autentiser

Autentisering is the process of establishing the identity of a person, device, or process requesting access to a system or resource. It is a fundamental step in access control, distinguishing who is allowed to do something from who is not. In Norwegian usage, autentiser is the verb form, while autentisering refers to the process itself.

Authentication answers who you are; authorization determines what you are allowed to do after being authenticated.

A key feature of autentisering is the use of multiple factors. Categories include knowledge-based factors (something you know, such as a password), possession-based factors (something you have, such as a security token), and inherence-based factors (something you are, such as biometrics). Many systems use multi-factor authentication (MFA) by combining two or more factors to increase security.

Common methods and technologies include passwords, biometrics, security tokens and hardware keys (such as those conforming to FIDO2), mobile push-based approvals, one-time passwords (OTP via TOTP or HOTP), digital certificates, smart cards, and WebAuthn. These methods are supported by various protocols and standards that govern how identities are proven across networks and services.

The typical autentisering flow involves the user submitting credentials, the system presenting a challenge or requesting a second factor, verification of the provided information, and, on success, the establishment of a session using tokens such as cookies or JSON Web Tokens, which grant access for a limited period.

Security considerations include the use of phishing-resistant methods, salted password storage, and MFA to reduce credential theft risk. Ongoing device and session management, recovery procedures, and privacy protections are also important. Autentisering is applied widely across web services, corporate networks, mobile apps, and IoT, guided by standards such as OAuth 2.0, OpenID Connect, SAML, Kerberos, and WebAuthn.