Conventional authentication using password-based methods is vulnerable to phishing attacks and can result in identity theft and pharming through the forging of the target Web page. Adopting technologies to strengthen these methods and to support others providing more secure authentication is essential for preventing identity theft and for making the authentication process and, therefore, the relationship between the parties more reliable and trustworthy.
A wide range of authentication methods are available (username and password, soft token, hard token, PKI credentials, biometrics, etc.) that provide different levels of assurance (LoA*). However, it can sometimes be difficult to implement more reliable methods owing to them being not very user-friendly or a sharp change from our familiar use habits. This difficulty is even greater when we try to change the methods used by our clients.
Safelayer's TrustedX Adaptive Authentication platform supports the majority of methods and combinations of them and also enables implementing the less common ones. Furthermore, its risk assessment capability (through the analysis of user context factors) means the platform can make decisions based on previously defined policies to bolster the method used.
The authentication policies can determine, individually for each application and according to the risk calculated, whether to grant or deny access following the prompting for a second authentication factor using a different method. Depending on the access device (desktop, tablet or mobile, etc.), a particular behavior can be established in the authentication policy.
More Than Just Strong Authentication
Safelayer's position and experience in the financial and insurance sectors has allowed us to create a complete range of security solutions in our fields of expertise: digital identity, electronic signature and data protection. We complement the potential and versatility of our TrustedX Adaptive Authentication platform with:
- TrustedX Electronic Signature for providing business applications with the PKI functionality required for implementing the electronic signature (transactions, contracts, parties, orders, etc.).
- TrustedX Encryption Key Management for providing the applications and users of the services with data encryption/decryption key management.
- KeyOne PKI Platform for providing all the components for managing PKI credentials in user desktop and mobility environments.
(*) See the level of assurance classification of the National Institute of Standards and Technology (NIST) Special Publication 800-63-1 "Electronic Authentication Guideline" and/or ITU-T X.1254 / ISO/IEC 29115 classifications.