Identity federation and privacy: one step beyond

ABSTRACT

Providing Single Sign-On (SSO) between SPs and enabling SPs to share user personal attributes are critical for both users to benefit from a seamless access to their services, and SPs to realize new business opportunities. Today, however, the users have several independent, partial identities spread over different SPs. Providing SSO and attribute sharing requires that links (federations) are established between (partial) identities. In Liberty and SAML, the links between identities are stored and managed at the network side by the IdPs (network-side identity federation). This model prevents the SPs from mass-correlating the partial identities they have, but the users must fully trust the IdPs. In this paper, we propose a complementary approach where the users have a full control of the links between the partial identities. This client-side identity federation approach relies on the introduction of a new cryptographic tool, called invariable partially blind signature scheme, that may be of independent interest.

REFERENCES

• 1: Masayuki Abe, A Secure Three-Move Blind Signature Scheme for Polynomially Many Signatures, Proceedings of the International Conference on the Theory and Application of Cryptographic Techniques: Advances in Cryptology, p.136-151, May 06-10, 2001
• 2: Liberty Alliance. http://www.projectliberty.org/.
• 3: Stefan A. Brands, An Efficient Off-line Electronic Cash System Based On The Representation Problem., CWI (Centre for Mathematics and Computer Science), Amsterdam, The Netherlands, 1993
• 4: Jan Camenisch, Jean-Marc Piveteau, and Markus Stadler. Blind signatures based on the discrete logarithm problem. In EUROCRYPT'94, pages 428--432, 1994.
• 5: CardSpace. http://netfx3.com/content/windowscardspacehome.aspx.
• 6: David Chaum. Blind signatures for untraceable payments. In CRYPTO, pages 199-203, 1982.
• 7: David Chaum. Blind signature system. In CRYPTO, page 153, 1983.
• 8: David Chaum , Torben P. Pedersen, Wallet Databases with Observers, Proceedings of the 12th Annual International Cryptology Conference on Advances in Cryptology, p.89-105, August 16-20, 1992
• 9: Amos Fiat , Adi Shamir, How to prove yourself: practical solutions to identification and signature problems, Proceedings on Advances in cryptology---CRYPTO '86, p.186-194, January 1987, Santa Barbara, California, United States
• 10: E. Maler, P. Mishra, and R. Philpott. Assertions and protocol for the oasis security assertion markup language (saml). OASIS Standard, September 2003.
• 11: OpenID. http://openid.net/.
• 12: Claus-Peter Schnorr, Efficient Identification and Signatures for Smart Cards, Proceedings of the 9th Annual International Cryptology Conference on Advances in Cryptology, p.239-252, August 20-24, 1989

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.4 INFORMATION SYSTEMS APPLICATIONS
      H.4.3 Communications Applications

Additional Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Authentication

General Terms:
Algorithms, Design, Security

Keywords:
cryptography, identity federation, identity management, privacy, user centric