Bayesian Identity Proofing - Revision history

Tom: /* Works Cited */

2025-05-29T00:00:55Z

‎Works Cited

Tom: /* Author */

2023-05-26T22:40:16Z

‎Author

Tom: /* Works Cited */

2019-08-29T21:22:58Z

‎Works Cited

Tom: /* Author */

2019-01-06T21:07:12Z

‎Author

Tom: /* Author */

2019-01-06T21:05:30Z

‎Author

Tom: /* Works Cited */

2019-01-06T21:04:16Z

‎Works Cited

Tom: /* Author */

2018-12-27T07:53:36Z

‎Author

Tom: /* Author */

2018-12-27T07:50:29Z

‎Author

Tom: /* Works Cited */

2018-09-05T04:31:50Z

‎Works Cited

Tom: /* Author */

2018-08-14T03:04:45Z

‎Author

@@ Line 65: / Line 65: @@
 [[Category:Authentication]]
 [[Category:Identity Proofing]]
 [[Category:Article]]
 [[Category:Assurance]]

@@ Line 59: / Line 59: @@
 Machine learning has been focused on the individual machine faced with a fairly constant problem to solve. That that is not the way human learning works. People’s problem set varying over time and they work in a group with other people to solve problems. Then the solution is passed from one person to another and from one generation to the next. Given the constantly changing environment in which people need to be identified during their varying activities and problem sets, any identity ecosystem must be able to accept inputs asynchronously and to share what they have learned with other systems and other generations of systems. Even more importantly the identity ecosystem must be able to report problems that it has not been able to resolve so that new solution designs can be sought. Two specific ecosystems come to mind where a common identity solution is not possible is the medical ecosystem and the governmental ecosystem even within one federal system like the (partially) United States.
-Privacy has not be addressed here-to-fore, but will be critical to the acceptance of an identity ecosystem. In the body of this paper the case for specialized authenticators has been repeatedly emphasized. Privacy is yet one more reason for limiting user attribute collection to a small number of organizations that are willing and able to protect those attributes. That will at least serve to make verification of privacy compliance more likely. Just like the “To big to fail” label on large financial institution, some sort of “To big to fail” label should be placed on any organization that collects and disseminates user data. Organizations that will not accept the label and the responsibility it carries should be proscribed from user data collection and dissemination.
+Privacy has not be addressed here-to-fore, but will be critical to the acceptance of an identity ecosystem. In the body of this paper the case for specialized authenticators has been repeatedly emphasized. Privacy is yet one more reason for limiting user attribute collection to a small number of organizations that are willing and able to protect those attributes. That will at least serve to make verification of privacy compliance more likely. Just like the “To big to fail” label on large financial institution, some sort of “To big to fail” label should be placed on any organization that collects and disseminates user data. Organizations that will not accept the label and the [[Responsibility]] it carries should be proscribed from user data collection and dissemination.
 ==Works Cited==

@@ Line 65: / Line 65: @@
 [[Category:Authentication]]
 [[Category:Article]]
 [[Category:Assurance]]

@@ Line 48: / Line 48: @@
 However, the psychology of the level of protection is important in the sense that today users are known to choose passwords that are easy to guess. That makes password look-up tables widely used in attacks. Password complexity rules do help to reduce the occurrence of simple, easy-to-guess passwords, but at great cognitive load on the user. In order to discourage attackers, they should believe that password guessing is not likely to succeed. That does put some burden on the authentication sites to screen out “bad” passwords, whatever that might mean. One approach is to scan the dark web for such tables and use those tables to screen password selection. Another approach would be to find authentication methods that avoid user remembered secrets altogether. That approach would certainly lower the cognitive load on the user.  However, that approach has been tried in the past without much success. In the case of web sites where only a small level of assurance is required, password are not likely to be supplanted.
-The last point to consider is the collection of multiple authentication “events” to increase the trustworthiness of the identity. Given that if the authentication site chosen by the [[Web Site]] has trustworthy security, random attacks against it are unlikely as the likelihood of success is low. In that case the best authentication “events” are those with low probability of success (that is when the '''t''' in '''P<sub>c</sub>'''/'''t''' is low.) That is a mathematical way of saying that the most information is carried in messages that are the most hard to predict or “surprising”. Currently sites use multiple attributes as increasing the probability that an identification is trustworthy. Getting a sequence of data that has all been released (for example) in the Equifax breach, is not surprising. Since if the attacker has the password, they likely have the other user attributes as well. Several sites, including NIST promote the concept of Knowledge Based Authentication<ref> Hastings, N. E. Quantifying Assurance of Knowledge Based Authentication . Proceedings of the 3rd European Conference on Information Warfare and Security. 2004</ref> which is just such a collection. Where such knowledge attributes are reused they, like one-time pads, lose their value when any sort of leakage occurs. In other words, the first factor in multifactor identification, “What you know” may continue to work for low assurance identification, but it is inadequate for high levels.
+The last point to consider is the collection of multiple authentication “events” to increase the trustworthiness of the identity. Given that if the authentication site chosen by the [[Web Site]] has trustworthy security, random attacks against it are unlikely as the likelihood of success is low. In that case the best authentication “events” are those with low probability of success (that is when the '''t''' in '''P<sub>c</sub>'''/'''t''' is low.) That is a mathematical way of saying that the most information is carried in messages that are the most hard to predict or “surprising”. Currently sites use multiple attributes as increasing the probability that an identification is trustworthy. Getting a sequence of data that has all been released (for example) in the Equifax breach, is not surprising. Since if the attacker has the password, they likely have the other user attributes as well. Several sites, including NIST promote the concept of Knowledge Based Authentication<ref>N. E. Hastings, ''Quantifying Assurance of Knowledge Based Authentication.'' Proceedings of the 3rd European Conference on Information Warfare and Security. 2004</ref> which is just such a collection. Where such knowledge attributes are reused they, like one-time pads, lose their value when any sort of leakage occurs. In other words, the first factor in multifactor identification, “What you know” may continue to work for low assurance identification, but it is inadequate for high levels.
 There are some attributes that remain hard for attackers to acquire and hence continue to have low probability of attack that will help proof identities. These attributes belong to the other factors of authentication: “What you have” and “What you are”. Extensive efforts at smart cards and biometrics have not been successful in broad deployments to-date because of the unacceptable load that they place on the user. It is imperative that new acceptable authentication factors are deployed. The most promising effort in “What you have” at this stage is to enable FIDO U2F.

