THE ADRIAN STORY
|
Phil Becker 08.31.2006 today Adrian 1 Adrian
Adrian's new car doesn't have a "car key" but rather has an RFID encrypted, rolling code "fob". In fact, his wife also has a fob for their shared car which has a different code. Adrian walks out to his car, and as his hand reaches for the door handle a proximity sensor recognizes he's trying to open the door. The car's computer has already authenticated the RFID code from the fob in his pocket, so the car beeps gently and the door opens when Adrian pulls the handle -- as though it were never locked.
At the same time,
|
Roland Sassen 08.31.2006 tomorrow Adrian 2 Adrian
At the same time,
Adrian resumes his drive, but as he passes the donut
shop, decides he needs some sugar and caffeine to get his day going. He
pulls in and gets out of his car -- and by getting out, the car responds
with two beeps, Part of Adrian's route to work has him driving on a toll road. As he drives
through the toll booth area, his HEARTBEAT-ID watch is read, Adrian finally arrives at the office. Entering the
parking garage, There are no local data, so no malware. When it has
powered up, Adrian´s HEARTBEAT-ID watch logs him into his HEARTBEAT-ID
personal portal. |
| original | heartbeat-id scanner heartbeat-id secure portal thinsia |
Identities are all things with a name, this includes people.
A identification is the decision (by another identity) to believe that this
identity is what it looks like here and now. This decision can be correct or
not.
You said:” the only true identity based authentication technologies available
are biometric.”
I would like to put it this way:
Authentication is deciding thst a person is really the person with that name
and context / history. This can only be achieved with biometrics.
This decision can by definition not be a false one. It is, however, possible
that the decision cannot be made.
Would it be possible to make a false authentication decision, than we would
not need authentication at all, because there would be no difference between
authentication and identification.
Authorization is making a list with identities and actions, and store this
list at the place of an identity.
Identification, authentication and authorization now map to things, persons
and lists.
So let’s have a look at Adrian, walking to his car.
The car’s computer has authenticated the RFID code from Adrian’s fob.
In my words:
At the garage, some person authorized Adrian by putting his RFID code in the
list of the computer.
The car’s computer identificated the RFID code by looking in the list.
The computer then performs the actions defined in the list, and Adrian gets
access to his car.
In the whole Adrian story there is no authorizing action, one authentication
action and all other actions are identifications!
Adrian yesterday asked his friend: why do I have to have a RFID fob,
ATM Card, money, RFID EZ-Pass, license plate, credit card, smartcard ID badge,
fingerprint sensor, Trusted computing chip, federated identity
just to do one thing: being myself?? And why if I want to change the
authorisation list of any of these things, I have to go to so many different
places?
His friend, his name is Adrian 2, answered him: here, try my watch!