[转载]Medina: Combining Evidence to Build Trust

文章作者：Johannes Helander and Benjamin Zorn
原始出处：http://seclab.cs.rice.edu/w2sp/2007/

本文章是Web 2.0 Security & Privacy 2007大会议题。

Abstract
Security mechanisms require °exibility to accommodate the frailties of the imperfect people that use them. For example, password systems typically allow users who forget their passwords to reset their password after passing some other test. More generally, many human decisions of trust are based on weighing a preponderance of evidence in an ad hocfashion. We present Medina, an authentication system based on combining various forms of evidence in a computational framework. Medina assumes that all authorization decisions are based on weighing a variety of evidence and brings elements of security (such as what happens when someone forgets their password) into a computational framework. Medina also allows for a range of access control policies that are less strict and/or more °exible than traditional security mechanisms.