Human-Centric and Privacy-Protecting Trust Establishment over the Internet

Abstract—Security needs to be human-centric if the human context and intent have to be known. Security mechanisms should be hidden whenever automation has all information it needs. In this paper, we present a human-centric, assisted trust establishment mechanism over the Internet. This mechanism expands our previous work that required a physical meeting to exchange identities (public keys) and to establish mutual trust. The goal is identification and authentication, which can then be used for authorization. The mechanism was designed to protect privacy while it utilizes existing trust relationships within small social groups to gain evidence of the trustworthiness of a claimed identity. Our technology is in particular suited for inter-connecting users and their home networks as well as for smart environments. Competing solutions with respect to trust modeling are the X.509 standard and the PGP (Pretty Good Privacy) web of trust, with respect to applications cloud computing and social networks like Facebook. Keywords–trust establishment, authentication, access control I