Data security, which is concerned with the prevention of unauthorized access to computers, databases, and websites, helps protect digital privacy and ensure data integrity. It is extremely difficult, however, to make security watertight, and security breaches are not uncommon. The consequences of stolen credentials go well beyond the leakage of other types of information because they can further compromise other systems. This paper criticizes the practice of using clear-text identity attributes, such as Social Security or driver's license numbers -- which are in principle not even secret -- as acceptable authentication tokens or assertions of ownership, and proposes a simple protocol that straightforwardly applies public-key cryptography to make identity claims verifiable, even when they are issued remotely via the Internet. This protocol has the potential of elevating the business practices of credit providers, rental agencies, and other service companies that have hitherto exposed consumers to the risk of identity theft, to where identity theft becomes virtually impossible.
The concept of claims-based identity was pioneered by Cameron @cite_17 at Microsoft in the mid-2000s when he laid out seven laws'' of identity, which provide useful guidelines for the design of systems that cope with identity on the Internet. Cameron proposes a definition of identity in terms of claims rather than identifiers. With this definition, he shifts the paradigm from identifying individuals to proving the relationship between digital identity and real-world objects. By choosing the term claim'' instead of assertion,'' he emphasizes that this relationship is always imbued with some level of uncertainty, and could manifest itself as a potential weakness in any secure system. The protocol described in this paper implements the first four of Cameron's laws, which boil down to: user consent,'' minimal disclosure,'' justifiable use,'' and context isolation.'' The fifth law states that an identity system needs to allow for pluralism of operators and technologies, which the protocol also does, granted that it leaves the method for end-point authentication unspecified. The sixth and seventh laws are strictly concerned with user experience, which is entirely outside of the scope of this paper.
@cite_17
1523091741
This paper is about how we can prevent the loss of trust and go forward to give Internet users a deep sense of safety, privacy, and certainty about whom they are relating to in cyberspace. Nothing could be more essential if Web-based services and applications are to continue to move beyond "cyber publication" and encompass all kinds of interaction and services. Our approach has been to develop a formal understanding of the dynamics causing digital identity systems to succeed or fail in various contexts, expressed as the Laws of Identity. Taken together, these laws define a unifying identity metasystem that can offer the Internet the identity layer it so obviously requires.