Authentication of both the customer and service provider establishes their identities and ensures that both are who they say they are. The most favored approach for this is to exchange a set of data which had been encrypted through the use of RSA's public-key cryptography. The private key is known only to its owner and used by its owner to encrypt messages and provide a digital signature. The associated public key is known to everyone else and used to decrypt messages and authenticate the sender of the message. After authentication establishes the identity of the transaction participants, authorization must establish what they are allowed to do.
Authorizations take the form of a permissions database at a service provider location.
The database may, for example, give read-only access to a customer to view his own account data and read, write, and create permissions to allow account administrators to create, delete, credit, or debit customer accounts. The same data-encryption scheme that allows for authentication of transaction participants can also provide the necessary privacy to, for example, keep account balances from flowing in open view over the network. Because public-key encryption is resource intensive, some companies use the authentication service to transmit a separate, encrypted private key. The private key can then be used to switch to a more efficient, private, encryption technique for the remainder of the transaction. Digital signatures make use of the private key and a message-specific value, such as a check sum, to prove both who generated the information and that the information was not modified after the message and matching signature were generated.