# Security Architecture for Swarms of Autonomous Vehicles in Smart Farming
## 3 Results
### Security Architecture for Swarms of Autonomous Vehicles
#### 3.2.2 User or System Authentication  
The purpose of authentication is to confirm or verify the identity of a user or process. Authentication during the setup of a connection ensures that data are only exchanged between correct parties. Basic user authentication is typically based on two elements: an identity and a password. This method can prevent user logging into other people's accounts, but it is not useful in brute force attacks or password theft situations. Advanced authentication mechanisms are needed to ensure that users are who they say they are. Some of the most popular advanced authentication technologies are (a) limitation of login attempts, so it should not be possible to force an account through its web user interface (user accounts that perform many incorrect logins can be blocked, and account holders can be notified), which is simple to implement but is not effective in the case of password theft; (b) two-factor authentication, a method that requires users to enter a code sent to one of their devices before they can log in, which is common and low-cost to implement but can circumvent the security offered due to a lost device; (c) context-based authentication, which relies on information about the device and user location (any log attempt from a new location or device is notified to the account holder); (d) biometric authentication, which relies on the unique biological characteristics of an individual to verify his/her identity (e.g., fingerprints, voice and face), which are difficult to fake but requires specialised scanning equipment; and (e) third-party authentication, in which the identity of an entity is verified by a third-party. Some examples are Certificate Authorities in the case of the X.509 digital certificate associated with digital signature, a cryptographic method that proves that data were signed by none other than the private key holder; OAuth [33] Authorisation Servers in the case of token-based authentication solutions; Google Authenticator [34] for the case of Google applications that implement a two-factor authentication mechanism; or a LDAP (Lightweight Directory Access Protocol) server. LDAP is a standard protocol that implements remote authentication through distributed directory information services. LDAP provides a central place to store usernames and passwords, which allows services to connect to the LDAP server (also known as Directory System Agent) to authenticate users and to check their role. LDAP is often the protocol of choice for many open source technical solutions, such as Docker, Kubernetes or Jenkins. Based on these alternatives, several authentication mechanisms are recommended in the system under study:  
* Communication channel A: due to its robustness and flexibility, the authors of this article suggest providing mutual authentication based on third-party mechanisms, for both users and the Mission Console. On the one hand, user authentication can be performed using LDAP, an especially suitable solution if you are looking for a centralised management of user information. OpenLDAP [35] is proposed as an open source solution to implement an LDAP server. In this case, the Mission Console acts as an LDAP client. If TLS is used to protect communication between LDAP clients and remote LDAP servers (LDAP over TLS), the exchange of user credentials remains encrypted. The process of user authentication begins with the user providing his/her credentials to the Mission Console, which validates username, password and role in the LDAP Server. If validation is successful, the user is granted access to the Mission Console, according to the assigned role. On the other hand, authentication of the Mission Console can be performed thanks to TLS and the X.509 certificate installed in the host. In the case under study, authentication can be implemented by the RSA algorithm provided by OpenSSL. When an operator (browser) sends an HTTPS request at connection setup, a TLS handshake takes place. The Mission Console responds with its certificate (containing its public key).