## 3 Background and Related Work
### Identity Management
#### 3.1.2 Authentication  
Authentication is the stage where the user proves their claimed identity by providing at least one authentication method assigned to the identifier. Often, the provided credential is a password, i.e., something-you-know, even though many users make a poor choice on passwords [20]. Other method categories are something-you-have, like an access card or token, or something-you-are, for example, a fingerprint or other biometric data. [PERSON] [21] provides an overview of different methods, which are roughly compared by [PERSON] [22]. Credentials, usually the three different categories, can be combined for MFA to increase overall security. A common form of MFA is Two-Factor-Authentication (2 FA). However, this, at the same time, poses the risk of getting locked out of one's account when losing one of the factors. The security and further aspects of authentication is categorized in NIST SP 800-63 B [23].  
Several approaches compare and improve MFA for web applications and specific settings like cyber-physical systems [24] or mobile scenarios [25]. [PERSON] et al. [26] proposed a set of heuristics to evaluate the security, usability, and other characteristics of user authentication, whereas [PERSON] et al. [27] evaluated legal aspects of user-device authentication in the Internet of Things (IoT) settings. In order to continuously improve the current state, a structured process is required. Security frameworks and standards provide either a narrow, or a broad, overview, but do not go into technical details. [PERSON] and [PERSON] [28] proposed an identity and access assurance model based on SABSA, covering generic identity management. No specific approaches for authentication and MFA were known to the others. [PERSON] et al. [29] analyzed the participants' perception of MFA.  
The authentication lifecycle, according to NIST [23], comprises the following phases, as visualized in Figure 2. In addition, a backup strategy needs to be established.  
**Authenticator Binding:**: In the beginning, an association between a specific authenticator and a subscriber's account is established. This enables the authenticator to be used to authenticate that account. The binding includes binding at enrolment, post-enrolment binding, and binding to a subscriber-provided authenticator.
**Renewal, Loss, Theft, Damage, and Unauthorized Duplication:**: Potentially compromised and malfunctioning authenticators need to be guarded against any possibility of extraction of the authenticator secret. For the following processes, the incident should be reported and a backup or an alternate authenticator should be used instead.
**Expiration:**: Authenticators may expire and should not be used for authentications. In consequence, a renewed authenticator should be issued if required.
**Revocation and Termination:**: At the end of the lifecycle, an authenticator is revoked, i.e., the binding between an authenticator and a credential is removed.  
During all stages of the lifecycle, different threats are possible, such as theft, duplication, and eavesdropping. In consequence, all potential threats have to be known and, depending on the risk management, adequately mitigated.