Privacy by Design in Federated Identity Management

Abstract

Identity federations operating in a business or consumer context need to prevent the collection of user data across trust service providers for legal and business case reasons. Legal reasons are given by data protection legislation such as [1].Other reasons include business owners becoming increasingly aware of confidentiality risks that go beyond traditional information security, e.g., the numbers of authentications to an EDI service might provide insights into the volume of invoices, from which one could derive insider information. This paper proposes extended technical controls supporting three privacy requirements: a) Limited Linkability: Two service providers cannot link data related to a user without the help of a third party, using neither an identifier nor other identifying attributes like email addresses or payment data; b) Limited Observability: An identity provider cannot trace which services a user is using without the help of a third party; c) Non-Disclosure: Attributes provided to the service provider by an attribute provider are not disclosed to the identity provider or an intermediate service broker.Using a hub-and-spoke federation style following the privacy-by-design principle, this reference architecture addresses the privacy controls mentioned above.

Identity Assurance in the UK: technical implementation and legal implications under eIDAS

“…This is an important inclusion, since concepts of privacy protection have been traditionally absent from UK common law. 24 The DPA does not include all provisions of the EU Data Protection Directive and many passages have been kept purposefully vague. As with many UK policies, it is a principle-based policy, focusing on a goal oriented approach to data protection rather than details on how to achieve it [43]; instead the Act gets supplemented by explanations on practical applications from the Information Commissioner.…”

“…Selective disclosure, which can be viewed as a complimentary principle, refers to the disclosure of only the minimum necessary data for the stated purpose [13,35]. 7 Similarly, storage locations affect the risk of data breaches [24]. Traditionally, eID architectures revolved around a central entity that served as an Identity Provider to multiple Service Providers.…”

Bringing Federated Identity to Grid Computing

“…GUMS has a mapping logic that associates VO attributes with a list of grid resources, UNIX user accounts on these resources and location of files. It provides better control and security for access to the site's grid resources 12 . At FNAL, when a job submission is accepted, Jobsub Server sends a mapping request to the Fermilab GUMS Authorization server.…”

“…As we accept these new Identity Providers into our ecosystem, we will closely examine their operational security practices such as how they operate their Identity Provider systems, how they monitor for incidents and how quickly they can detect credential compromise and notify us. A thorough discussion of risks in trust federations is presented in [12,13] and will be included in our evaluation of new IdPs. Our new model shifts some of the security responsibility beyond Fermilab's control, but the user's home institution has a closer relationship with the user and should be able to detect and respond in the event of an compromise of a user's authentication credentials.…”

Future Challenging Issues in Location based Services

“…And trust include privacy with a) Application-level confidentiality and integrity aspects, example, for content that is owned by the relying party or third parties. b) Protection against attacks on components that are not related to identity management [25].…”