perspective, it must therefore be assumed that relatively new technologies and processes will also use these functions - especially if the market launch and penetration are also coordinated by government authorities and the users are predominantly private individuals.

A practical example of validating current authentication procedures in a high-growth IoT application is the public charging infrastructure for electromobility. There are currently around 50,000 to 55,000 public charging points in Germany. According to political targets, there should be one million by 2030. Over time, tens of millions of people will authenticate themselves at these infrastructure points to draw electricity and pay for it, in order to charge their vehicles after successful authentication. At the moment, simple one-factor authentication via RFID customer card or smartphone app, i.e. ownership factors, still dominate the currently available e-charging stations. Many charging service providers have simply transferred the high risk of these highly insecure procedures to the user via the general terms and conditions. On the other hand, the charging process is very convenient: simply hold the correct RFID card in front of the reader or scan a QR code at the charging point using a smartphone app and the charging current flows into the vehicle battery. Days, weeks or even months later, the costs are then debited from the user's account.