Authentication and Authorization

While being similar and often combined these are two sperate concerns.

Authentication: Binding an identity to a subject.
Authorization: Binding rights to a subject.

Authentication

The authentication process consists of 4 distinct steps:

Receiving authentication data
Extracting unique featues
Comparison with reference data
Final Authentication

Most authentication procedures are based around secrets:

What do I know?
Where am I?
What do I have (biometric)?

The authentication can be split into verification, which means comparing the authentictation data with the reference data (1:1) and identification were we compare the authentication data against the reference data of all registered people (1:n).

Knowledge base authentication

Uses secret knowledge like a pin or password which is not known to anyone else. This secret needs to be complex enough such that it can't be guessed and it should be changed frequently.

Example authentication steps:

Typing in your password
Hashing the password
Comparing hash with reference hash
Identical or not identical