Sobriquet : a personal naming and identity management system

Abstract

The Internet in its current form lacks an adequate identity infrastructure. Every rel- evant application must provide its own solution to the problem of authenticating and naming people. Many of these applications share common goals and duplicate this functionality. Compounding the problem is that for every application a person uses they acquire a new identifier and set of authentication credentials. In some cases people come to depend on these names to be reachable online. When these identifiers change or become unavailable people lose contact with one another. The reliance on these identifiers also encourages provider lock-in. Regulators of the telephone system realised some time ago that mobility of identifiers is important as a means of encouraging competition between providers. Yet on the Internet no system exists to provide this functionality. The lack of a means to authenticate people on the Internet means that people often communicate with one another insecurely; without the ability to know for sure who they are communicating with and having no means to ensure the confidentiality of their communications. Public Key Infrastructures were once thought to be the solution to this problem, but have so far failed to live up to this promise. They are costly to maintain and are not suitable for all applications where authentication is required. The area of identity management has sought to rectify the authentication problem in recent years, but generally ignores the identifier mobility issue. In our solution, Sobriquet, we propose a global naming system for people that allows for identifier mobility, and an identity management system that aims to provide a means of authenticating people. Our solution recognises that there is in all likelihood no general solution to the problem of authenticating people. We propose a system of authentication we call "history based authentication" that authenticates a person as being the same individual as was present in a previous communications session. Authentication happens with respect to an identifier, and the history of interactions an entity has with the person that identifier represents influences the notions of identity that this entity ascribes to that identifier. We argue that this is an adequate level of authentication for many types of online interactions. Our solution also addresses the issue of bootstrapping trust between people who have never met. We do this by reducing the economic incentives for people to engage in undesirable behaviour.