Internet & Intranet Security Management - Risks & Solutions

• User authentication. The users who communicate have to verify their identity. This is particularly
important for e-commerce transactions when a merchant wants to ensure that a customer is indeed the
authorized user of a credit card.
• Data origin authentication. When a user A receives a message from a user B, then user A has to
ensure that the received message is from user B and vice versa (originality).
Many methods are used to provide authentication services. Some are based on cryptographic
techniques and others are based on biological characteristics such as fingerprints. The most important
techniques based on cryptographic techniques are digital signatures (certificates) and username/password
schemes.
The HTTP/1.1 provides two simple user-name/password-based
Figure 7.
HTTP challenge-response authentication mechanism
mechanisms for user authentication and for access control: Basic authentication access scheme and
digest access authentication scheme. The Web server provides access to protected and unprotected
resources. For protected resources, the server requires clients to authenticate themselves and replies
to a client's HTTP request with a ''401 Unauthorized" status code and an authentication challenge
included in a "WWW-Authenticate" header field. The client may then resubmit the request including
the authentication information in an "Authorization" header field (see Figure 7).
This header field contains at least an indication of the required authentication method (Basic or
Digest) and a server specified realm. On the server side the realms are used to identify the resources
to be protected. On the client side a realm is displayed to users so they know which user-name and
password to use when the client prompts the user for the user-name and password.