The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the paradigm. Can anyone shed some light on this?
The origin of three-factor authentication paradig is unknown, but one thing is for certain: it predates mankind. Controversial? Let's see. Ask yourself, how does e.g. a father gorilla recognize a newborn cub as being one of his offspring, even if its mom is not around? By something it has - a smell of its mom. Something it knows - the distress call. Something it is - a newborn gorilla cub. So, we have a newborn gorilla cub that's calling in distress the way gorilla cubs do, and smells of its mom, the way she did when father gorilla mated with her. That's a three-form authentication, and as far as nature is concerned - it's good enough. Does it predate gorillas? Sure. Any animal species that exhibit certain amount of social responsibility, and/or their behavioral patterns dictate the need for such identification of its members would - by this necessity alone - have similar methods in place. Or such goes the Darwinian explanation.
But what about its etymology, the origins of this phrase as us humans use it? The answer is, that we don't know for sure who exactly coined this phrase first, or indeed when. The phrase describing this method of authentication was probably changed many times throughout history, but its modus operandi remained the same. One example of three-form authentication - that would be used in early days of our civilization - would have been in use with military couriers, or diplomatic envoys. Their messages would face authentication scrutiny that is sufficiently confirmed by a three-form authentication. Messengers would be required to know something (password), have something (a recognizable seal) and be something (e.g. a member of some tribe), before they would be allowed to deliver their message to its intended recipient. I believe it's relatively safe to assume, that we do have historical records of such authentication methods being used, that they were described by various names, and that we can not tell with any degree of certainty who could hold a claim to its first use.