“Who the entity knows.” I've Googled for weeks and can't find results

Question

A lecture slide mentioned methods of authentication, one of them being. Who the entity knows. But the lecturer said it was up to me to research it. I've Googled as hard as I can but to no avail :( I can't find an example or even a reference, the best I've come up with is something to do with background checks.

Answer 1

A Google search for authentication "who the entity knows" returns a few hits. Here's one PDF:

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.93.2471&rep=rep1&type=pdf

Fourth-Factor Authentication: Somebody You Know

ABSTRACT User authentication in computing systems traditionally depends on three factors: something you have (e.g., a hard-ware token), something you are (e.g., a fingerprint), and something you know (e.g., a password). In this paper, we explore a fourth factor, the social network of the user, that is, somebody you know.

Human authentication through mutual acquaintance is an age-old practice. In the arena of computer security, it plays roles in privilege delegation, peer-level certification, help-desk assistance, and reputation networks. As a direct means of logical authentication, though, the reliance of human being on another has little supporting scientific literature or practice.

In this paper, we explore the notion of vouching, that is, peer-level, human-intermediated authentication for access control. We explore its use in emergency authentication, when primary authenticators like passwords or hardware tokens become unavailable. We describe a practical, prototype vouching system based on SecurID, a popular hardware authentication token. We address traditional, cryptographic security requirements, but also consider questions of social engineering and user behavior.

Answer 2

See "It's Not What You Know, But Who You Know" (by Stuart Schecter, Serge Egelman, and Robert W. Reeder, published at CHI 2009) for one research paper on the subject. They propose that each user may select "trustees" who they trust. If the user forgets their password, the trustees can help them recover access to their account.

Answer 3

I bet that what they are trying to refer to is a web of trust system. That is usually referred to in the context of trusting public encryption keys. A quick Google search also shows a tool for vetting websites that works in a similar theory.

In these networks, trust is derived from apparent consensus from the community or by a chain that leads back to individuals that you trust. If people are verified by others you are connected to, or by a large enough portion of the community, you get a sense of trust even without knowing that person. That may be because your good friend Alice says that Bob (or Bob's key) is good.

See http://en.wikipedia.org/wiki/Web_of_trust

Answer 4

That's an interesting one. Normaly authentication is performed by either: a) Something you know (password) b) Something you have (token) c) Something you are (biometrics)

Perhaps your lecturer was talking about reputation-based systems, like ebay and p2p networks? Not a direct authentication mechanism, but it has similar properties.