@@ Line 10: / Line 10: @@
 In Deep Learning the breakthrough concept was back propagation.
-While most discussions about authentication of an identity treat it as a single event, the actual process of authentication of a user at a Web Site is a series of events, each emending the probability of sufficient knowledge of the identity to allow a test of sufficiency ot occur.<ref>Dean Jamison, Baysean Information Usage in Information and Inference p. 28-57 (1960) ISBN 90 277 0155 5</ref> While there are as many reasons to acquire knowledge of the user as there are web sites, we will look at one use case; the provisioning of a valuable digital resource to a user. The following list is one possible stream of events leading to the release of the resource to the user in the face of malicious parties seeking to acquire the asset without paying the price required. In this case the resource owner needs to know that claimant is not known to be in the business of illicit resource acquisition, which has previously been determined to be the greatest threat facing the resource owner.
+While most discussions about authentication of an identity treat it as a single event, the actual process of authentication of a user at a Web Site is a series of events, each emending the probability of sufficient knowledge of the identity to allow a test of sufficiency ot occur.<ref>Dean Jamison, ''Baysean Information Usage'' in Information and Inference. p. 28-57 (1960) ISBN 90 277 0155 5</ref> While there are as many reasons to acquire knowledge of the user as there are web sites, we will look at one use case; the provisioning of a valuable digital resource to a user. The following list is one possible stream of events leading to the release of the resource to the user in the face of malicious parties seeking to acquire the asset without paying the price required. In this case the resource owner needs to know that claimant is not known to be in the business of illicit resource acquisition, which has previously been determined to be the greatest threat facing the resource owner.
 #	The user contacts the Web Site and an HTTPS connection is established. The resource owner now knows the approximate location of the user and has an IP address that can be compared to an existing list of suspect IP addresses. Also the HTTPS connection assures the resource owner that the same user will be survive with this consistent connection identifier for the duration of the connection. (If a man-in-the-middle attack is in progress the “user” is the mitm.)
 #	The user selects a resource to be acquired after a period of browsing. The length of time and effort to get to the resource now known to the resource owner.

← Older revision		Revision as of 21:04, 6 January 2019
Line 66:		Line 66:
	[[Category:Authentication]]		[[Category:Authentication]]
	[[Category:Article]]		[[Category:Article]]
		+	[[Category:Assurance]]

← Older revision		Revision as of 04:31, 5 September 2018
Line 65:		Line 65:

	[[Category:Authentication]]		[[Category:Authentication]]
		+	[[Category:Article]]

@@ Line 38: / Line 38: @@
    '''P<sub>new</sub>''' = '''P<sub>old</sub>''' x '''P<sub>c</sub>''' / '''t'''.
-The entire change in the probability at each step is determined by the term Pc/t, so we need to understand the environment where this value is calculated. Simplistically if probability of e give the current value of Pold is not dependent on '''P<sub>old</sub>''', then the change term is 1 and there is no impact of that event on the new probability that the identity is trustworthy. Another way to put this is that the probability of the event occurring in the total population needs to be significantly lower than the probability of the event given the prior tests that went into the value of '''P<sub>old</sub>'''. Let’s consider the specific case of the correct entry of a password of complexity sufficient to make the probability of entering it correctly in 3 tries without knowing it to be .001, in other words, not very complex. If the probability of the user getting it wrong 3 time is a low is also .001, then the value of the entry of the correct entry password given the general population of 100 million is:
+The entire change in the probability at each step is determined by the term Pc/t, so we need to understand the environment where this value is calculated. Simplistically if probability of e give the current value of '''P<sub>old</sub>''' is not dependent on '''P<sub>old</sub>''', then the change term is 1 and there is no impact of that event on the new probability that the identity is trustworthy. Another way to put this is that the probability of the event occurring in the total population needs to be significantly lower than the probability of the event given the prior tests that went into the value of '''P<sub>old</sub>'''. Let’s consider the specific case of the correct entry of a password of complexity sufficient to make the probability of entering it correctly in 3 tries without knowing it to be .001, in other words, not very complex. If the probability of the user getting it wrong 3 time is a low is also .001, then the value of the entry of the correct entry password given the general population of 100 million is:
    '''P<sub>c</sub>'''/'''t''' = .999 / .001 or 999, applied to a 100 million (probability 1/100 million) then
    '''P<sub>new</sub>''' > .99999 pretty much independently of whatever '''P<sub>old</sub>''' might have been.