---
title: "Authentication as security mechanism"
subject: "Operating System"
chapter: 8
key: "semester_6/operating_system:authentication-security"
source: https://www.bctengineer.com/q/semester_6/operating_system/authentication-security
site: BCT Engineering
---

# Authentication as security mechanism

Operating System · Chapter 8: Security

- Asked in: 2074 Bhadra, 4 marks
- Video: [User Authentication-Operating Systems-20A05402T-UNIT – 5  Protection and System Security](https://www.youtube.com/watch?v=M8NbBkk8StA) — D Sumathi
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_6/operating_system/authentication-security
- Whole chapter: https://www.bctengineer.com/md/semester_6/operating_system/chapter-8

## Question

How is authentication an essential mechanism for maintaining security? Explain.

## Short answer

Authentication verifies identity before granting access, forming the basis for authorization, auditing, and access control. Without it, permissions become useless. Methods include passwords, tokens, biometrics, and multi-factor authentication.

## Answer

**Authentication** is the process of verifying the identity of a user, process or device before access is given. It is essential because every other security mechanism (authorisation, access control, auditing) depends on knowing correctly who is making the request. If identity can be faked, ACLs and permissions become useless.

#### Why it is essential
- Ensures only legitimate users enter the system (prevents masquerading).
- Gives accountability: actions are recorded against a verified identity in logs.
- Protects confidentiality and integrity of data by allowing access only to the right person.
- Starting point for authorisation: permissions are assigned to authenticated identities.

#### Methods of authentication
1. **Something the user knows:** password, PIN. Weak if guessable; so use long passwords, hashing with salt, expiry.
2. **Something the user has:** smart card, token, mobile OTP.
3. **Something the user is:** biometrics (fingerprint, iris, face).
4. **Multi-factor authentication:** two or more of the above, e.g. password + OTP.
5. **Challenge-response:** the system sends a random challenge; the user returns a result computed with a secret key, so the secret never travels.

#### Typical login flow (UNIX)
```text
 user name + password
        |
  hash(password + salt)
        |
 compare with stored hash in /etc/shadow
        |
  match -> access granted
```

Authentication threats: password guessing, login spoofing, sniffing. Countermeasures: account lockout after failures, encrypted channels and trusted login paths.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. Why is authentication essential?
   A. Other mechanisms like ACLs depend on knowing who is making the request
   B. It encrypts all data
   C. It removes need for permissions
   D. It speeds up access
   Answer: A. If identity can be faked, permissions are useless. (Key point: Why essential)

2. Which pairs factor with example?
   A. Something you know: smart card
   B. Something you are: fingerprint
   C. Something you have: password
   D. Something you are: PIN
   Answer: B. Know: password; have: token; are: biometrics. (Key point: Factors)

3. What is multi-factor authentication?
   A. Using a password twice
   B. A very long password
   C. Using two or more factors, e.g. password plus OTP
   D. Two accounts
   Answer: C. It remains secure if one factor is compromised. (Key point: MFA)

4. What is the advantage of challenge-response?
   A. No password is needed
   B. It needs biometrics
   C. The challenge is fixed
   D. The secret key never travels over the network
   Answer: D. The user returns a result computed with the secret key. (Key point: Challenge-response)