Entity Authentication and Trust Validation in PKI Using Petname Systems

Abstract

Recognition of identities and certainty about identity ownership are crucial factors for secure communication in digital environments. Identity Management Systems have been designed to aid users as well as organisations to manage different user identities. However, traditional Identity Management Systems are primarily designed to facilitate the management of identities from the perspective of the service provider, but provide little support on the user side to manage organisational identities. Public Key Infrastructures (PKI) is the primary tool in aiding users to manage such identities on their sides as well as to establish trust during online transactions. Nevertheless, the complexities and difficulties involved in managing and understanding such certificates from the general public’s point of view are overlooked. This causes vulnerabilities that open up for serious attacks such as identity theft and Phishing. Petname Systems have been proposed for managing organisational identities on the user side in order to improve the user friendliness and to strengthen security. This chapter provides an analysis of the Petname Model by describing its history and background, properties, application domains, and usability issues, and explains how a Petname System can be effectively combined with the PKI to recognise identities and impose certainty by validating the user trust on those identities. The chapter also presents an analysis on two applications that integrate the Public Key Infrastructure with the Petname Model.

Identity management and trusted interaction in Internet and mobile computing

“…An essential component of identity management is the namespace of unique names, which ideally should be global and memorable. Unfortunately, no namespace can be designed where names are unique, global and memorable simultaneously, which is one of the main challenges in identity management [6]. The legal name of a person or organisation is usually not unique, in which case it cannot be used to uniquely identify a person or organisation.…”

“…The triangle of Fig. 11 where each of the three desirable properties of names are placed in one of the corners is commonly known as Zooko's triangle, and represents the basic foundation for the Petname Model [6, 42].…”

“…By using a petname system this type of confusion – and phishing attack – is avoided through enabling manual trust evaluation by the user while the transition takes place [6, 46]. More specifically, a petname system in combination with, for example, TLS can provide cognitive server authentication, which is precisely the security service needed to prevent phishing attacks.…”