Data security, which is concerned with the prevention of unauthorized access to computers, databases, and websites, helps protect digital privacy and ensure data integrity. It is extremely difficult, however, to make security watertight, and security breaches are not uncommon. The consequences of stolen credentials go well beyond the leakage of other types of information because they can further compromise other systems. This paper criticizes the practice of using clear-text identity attributes, such as Social Security or driver's license numbers -- which are in principle not even secret -- as acceptable authentication tokens or assertions of ownership, and proposes a simple protocol that straightforwardly applies public-key cryptography to make identity claims verifiable, even when they are issued remotely via the Internet. This protocol has the potential of elevating the business practices of credit providers, rental agencies, and other service companies that have hitherto exposed consumers to the risk of identity theft, to where identity theft becomes virtually impossible.
The concept of claims-based identity was pioneered by Cameron @cite_17 at Microsoft in the mid-2000s when he laid out seven laws'' of identity, which provide useful guidelines for the design of systems that cope with identity on the Internet. Cameron proposes a definition of identity in terms of claims rather than identifiers. With this definition, he shifts the paradigm from identifying individuals to proving the relationship between digital identity and real-world objects. By choosing the term claim'' instead of assertion,'' he emphasizes that this relationship is always imbued with some level of uncertainty, and could manifest itself as a potential weakness in any secure system. The protocol described in this paper implements the first four of Cameron's laws, which boil down to: user consent,'' minimal disclosure,'' justifiable use,'' and context isolation.'' The fifth law states that an identity system needs to allow for pluralism of operators and technologies, which the protocol also does, granted that it leaves the method for end-point authentication unspecified. The sixth and seventh laws are strictly concerned with user experience, which is entirely outside of the scope of this paper.
@cite_17
2807661999 1523091741 1993504803 2170075839
Digital identity is unsolved: after many years of research there is still no trusted communication over the Internet. To provide identity within the context of mutual distrust, this paper presents a blockchain-based digital identity solution. Without depending upon a single trusted third party, the proposed solution achieves passport-level legally valid identity. This solution for making identities Self-Sovereign, builds on a generic provable claim model for which attestations of truth from third parties need to be collected. The claim model is then shown to be both blockchain structure and proof method agnostic. Four different implementations in support of these two claim model properties are shown to offer sub-second performance for claim creation and claim verification. Through the properties of Self-Sovereign Identity, legally valid status and acceptable performance, our solution is considered to be fit for adoption by the general public. This paper is about how we can prevent the loss of trust and go forward to give Internet users a deep sense of safety, privacy, and certainty about whom they are relating to in cyberspace. Nothing could be more essential if Web-based services and applications are to continue to move beyond "cyber publication" and encompass all kinds of interaction and services. Our approach has been to develop a formal understanding of the dynamics causing digital identity systems to succeed or fail in various contexts, expressed as the Laws of Identity. Taken together, these laws define a unifying identity metasystem that can offer the Internet the identity layer it so obviously requires. Unique identification and secure authentication of users are essential processes in numerous security-critical areas such as e-Government, e-Banking, or e-Business. Therefore, many countries (particularly in Europe) have implemented national eID solutions within the past years. Such implementations are typically based on smart cards holding some certified collection of citizen attributes and hence follow a client-side and user-centric approach. However, most of the implementations only support all-or-nothing disclosure of citizen attributes and thus do not allow privacy-friendly selective disclosure of attributes. Consequently, the complete identity of the citizen (all attributes) are always revealed to identity providers and or service providers, respectively. In this paper, we propose a novel user-centric identification and authentication model for eIDs, which supports selective attribute disclosure but only requires minimal changes in the existing eID architecture. In addition, our approach allows service providers to keep their infrastructure nearly untouched. Latter is often an inhibitor for the use of privacy-preserving cryptography like anonymous credentials in such architectures. Furthermore, our model can easily be deployed in the public cloud as we do not require full trust in identity providers. This fully features the Identity as a Service-paradigm while at the same time preserves citizens' privacy. We demonstrate the applicability of our model by adopting to the Austrian eID system to our approach. Identification is central to information or content centric networking, in order to enable referencing and access to the information objects. In this work we focus on identifiers and the identification system as a target of a design process, because without careful attention to the identifiers themselves and the approaches to selecting, assigning and using them, they may not meet their design goals. The paper begins with an examination of key issues central to the design of an identification system. With those in mind, we discuss the objectives of pervasiveness and persistence as requirements for identification in an information centric networking (ICN) approach. These lead to a set of design four goals: longevity, scalability, evolvability and security. We apply two key design principles, layering and modularity, to derive our design for the Pervasive Persistent Identification System or PPInS for information centric networking. The contributions of this work include (1) the design issues for identification systems, (2) analysis of goals and key design criteria for identification in an ICN approach, and (3) a principled design of PPInS.