Authentication is the mechanism whereby systems may securely identify their users. Authentication systems provide an answers to the questions: * Who is the user? * Is the user really who he/she represents himself to be? Authentication can be based on classical password some physical property of the individual (fingerprint retinal vascularization pattern etc.) or some derived data (as in the case of so-called smartcard systems). Authorization by contrast is the mechanism by which a system determines what level of access a particular authenticated user should have to secured resources controlled by the system. For example a database management system might be designed so as to provide certain specified individuals with the ability to retrieve information from a database but not the ability to change data stored in the datbase while giving other individuals the ability to change data.
