ENTICATION Authentication is one of the three As commonly found in figures showing IP-oriented networks. AAA stands for: Authentication Authorization Accounting Authentication is a control of the identity of the user, whereas authorization means allocation of rights. The last A, accounting, will not be described in this chapter as the function is related to charging and not network security. Authentication means controlling the user identity. The fundamental mechanism is that another party has to show that he knows or is able to do something that nobody else can do. Often the one who wants to verify the authenticity of somebody must challenge him and the challenged party must respond with the right answer. Such a response is to encrypt the challenge with the right key SO that the party can prove that he/she possess the key. It is very important that the challenge is truly random. If the intruder can predict the next challenge, he can ask the right response in advance. Access restrictions by means of authentication is nothing new. An interesting possibility deployed by the old Egyptians and Greeks, who did not have identity cards, is to use biometrical methods. 'Biometry' means 'measurements of humans' with original measures such as length, eye colour, skin colour and scars. A true personal identification can only be achieved using unique personal properties. A key, a personal code or a photo can all be misused. Two fairly cheap alternatives are voice recognition and personal signatures. Voice recognition is tailored to voice communication, and therefore easy to introduce for voice supporting media. This type of verification requires storage of voice prints. The problem with voice recognition is that any type of background noise, or voice changes because of a cold, can cause legitimate calls to be blocked. A more futuristic alternative is scanning of the iris. See biometrics below. Even simpler is a system that is used for personal verification of roamers, who are routed to a call centre, where they verify their i