In most identity management scenarios there are different interests at play. Users are characterised by the different attributes that make up their identity

Service providers must verify that users comply with the necessary conditions to access services. These requirements may simply involve the knowledge of the typical username and password combination or include more sensitive data such as the user’s age or location.

There is a growing concern that citizens, businesses, and the EU Member States are gradually losing control of their data, their capacity for innovation, and their ability to shape and enforce legislation in the digital environment.

The final goal of CyberSec4Europe’s research on privacy-preserving identity management (pp-IdM) is to provide a set of advanced mechanisms that can be integrated in various scenarios, in order to provide additional protection and privacy features to end-users, organisations and infrastructures. Thanks to the provided tools, European systems would be able to perform authentication and authorisation processes with strong trust, while enforcing user privacy.

To this end, the pp-IdM research team has performed an analysis of the topic, resulting in a description of the EU’s strengths/weaknesses/opportunities/threats in relation to privacy and identity management with the identification of several key challenges:

(1) GDPR and eIDAS impact interoperability,

(2) Unlinkability and minimal disclosure,

(3) Password-less authentication,

(4) System-based credential hardening,

(5) Distributed oblivious identity management,

(6) Privacy preservation in blockchain, and

(7) Identity management solutions for IoT scenarios.

The following briefly describes why these challenges have been considered.

During authentication, more information than intended may be revealed by a user to a service provider, or the information revealed to multiple service providers may be pooled to create a more complete picture of the user’s identity than expected (2). Also, a malicious or compromised issuer can track user activity which may lead to breaches of privacy (identity data is revealed) or even to identity theft or forgery (5). Lastly, it is necessary (and/or desirable) to conform to existing regulations regarding privacy while keeping in mind the possible interoperability issues (1).

However, protecting the user from malicious (or compromised) actors is not the only challenging matter. Other risks come from the software tools that are used or the possible misuse by the user himself. For example, the most widespread method for authentication is the use of username plus password. While the method itself can be secure, in practice it leads to possible breaches because of weak or reused passwords and offline attacks (3). Also, when cryptographic materials like certificates or credentials are involved, they become assets that must be protected so they do not put the user’s identity at risk (4). Lastly, as new scenarios and technologies arise, they must be either protected, like in the case of IoT scenarios, or taken advantage of to achieve privacy-enhancing solutions, like blockchain (6).

So far, the work done has resulted in the development of roadmaps that delineate the research efforts for tackling these challenges. The first phases of work have already been completed and focused on thorough the analysis of the different issues (e.g., a comparison of different existing solutions or requirements analysis). Also, first steps in developing the solutions have been taken, like the design of architectures for the systems that will be proposed, a definition of GDPR guidelines or first reference implementations of the components and their evaluations.

The latest results of CyberSec4Europe’s work on roadmapping privacy-preserving identity management will be available in deliverable D4.4 Research and Development Roadmap, available shortly.

 

Antonio Skarmeta, University of Murcia