I would like to have/develop an application to quantify the strength of authentication in a user-centric manner. Semantic annotation might provide the flexibility and abstraction to reflect common user's perspective on authenticity. I haven't found any ontology that does more than reflecting this or the other credential format, but nothing that could be used for Better-Than-Nothing Security or scalable validity.
Anybody with a background in semantic technologies can recommend something?
Update: By semantic annotation I refer to expressions similar to RDF (with extensions to embed RDF-notation in other documents) or topic maps, as well as related ontologies to define (semantical) relations between concepts. The idea is to provide languages of concepts that reflect the internal model of users but also allow computational operations for evaluation, inference and enhancement. There are quite impressive list filled with ontologies, for example the linked open vocabularies [see links below], but none that I found provides a generic formalisation of authenticity.
http://lov.okfn.org
Can you give any references to what you mean by "semantic annotation" or prior art in this work ?
Its totally above my head , i could not correlate between "strength of authenticity in a user-centric manner" and semantic annotation ? What does strength of authenticity mean ? as in strength of passwords ? etc?
Hello Sashank,
thanks for your input, it makes me aware of needed clarification.
Authentication in communication, i.e. Human2Human, is based on authentication of Machine2Machine and Human2Machine, for which we use different methods. But most of the methods involve some kind of authentication anchor to be known as valid by the verifier. Examples are password-hashes (and their relation to identifiers) as well as cryptographic keys (often stored/exchanged in certificates/credentials). The strength of authentication depends on the protocol/algorithm used to verify the connection between the prover and on the validity of the authentication anchor. Commonly we mostly employ a boolean metric to quantify the strength of authentication. (Or at best, we have employed metrics based on the length or quality of trust paths.) I like to change that towards more generic, more open metrics that are related to the way users experience authenticity.
In the context of privacy, I've been using a taxonomy ranging from "unauthenticated" to "proven" depending upon the degree of authentication that has been provided by some data subject (user).
So, if we consider systems where users just visit, e.g.: web pages, then typically they are unauthenticated; we could increase this to "observed" if we have some notion of who they might be to some degree, such as identification by IP address. If they log in to the system then we might say they are "authenticated" by some authority and can guarantee their identity. Beyond this we can have categories for two factor authentication and for KYC scenarios used by banks when creating accounts.
Of course any ontology in this area is going to have to be linked with other notions such as the provenance of the data and so on.
Have you formally described that taxonomy? Because, we could probably discuss the value of quasi-identifiers and multi-channel identification for authentication.
- Badges
- Science method
- Similar topics
- Mathematics
- Statistics
- Statistical Techniques
- Meta-Analysis