Source-linked AI summary
A Catalog of User Authentication Patterns
Alex R. Mattukat, Horst Lichter
TL;DR
Existing security pattern catalogs have limited practical application and lack concrete, detailed coverage of user authentication. This paper analyzes authentication techniques and presents a 14-pattern catalog organized by authentication factor and usual role, with the stated aim of improving practical application. The catalog is intended to support software architects and engineers, particularly non-security experts, while leaving combinations of patterns outside its scope.
Problem
Existing security pattern catalogs have limited practical adoption and lack a detailed catalog of concrete user authentication patterns.
Method
The paper analyzes authentication techniques for pattern characteristics and recurring problems under forces, then organizes patterns by authentication factor and usual role.
Results
The paper presents a catalog of 14 distinct user authentication patterns.
Takeaways & Limitations
The catalog is intended to improve the practical application of security patterns and support software architects and engineers, especially non-security experts.
Takeaways & Limitations
The catalog does not account for combinations of authentication patterns, although multiple patterns are commonly used together in practice.
Abstract
from arXiv · showhide
Security patterns are intended to support the design and development of secure software systems. However, although established catalogs of security patterns exist, their practical application remains limited. In particular, despite these catalogs, concrete patterns for common security controls such as user authentication (authentication for short) are lacking. This paper aims to make an initial contribution toward closing this gap, as exemplified by authentication. It presents a novel authentication pattern catalog, comprising 14 user authentication patterns. To support the catalog's practical application, it classifies patterns by the well-known concept of authentication factors and by the usual role each pattern fulfills in practice. By cataloging common authentication techniques through authentication patterns, we aim to make an important contribution to supporting software engineers and architects in designing and developing secure software systems.
1 Introduction
Secure software design is crucial but challenging, especially because non-security experts often make security decisions. Existing security pattern catalogs have limited practical adoption because their abstractions and classifications are unclear.
- Motivation: Secure software design is crucial and challenging, while security expertise remains scarce.Non-security experts therefore often handle security-related activities and decisions.
- Pattern-catalog gap: Established security pattern catalogs support secure-system design, but their practical adoption remains limited.The paper links this limitation to unclear abstractions in pattern classification and modeling.
- Pattern-catalog gap: Many security patterns describe overly general concepts such as objectives, guidelines, or principles.The paper notes that this abstraction problem persists in more recent catalogs.
- Paper scope: The paper introduces authentication terminology and patterns before presenting related work, classification, detailed patterns, and limitations.Its structure moves from foundations and contributions through catalog presentation to conclusions and future research.
2 Background and Contributions
Authentication verifies a claimed identity through one or more authenticators, and the paper focuses specifically on human user authentication. Existing catalogs lack detailed authentication coverage, so this paper proposes and organizes 14 user authentication patterns for practitioners.
- Authentication foundations: Authentication verifies a claimed identity using one or more authenticators controlled and possessed by the subject.Examples include passwords, fingerprints, and one-time passwords sent by SMS or email.
- Authentication foundations: The paper uses “authentication” to mean user authentication because consistent patterns for non-human subjects have not yet been identified.Its scope is authentication techniques for human subjects.
- Research gap: Existing catalogs generally treat authentication as a general concept or cover only a few variants.Detailed catalogs for fingerprint-, smart-card-, and passkey-based authentication remain missing.
- Contribution: The paper proposes 14 distinct user authentication patterns intended primarily for non-security experts.Patterns are documented from a solutions architect’s perspective while omitting technical and low-level security details.
- Contribution: The catalog groups patterns by authentication factor and usual authentication role to guide pattern selection.This structure is intended to improve applicability for software architects and engineers.
3 Related Work
Earlier security pattern catalogs include authentication but remain too abstract to document the recurring alternatives in sufficient detail. This paper distinguishes authentication techniques from patterns and analyzes techniques for recurring problems, forces, and pattern characteristics.
- Existing catalogs: Established security catalogs include authentication-related patterns but remain highly abstract.Their authentication coverage does not sufficiently document recurring problems, solutions, and forces.
- Existing catalogs: Insufficient detail in existing catalogs limits the practical use of authentication alternatives.The missing detail concerns the recurring problems, solutions, and forces associated with those alternatives.
- Techniques and patterns: An authentication technique is the conceptual way one or more authenticators are used to perform authentication, whereas a pattern guides its design.The two catalogs therefore support architects and engineers in different ways.
- Catalog overview: Table 1 overviews the catalog’s authentication patterns grouped by authentication factor and usual authentication role.The caption identifies both grouping dimensions.
- Analysis approach: The authors analyzed authentication techniques for individual or cross-technique pattern characteristics and assessed whether they solve recurring problems under forces.Password authentication exemplifies recurring technique characteristics, while similarly implemented biometric variants exemplify cross-technique characteristics.
4 Classification of Authentication Patterns
The catalog classifies authentication patterns by the authenticator’s factor and the pattern’s usual role, providing navigation and selection guidance. Factors include inherence, knowledge, and possession; roles are primary or subsidiary.
- Classification: Authentication patterns are classified by authentication factor and usual authentication role.Both properties help practitioners navigate the catalog and select a pattern for a specific context.
- Authentication factors: The catalog uses inherence-based, knowledge-based, and possession-based factors.These correspond respectively to inherent user features, secret information, and something the user possesses.
- Authentication factors: Authentication factor is the first-level grouping because it is widely recognized and carries factor-inherent properties.For example, inherence-based patterns process highly sensitive data and face strict data-protection requirements.
- Authentication roles: Patterns are usually implemented in primary or subsidiary authentication roles.Primary patterns provide the central entry point to restricted resources, while subsidiary patterns support or enhance primary authentication or serve other use cases.
