Continuous Authentication Definition

What is Continuous Authentication?

Most authentication systems perform one-time authentication at the beginning of a user’s session. For example, a user might enter a password or tap a fingerprint scanner before being granted access to a particular application. After authentication is complete, the user is assumed to be a legitimate user throughout their entire session.

Continuous authentication integrates authentication throughout a user’s entire session. The authentication system performs periodic measurements and ensures that they match the user’s profile throughout their session. This approach can help to enhance the accuracy of user authentication or to protect against session hijacking attacks.

Authentication Methods for Continuous Authentication

Many forms of user authentication require explicit action by the user to work. For example, password-based authentication requires the user to take the time to type or copy-paste a password into a prompt. Attempting to do this throughout the user’s session negatively impacts the user experience.

For this reason, knowledge-based and possession-based authentication methods aren’t a great choice for continuous authentication. In most cases, these methods require user interaction, which interrupts the user’s flow.

Biometric authentication, on the other hand, is often a good fit for continuous authentication. Some examples of biometric authentication that require minimal user interaction include:

• Facial Recognition: A webcam can be used to observe a user’s face as they perform computing tasks.
• Gait Recognition: A person’s walking style is unique and can be used to continuously authenticate them while they perform tasks that involve moving about.
• Keystroke Analysis: The rhythm, speed, and pressure of a user’s typing can be used to authenticate them as they type at a computer.
• Device Interaction: A user’s habits when holding a device, scrolling, tapping, etc. provide a strong, continuous authentication factor when using a smartphone or other mobile device.

In general, behavioral biometrics (gait recognition, keystroke analysis, device interaction, etc.) are the best fit for continuous authentication. This is especially true if the feature being measured is part of the task being performed.

Benefits of Continuous Authentication

Continuous authentication systems perform authentication as a process throughout a user’s entire session rather than as a one-time event. This model provides a few different advantages over traditional, single-time authentication systems. Some examples of these advantages include:

• Improved Authentication: Continuous authentication takes ongoing measurements to verify a user’s identity. This provides additional data points that can be used to better refine and improve the authentication decision.
• Session Hijacking Prevention: If an attacker abandons a logged-in device or has their session hijacked, then an unauthorized user may be able to access sensitive resources. Continuous authentication ensures that the same, legitimate user is using the device throughout the entire session.
• Painless Authentication: In general, continuous authentication uses non-interactive authentication factors. This helps to improve the user experience by removing friction in the authentication process.

Conclusion

Continuous authentication systems perform ongoing authentication of a user’s identity throughout their entire session. This is accomplished by using non-interactive, non-intrusive authentication methods that don’t interfere with the user’s work. By turning authentication into a process rather than a on-time event, continuous authentication improves authentication quality and security.