Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A lecture slide mentioned methods of authentication, one of them being. Who the entity knows. But the lecturer said it was up to me to research it. I've Googled as hard as I can but to no avail :( I can't find an example or even a reference, the best I've come up with is something to do with background checks.

share|improve this question
    
Do you have a link to the presentation? Could you post presentation title and or presenter's name? –  this.josh Aug 27 '11 at 18:38
    
could you give more details about where you saw it ? –  woliveirajr Aug 29 '11 at 12:14

4 Answers 4

A Google search for authentication "who the entity knows" returns a few hits. Here's one PDF:

http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.93.2471&rep=rep1&type=pdf

Fourth-Factor Authentication: Somebody You Know

ABSTRACT User authentication in computing systems traditionally depends on three factors: something you have (e.g., a hard-ware token), something you are (e.g., a fingerprint), and something you know (e.g., a password). In this paper, we explore a fourth factor, the social network of the user, that is, somebody you know.

Human authentication through mutual acquaintance is an age-old practice. In the arena of computer security, it plays roles in privilege delegation, peer-level certification, help-desk assistance, and reputation networks. As a direct means of logical authentication, though, the reliance of human being on another has little supporting scientific literature or practice.

In this paper, we explore the notion of vouching, that is, peer-level, human-intermediated authentication for access control. We explore its use in emergency authentication, when primary authenticators like passwords or hardware tokens become unavailable. We describe a practical, prototype vouching system based on SecurID, a popular hardware authentication token. We address traditional, cryptographic security requirements, but also consider questions of social engineering and user behavior.

share|improve this answer
    
I loathe PDF; especially pasting text from PDF to anywhere. Anyone know any useful way of doing that without weird line breaks? –  DanBeale Aug 27 '11 at 17:54
1  
You might try ctrl+shift+v when you paste - it pastes without formatting. –  johsephm Aug 28 '11 at 2:32

See "It's Not What You Know, But Who You Know" (by Stuart Schecter, Serge Egelman, and Robert W. Reeder, published at CHI 2009) for one research paper on the subject. They propose that each user may select "trustees" who they trust. If the user forgets their password, the trustees can help them recover access to their account.

share|improve this answer

I bet that what they are trying to refer to is a web of trust system. That is usually referred to in the context of trusting public encryption keys. A quick Google search also shows a tool for vetting websites that works in a similar theory.

In these networks, trust is derived from apparent consensus from the community or by a chain that leads back to individuals that you trust. If people are verified by others you are connected to, or by a large enough portion of the community, you get a sense of trust even without knowing that person. That may be because your good friend Alice says that Bob (or Bob's key) is good.

See http://en.wikipedia.org/wiki/Web_of_trust

share|improve this answer
    
Keep your friends close, but your enemies closer. –  Dog eat cat world Aug 27 '11 at 12:32

That's an interesting one. Normaly authentication is performed by either: a) Something you know (password) b) Something you have (token) c) Something you are (biometrics)

Perhaps your lecturer was talking about reputation-based systems, like ebay and p2p networks? Not a direct authentication mechanism, but it has similar properties.

share|improve this answer
1  
Or maybe web of trust? –  Nam Nguyen Aug 27 '11 at 11:58
    
same thing imho :-) –  chris Aug 27 '11 at 17:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.