Authentication and Authorization are two similar terms that are often confused. The difference is as follows - authentication is a method by which
users are verified to be who they say they are, by passwords or other means, whereas authorization is a process by which an authenticated person is
allowed certain access to the system, via password or other means. Authentication and authorization are important for the users of timekeeping
software, because recent attacks against several Internet sites engaged in electronic commerce have raised concerns about the security of the NIST
time servers and the authenticity of the messages they transmit. In particular, there are two concerns time server clients have - (1) that the time
messages that they receive from time servers really came from NIST and not from some third-party attempting to hoax the system and (2) that the client
software provide an audit trail that can be used to verify compliance with legal requirements. To address this issue, NIST (National Institute of
Standards and Technology) has implemented a new program - Authentication and Certification of NIST Internet Time Signals. Different authentication
and authorization methods are also used by other network protocols associated with network timekeeping software - NTP (Network Time Protocol), SNMP
(Simple Network Management Protocol) and HTTP (Hyper Text Transfer Protocol).