- Authentication roles: Subsidiary authentication includes second factors, fallback techniques, and authentication outside central protected-service entry points.The specific subsidiary role varies by use case.
- Authentication roles: Passwords usually authenticate application access, whereas security questions commonly authenticate users who forgot their password.This illustrates why passwords typically have a more central role than security questions.
- Catalog organization: Table 1 and the pattern presentations follow the same factor-first and role-second organization.Pattern descriptions cover context, addressed problem, forces, solution, consequences, and known uses.
5 Inherence-based Authentication Patterns
Inherence-based authentication patterns use biometric data to identify and authenticate users conveniently, but they require strong privacy protections and can suffer accuracy, environmental, and accessibility limitations. The catalog identifies fingerprint, face recognition, iris recognition, and continuous behavioral-based authentication patterns.
- Inherence-based patterns: Inherence-based patterns use biometric data to identify and authenticate humans simultaneously, offering high usability and comfort but requiring strong data security and privacy.They are primarily suited to local authentication because remote use raises serious security and privacy concerns.
- Pattern classification: All three primary inherence-based patterns are fingerprint, face recognition, and iris recognition.The catalog separately identifies continuous behavioral-based authentication as a subsidiary inherence-based pattern.
- Fingerprint authentication: Fingerprint authentication captures a finger sample, compares it with a securely stored reference, and grants access when similarity is sufficient.It requires only a brief gesture and can offer very high accuracy in everyday settings, but residues, environmental conditions, presentation attacks, and some physical impairments limit suitability.
- Face recognition authentication: Face recognition captures facial images and compares them with a stored reference without requiring physical contact or deliberate interaction.It can support passive authentication and broad applicability, but lighting, facial changes, positioning, liveness, and accidental bystander capture create constraints.
- Iris recognition authentication: Iris recognition offers high accuracy, very low false-positive rates, and greater resistance to forgery than other biometric features.Its requirement for precise positioning and sensitivity to lighting, reflections, and distance make it less suitable for moving users or high-throughput contexts.
- Continuous behavioral-based authentication: Continuous behavioral-based authentication continuously compares observed user interactions with a stored behavioral profile throughout the session.This passive pattern can detect session takeovers that active authentication misses after initial authentication, while raising concerns about behavior changes and privacy.
6 Knowledge-based Authentication Patterns
Knowledge-based authentication separates subject identification from authentication and can support broadly applicable, anonymous or pseudonymous access. Its usability and deployment advantages are offset by memorability demands, credential attacks, and weaker security for self-managed secrets.
- Knowledge-based patterns separate subject identification from authentication, enabling anonymous or pseudonymous authentication and generally reducing authentication-data sensitivity.
- Two primary knowledge-based patterns are text password authentication and self-managed PIN authentication.
- Text Password Authentication: Text passwords are familiar, require no specialized hardware, support broad applications, and have low implementation and operating costs.
- Text Password Authentication: Password authentication requires users to balance memorability and strength, while recovery mechanisms and password reuse introduce additional attack vectors and security risks.Passwords are also targeted by phishing, credential stuffing, and brute-force attacks.
- Self-Managed PIN Authentication: Self-managed PIN authentication uses a deliberately short numeric or alphanumeric password with strict countermeasures and local-only use on end devices.Countermeasures include blocking common or guessable PINs and locking out repeated failed attempts.
- Self-Managed PIN Authentication: Short PINs reduce memorization and entry effort, but their low complexity weakens resistance to guessing and brute-force attacks, making countermeasures essential.The pattern is not applicable as a standalone solution where remote authentication is required.
7 Possession-based Authentication Patterns
Possession-based authentication proves control of a physical token or device, avoiding memorization and permitting transmission to remote systems. The catalog covers smart cards, passkeys, and three OTP variants, each trading security or deployability benefits against operational or physical dependencies.
- Possession-based patterns prove control of a physical token or device, avoid memorization, and allow less-sensitive authentication data to be transmitted remotely.Their main physical-world risks arise from loss or theft of the authenticator.
- Two primary possession-based patterns are smart card authentication and passkey authentication.
- Smart Card Authentication: Smart cards support centralized credential revocation, multiple devices and access points, and large-scale deployment, but require specialized readers and substantial administrative infrastructure.Issuance overhead, physical damage, and dependence on a central authority add further constraints.
- Passkey Authentication: Passkeys provide phishing-resistant authentication without memorized secrets, physical-token infrastructure, or an external issuing authority, reducing cognitive and operational overhead.Their deployment typically depends on synchronization of key material across a user’s platform ecosystem and on user devices.
- Subsidiary Authentication: Three subsidiary possession-based patterns are hardware-token OTP, software-token OTP, and out-of-band OTP authentication.
- Hardware-Token OTP Authentication: 85%?
8 Conclusions & Future Work
The paper presents a 14-pattern user-authentication catalog organized by authentication factor and usual role to improve the practical application of security patterns. It identifies two limitations—factor-level abstraction and missing pattern combinations—and proposes future work on a pattern language and machine-to-machine authentication.
- The catalog contains 14 distinct user authentication patterns organized by authentication factor and usual role in the authentication context.
- The catalog’s factor-level properties suggest that authentication factors themselves may be expressible as abstract patterns, with the catalog entries serving as concrete patterns.
- The catalog does not account for combinations of authentication patterns, although multiple patterns are commonly used together in standalone authentication techniques.The paper gives two-factor authentication combining text passwords with software-token OTP as an example.
- Future work will address both limitations through an authentication pattern language and extend the catalog to machine-to-machine authentication.