A Model for Privacy-enhanced Federated Identity Management

TL;DR

This paper introduces a privacy-enhanced federated identity management model that employs technical controls to prevent data linkability, limit observability, and ensure attribute non-disclosure, aligning with privacy-by-design principles.

Contribution

It proposes a novel reference architecture using a hub-and-spoke federation model with specific privacy controls to improve user data protection in identity federations.

Findings

Supports privacy requirements: linkability, observability, non-disclosure

Uses a hub-and-spoke federation style for privacy

Addresses legal and confidentiality concerns in identity management

Abstract

Identity federations operating in a business or consumer context need to prevent the collection of user data across trust service providers for legal and business case reasons. Legal reasons are given by data protection legislation. Other reasons include business owners becoming increasingly aware of confidentiality risks that go beyond traditional information security, e.g., the numbers of authentications to an EDI service might provide insights into the volume of invoices, from which one could derive insider information. This paper proposes extended technical controls supporting three privacy requirements: a) Limit d Linkability: Two service providers cannot link data related to a user without the help of a third party, using neither an identifier nor other identifying attributes like email addresses or payment data; b) Limited Observability: An identity provider cannot trace which services a user is using without the help of a third party; c) Non-Disclosure: Attributes provided to the service provider by an attribute provider are not disclosed to the identity provider or an intermediate service broker. Using a hub-and-spoke federation style following the privacy-by-design principle, this reference architecture addresses the privacy controls mentioned above.