Who Goes There? : Authentication Through the Lens of Privacy

by Kent, Stephen T.; Millett, Lynette I.

• ISBN13: 9780309088961
• ISBN10: 0309088968
• Format: Paperback
• Copyright: 2003-10-01
• Publisher: Natl Academy Pr

Summary

Who Goes There?: Authentication Through the Lens of Privacyexplores authentication technologies (passwords, PKI, biometrics, etc.) and their implications for the privacy of the individuals being authenticated. As authentication becomes ever more ubiquitous, understanding its interplay with privacy is vital. The report examines numerous concepts, including authentication, authorization, identification, privacy, and security. It provides a framework to guide thinking about these issues when deciding whether and how to use authentication in a particular context. The book explains how privacy is affected by system design decisions. It also describes governmentrs"s unique role in authentication and what this means for how government can use authentication with minimal invasions of privacy. In addition, Who Goes There?outlines usability and security considerations and provides a primer on privacy law and policy.

Table of Contents

EXECUTIVE SUMMARY	1	(15)
1 INTRODUCTION AND OVERVIEW	16	(17)
Definitions and Terminology,	18	(3)
Authentication in Daily Life,	21	(7)
Current Tensions,	28	(6)
Four Overarching Privacy Concerns,	34
What This Report Does and Does Not Do,	31	(2)
2 AUTHENTICATION IN THE ABSTRACT	33	(22)
What Is Authentication and Why Is It Done?,	33	(8)
Three Parties to Authentication,	36	(1)
Authenticating to Authorize,	37	(1)
Authenticating to Hold Accountable,	38	(3)
What Do We Authenticate?,	41	(4)
Identifiers,	42	(1)
Attributes,	43	(1)
Statements,	44	(1)
How Do We Authenticate?,	45	(5)
Authenticating Physical Identity,	47	(1)
Authenticating Psychological Identity,	47	(2)
Authenticating Possession of an Artifact,	49	(1)
Identification,	50	(1)
The Relationship Between Authentication and Identification,	51	(4)
3 PRIVACY CHALLENGES IN AUTHENTICATION SYSTEMS	55	(25)
Privacy Impact of the Decision to Authenticate,	56	(1)
Access Control and Information Systems,	57	(5)
The Legal Foundations of Privacy,	62	(9)
Constitutional Roots of Privacy,	63	(5)
The Common Law Roots of Privacy Law,	68	(1)
Statutory Privacy Protections,	69	(2)
Information Privacy and Fair Information Practices,	71	(4)
Privacy of Communications,	75	(3)
Concluding Remarks,	78	(2)
4 SECURITY AND USABILITY	80	(24)
Threat Models,	81	(5)
Threats,	81	(3)
Dealing with Threats,	84	(2)
Authentication and People-User-Centered Design,	86	(9)
Lessons from User-Centered Design,	87	(3)
Lessons from Cognitive and Social Psychology,	90	(5)
Factors Behind the Technology Choice,	95	(2)
Systems and Secondary Use,	97	(4)
Concluding Remarks,	101	(3)
5 AUTHENTICATION TECHNOLOGIES	104	(34)
Technological Flavors of Authentication,	104	(2)
Basic Types of Authentication Mechanisms,	106	(17)
Something You Know,	107	(3)
Something You Have,	110	(10)
Something You Are,	120	(3)
Multifactor Authentication,	123	(2)
Centralized Versus Decentralized Authentication Systems,	125	(7)
Security Considerations for Individual Authentication Technologies,	132	(3)
Cost Considerations for Individual Authentication Technologies,	135	(1)
Concluding Remarks,	136	(2)
6 AUTHENTICATION, PRIVACY, AND THE ROLES OF GOVERNMENT	138	(41)
Regulator of Private Sector and Public Agency Behaviors and Processes,	140	(15)
Government-wide Law and Policy,	141	(4)
Agency- or Program-Specific Law and Policies,	145	(4)
Regulation of Private Sector Information Management Activity,	149	(2)
Policy Activity in the Early 2000's,	151	(4)
Summary,	155	(1)
Government as Issuer of Identity Documents,	155	(14)
The Tangled Web of Government-Issued Identity Documents,	162	(3)
Threats to Foundational Documents,	165	(4)
Government as Relying Party for Authentication Services,	169	(7)
Access Certificates for Electronic Services,	170	(2)
The Internal Revenue Service-Electronic Tax Filing,	172	(3)
The Social Security Administration and PEBES,	175	(1)
Nationwide Identity Systems,	176	(1)
Concluding Remarks,	177	(2)
7 A TOOLKIT FOR PRIVACY IN THE CONTEXT OF AUTHENTICATION	179	(18)
Privacy-Impact Toolkit,	181	(11)
Attribute Choice,	182	(4)
Identifier Selection,	186	(3)
Identity Selection,	189	(1)
The Authentication Phase,	190	(2)
Concluding Remarks,	192	(5)
APPENDIXES
A Biographies of Committee Members and Staff	197	(10)
B Briefers to the Study Committee	207	(2)
C Some Key Concepts	209	(4)
What Is CSTB?	213