Summary

Recommendation ITU-T X.1451 specifies a risk identification function in an information and communication technology (ICT) service system as a pre-processor before the authentication function is invoked. It enables the ICT service system to optimize user authentication based on identified risks.

With this specific risk identification function, the ICT service system can make choices on authentication mechanisms adaptively to its users and achieve multiple benefits such as: 1) to improve user experiences; 2) to increase the capacity and reduce the per transaction cost of user authentication; and 3) to reduce the risk of user identity forgery.

For ICT systems, user authentication is a critical security function. Various authentication mechanisms are available, but it may not be clear how to make the best choice from a number of options. Authentication of ICT services should strive to balance multiple functional objectives such as security, user experience, cost and performance.