computer science

Knowledge-based authentication

Knowledge-based authentication is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Knowledge-based authentication rather than just read about it. In short: Knowledge-based authentication, commonly referred to as KBA, is a method of authentication which seeks to prove the identity of someone accessing a service such as a financial institution or website. As the name suggests, KBA requires the knowledge of private information from the individual to prove that the person providing the identity information is the owner of the identity.

Key takeaways

Knowledge-based authentication belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Knowledge-based authentication to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Knowledge-based authentication from memory before moving on to harder problems.

Reference excerpt

Knowledge-based authentication, commonly referred to as KBA, is a method of authentication which seeks to prove the identity of someone accessing a service such as a financial institution or website. As the name suggests, KBA requires the knowledge of private information from the individual to prove that the person providing the identity information is the owner of the identity. There are two types of KBA: static KBA, which is based on a pre-agreed set of shared secrets, and dynamic KBA, which is based on questions generated from a wider base of personal information.

Static KBA (shared secrets) Static KBA, also referred to as "shared secrets" or "shared secret questions," is commonly used by banks, financial services companies and e-mail providers to prove the identity of the customer before allowing account access or, as a fall-back, if the user forgets their password. At the point of initial contact with a customer, a business using static KBA must collect the information to be shared between the provider and customer—most commonly the questions and corresponding answers. This data must then be stored only to be retrieved when the customer comes back to access the account. The weakness of static KBA was demonstrated in an incident in 2008 where unauthorized access was gained to the e-mail account of former Alaska Governor Sarah Palin. The Yahoo! account's password could be reset using shared secret questions including "where did you meet your spouse?" along with the date of birth and ZIP code of the former governor to which answers were easily available online. Some identity verification providers have recently introduced secret sounds or pictures in an effort to help secure sites and information. These tactics require the same methods of data storage and retrieval as secret questions.

Dynamic KBA Dynamic KBA is a high level of authentication that uses knowledge questions to verify each individual identity but does not require the person to have provided the questions and answers beforehand. Questions are compiled from public and private data such as marketing data, credit reports or transaction history. To initiate the process, basic identification factors such as name, address and date of birth must be provided by the consumer and checked with an identity verification service. After the identity is verified, questions are generated in real time from the data records corresponding to the individual identity provided. Typically, the knowledge needed to answer the questions is not available in a person's wallet (some companies call them "out-of-wallet questions") making it difficult for anyone other than the actual identity owner to know the answer and obtain access to secured information. Generally, the length of time and number of attempts provided to respond are limited to prevent the answers being researched. Dynamic KBA is employed in several different industries to verify the identities of customers as a means of fraud prevention and compliance adherence. Because this type of KBA is not based on an existing relationship with a consumer, it gives businesses a way to have higher identity assurance on customer identity during account origination.

See also Cognitive password Identity verification service Multi-factor authentication Out of wallet

References

Worked examples

Example 1 — a first encounter with Knowledge-based authentication

Start with the simplest possible case. Write down what Knowledge-based authentication claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Knowledge-based authentication before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Knowledge-based authentication ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Knowledge-based authentication

In research: Knowledge-based authentication appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Knowledge-based authentication in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Knowledge-based authentication is common in secondary-school and first-year university syllabi. It links to neighbouring topics Computer network security, so understanding it makes those chapters shorter.
In everyday life: Look for Knowledge-based authentication outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Knowledge-based authentication in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Knowledge-based authentication means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Knowledge-based authentication out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Knowledge-based authentication in simple terms?

Why does Knowledge-based authentication matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Knowledge-based authentication?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Knowledge-based authentication.