## 2 The Home Network as The Universal Center of Reference
### Building up Trust between Home Networks  
Networked homes are a very dynamic environment: new devices become part of a home, keys change, users lose their keying material and need to establish it again etc. We have already emphasized the control that users should have over their infrastructure. We will now show that it is possible to provide them with means to reflect the level and change of social relationships while providing a good level of security. Our approach is built on a protocol that we have described in formal terms in [11]. The protocol--Peer Domain Protocol Authentication (PDP-A)--is a four-party authentication protocol with key establishment for domain-structured systems. Authentication servers of a domain aid their clients by participating in the authentication process. Their task is two-fold: firstly, they establish contact to other domains and store information about them, and secondly, they provide their clients with relevant information during the authentication run to aid in the authentication decision. Where two servers have a strong preexisting security association, their clients can authenticate to each other at the same level of assurance. In our scenario, the Home CAs also act as the Authentication Servers. PDP-A allows to carry additional information between the Home CAs and the client entities. This can aid in building additional trust between home networks, which is useful in determining access rights in a semi-automated way. We explain this by three examples. We consider the case of two devices from different home networks wishing to authenticate to each other. **Keys exchanged between domains** We have shown in Section 2.3 how two devices or entities can exchange their Home CAs' public keys. Once this has happened, authentication between other entities of the same home networks benefits from the information that PDP-A conveys to the users: the other entity is known to belong to a domain to which a high level of assurance exists. Access rights can be set immediately in this case (although the user should probably still confirm first). **No keys exchanged between domains, but ISP assurance** The situation is slightly different where two domains have not had previous contact, and Home CAs' keys have not been exchanged, but ISPs  
Figure 3: Home CAs obtain their certificate from a trusted CA provided by the home network’s ISP. An implicit path-of-trust between many home networks exists now that can be used to authenticate home networks and entities within. have signed the certificates. In this case, the authentication would be based on the thus established certification chain. PDP-A would signal the different (lower) level of assurance to the user and access rights can be automatically set to be more restrictive. The user can then communicate with the other entity, making use of the authentication and the established encryption. If he believes the other entity to be authentic or otherwise trustworthy, he can still correct the access rights later. **No previous contact between domains, no ISP assurance** In this situation, no keys have been exchanged between the home networks and no certification chain via ISP certificates can be found. PDP-A would in this case conduct a first key exchange between domains, but warn the user that the communication is not authenticated and fraud might be possible. The user can either stop the authentication process or continue with it and allow communication to happen (with no access rights set). If he becomes convinced of the other entity's trustworthiness or authenticity (for example, because communication was by VoIP), he can set access rights. In this case, a certain (very low) level of assurance would also be set for the other domain. This information will be stored on the home network server and be re-used in later authentication processes with other entities from that domain.