The OLYMPUS Architecture—Oblivious Identity Management for Private User-Friendly Services

Abstract

Privacy enhancing technologies (PETs) allow to achieve user’s transactions unlinkability across different online Service Providers. However, current PETs fail to guarantee unlinkability against the Identity Provider (IdP), which becomes a single point of failure in terms of privacy and security, and therefore, might impersonate its users. To address this issue, OLYMPUS EU project establishes an interoperable framework of technologies for a distributed privacy-preserving identity management based on cryptographic techniques that can be applied both to online and offline scenarios. Namely, distributed cryptographic techniques based on threshold cryptography are used to split up the role of the Identity Provider (IdP) into several authorities so that a single entity is not able to impersonate or track its users. The architecture leverages PET technologies, such as distributed threshold-based signatures and privacy attribute-based credentials (p-ABC), so that the signed tokens and the ABC credentials are managed in a distributed way by several IdPs. This paper describes the Olympus architecture, including its associated requirements, the main building blocks and processes, as well as the associated use cases. In addition, the paper shows how the Olympus oblivious architecture can be used to achieve privacy-preserving M2M offline transactions between IoT devices.

Investigations in Security Challenges and Solutions for M2M Communications—A Review

“…Authentication focuses on controlling device access to applications and network domains, ensuring that only authorized users can access paper-sensitive data [124]. The security system must verify the parties identity and verify they are who they claim to be [125]. These security rules are the basis for generating security information in M2M communication.…”

Privacy-Preserving Identity Management and Applications to Academic Degree Verification

“…The ecosystem of the OLYMPUS identity management system (overview in Figure 4, more details in [32]) involves three main participants: the virtual Identity Provider (vIdP), the user client and the relying party (RP).…”

“…The most widely known solutions are Microsoft's UProve [6,25] and IBM's Identity Mixer [7,9,10]. However, a large body of related work has been carried out over the last decades, including formal frameworks for ABCs [8], schemes allowing users to anonymously delegate parts of their rights to other users [2,3,11,14], issuer-hiding credential schemes allowing user to remain anonymous across multiple issuers [4], ABC systems with distributed issuers [18,32], ABCs bound to hardware tokens [1], cloud-based ABCs [21,23], or distance-bounding schemes [5].…”

Distributed Cryptographic Protocols

“…Due to the complexity and importance of their function, IdMs are typically backed by government or official institutions. In Moreno et al [2019], Moreno et al present an IdMs based on PASTA that provides unlinkability through distributed identity providers and biometric identifica-tion. In Bernabé et al [2020], Bernabe et al evaluate ARIES, an European IdMs that also includes ID-proofing based on biometrics and breeder documents handling within their framework.…”