Privacy policies compliance across digital identity management systems

ABSTRACT

An emerging approach for protecting identities of individuals, while at the same time enhancing user convenience, is represented by federated identity management systems. In this paper we develop an approach to support privacy controlled sharing of identity attributes in federated environments. We present a wide range of strategies that enable users to trace their personal information across the federation and verify whether it has been managed according to their privacy preferences. Users can employ one or more of these strategies according to their goals and priorities. Additionally, we analyze the challenging issue of data, privacy policy, and preference updates in a federated system. Our algorithm allows users and federated service providers to control whether new versions of data and users' privacy references have been used, and detect possible inconsistencies.

REFERENCES

• 1: Gail-Joon Ahn , John Lam, Managing privacy preferences for federated identity management, Proceedings of the 2005 workshop on Digital identity management, November 11-11, 2005, Fairfax, VA, USA [doi>10.1145/1102486.1102492]
• 2: Gail-Joon Ahn , John Lam, Managing privacy preferences for federated identity management, Proceedings of the 2005 workshop on Digital identity management, November 11-11, 2005, Fairfax, VA, USA [doi>10.1145/1102486.1102492]
• 3: Franz Baader and Bernhard Hollunder. Embedding defaults into terminological knowledge representation formalisms. J. Autom. Reasoning, 14(1):149--180, 1995.
• 4: Abhilasha Bhargav-Spantzel , Jan Camenisch , Thomas Gross , Dieter Sommer, User centricity: A taxonomy and open issues, Journal of Computer Security, v.15 n.5, p.493-527, October 2007
• 5: Jan Camenisch, Thomas Gross, and Dieter Sommer. Enhancing privacy in identity federation anonymous credentials ensure unlinkability in ws-security. In IEEE Workshop on Web Services Security, 2006.
• 6: Lorrie Cranor, Marc Langheinrich, Massimo Marchiori, and J. Reagle.
• 7: Higgings. Open Source Initiative, http://www.eclipse.org/higgins, 2007.
• 8: http://www.zurich.ibm.com/security/enterpriseprivacy/epal/. EPAL 1.0 Specification.
• 9: IBM Tivoli Software. http://www-306.ibm.com/software/tivoli/, 2007.
• 10: Internet2. Shibboleth. http://shibboleth.internet2.edu.
• 11: Liberty Alliance Project. http://www.projectliberty.org.
• 12: Security Breaches at UCLA Medical Center More Privacy. http://www.privacy.org/archives/002241.html (accessed may 2008).
• 13: N. Noy and M. Musen. Using non-local context for semantic matching. In IJCAI 2001 workshop on ontology and information sharing, Seattle (WA US), pages 63--70, 2001.
• 14: P3P Preference Exchange Language 1.0 (APPEL1.0). http://www.w3.org/tr/p3p-preferences/.
• 15: Gurieth Karjoth Paul Ashley, Satoshi Hada and Matthias Schunter. E-P3P Privacy Policies and Privacy Authorization. In Proceedings of the Workshop on Privacy in the Electronic Society (WPES), 2001.
• 16: Samir Saklikar , Subir Saha, User privacy-preserving identity data dependencies, Proceedings of the second ACM workshop on Digital identity management, November 03-03, 2006, Alexandria, Virginia, USA [doi>10.1145/1179529.1179537]
• 17: Farzad Salim, Nicholas Paul Sheppard, and Reihaneh Safavi-Naini. Enforcing P3P policies using a digital rights management system. In Privacy Enhancing Technologies, pages 200--217, 2007.
• 18: SourceID: Open Source Federated Identity Management. http://www.sourceid.org/resources/basics.html.
• 19: Anna C. Squicciarini, Marco Casassa Mont, Abhilasha Bhargav-Spantzel, and Elisa Bertino. Automatic compliance verification of privacy policies in federated digital identity management. 2008.
• 20: Anna Cinzia Squicciarini, Abhilasha Bhargav-Spantzel, Alexei Czeskis, and Elisa Bertino. Traceable and automatic compliance of privacy policies in federated digital identity management. In Privacy Enhancing Technologies, pages 78--98, 2006.
• 21: OASIS Standard. Security assertion markup language (saml) v2.0, 2005.
• 22: Philip Sutton , Charles D. Hansen, Isosurface extraction in time-varying fields using a temporal branch-on-need tree (T-BON), Proceedings of the conference on Visualization '99: celebrating ten years, p.147-153, October 1999, San Francisco, California, United States
• 23: Cheryl Vroom and Rossouw von Solms. Towards information security behavioural compliance. Computers and Security, 23(3):191--198, May 2004.
• 24: Web Services Standard Listings. http://en.wikipedia.org/wiki/list_of_web_service_specifications, 2007.
• 25: Daniel J. Weitzner , Harold Abelson , Tim Berners-Lee , Joan Feigenbaum , James Hendler , Gerald Jay Sussman, Information accountability, Communications of the ACM, v.51 n.6, p.82-87, June 2008 [doi>10.1145/1349026.1349043]
• 26: K. Zhang , D. Shasha, Simple fast algorithms for the editing distance between trees and related problems, SIAM Journal on Computing, v.18 n.6, p.1245-1262, Dec. 1989 [doi>10.1137/0218082]

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Security

Keywords:
digital identity, privacy, tracing