Federated Identity Research Articles

A Cyber Risk Assessment Approach to Federated Identity Management Framework-Based Digital Healthcare System.

This paper presents a comprehensive and evidence-based cyber-risk assessment approach specifically designed for Medical Cyber Physical Systems (MCPS)- and Internet-of-Medical Devices (IoMT)-based collaborative digital healthcare systems, which leverage Federated Identity Management (FIM) solutions to manage user identities within this complex environment. While these systems offer advantages like easy data collection and improved collaboration, they also introduce new security challenges due to the interconnected nature of devices and data, as well as vulnerabilities within the FIM and the lack of robust security in IoMT devices. To proactively safeguard the digital healthcare system from cyber attacks with potentially life-threatening consequences, a comprehensive and evidence-based cyber-risk assessment is crucial for mitigating these risks. To this end, this paper proposes a novel cyber-risk assessment approach that leverages a three-dimensional attack landscape analysis, encompassing existing IT infrastructure, medical devices, and Federated Identity Management protocols. By considering their interconnected vulnerabilities, the approach recommends tailored security controls to prioritize and mitigate critical risks, ultimately enhancing system resilience. The proposed approach combines established industry standards like Cyber Resilience Review (CRR) asset management and NIST SP 800-30 for a comprehensive assessment. We have validated our approach using threat modeling with attack trees and detailed attack sequence diagrams on a diverse range of IoMT and MCPS devices from various vendors. The resulting evidence-based cyber-risk assessments and corresponding security control recommendations will significantly support healthcare professionals and providers in improving both patient and medical device safety management within the FIM-enabled healthcare ecosystem.

Considerations for trustworthy cross-border interoperability of digital identity systems in developing countries

AbstractIn developing nations, the implementation of Foundational Identity Systems (FIDS) has optimised service delivery and inclusive economic growth. Cross-border e-government will gain traction as developing countries increasingly look to identity federation and trustworthy interoperability through FIDS for the identification and authentication of identity holders. Despite this potential, the interoperability of FIDS in the African identity ecosystem has not been well-studied. Among the difficulties in this situation are the intricate internal political dynamics that have led to weak institutions, suggesting that FIDS could be used for political purposes; additionally, citizens’ or identity holders’ habitual low trust in the government raises concerns about data security and privacy protection. Similarly, vendor lock-in, cross-system compatibility, and ambiguous legislative rules for data exchange are other concerns. Interoperability is fundamentally necessary as a precondition for e-government services and serves as the foundation for the best possible service delivery in the areas of social security, education, and finance, as well as gender equality as demonstrated by the European Union (EU). Moreover, the integration of cross-border FIDS and an ecosystem of effective data governance will be created by unified data sharing via an interoperable identity system. Thus, in this study, we point to the challenges, opportunities, and requirements for cross-border interoperability in an African setting. Furthermore, we investigated current interoperability solutions such as the EU’s eIDAS and Estonian X-Road and proposed an approach for scoping requirements to achieve a fully functional interoperable identity ecosystem in the African setting. Our findings show that interoperability in the African identity ecosystem is essential for expanding the scope of e-government throughout the continent and for bolstering the smooth authentication and verification of identity holders for inclusive economic growth.

Enhancing Email Security - End to End Encryption

Abstract: Nowadays, most of people and organizations use the e-mail for different needs to exchange information between users. E-mail application is an important network application. It is significant when business1, health and educational communities use it for exchange of critical information such as business information, health patient record and so on. over the Internet or internal networks, It allows data and messages to be transferred easily between senders and receivers allowing messages to be received, responded to, stored, forwarded and broadcast among recipients. These extensive capabilities have caused the email to be widely adopted as the official communications method for many organizations. Also common for personal use, electronic mail is available through a diverse number of compatible software clients, and also via web-browser. An existing enterprise email implementation second service model adds security processing. The service provider is responsible for monitoring all threats using email as a channel , and for providing an email user interface (UI) In the enterprise augmentation model, an existing on-premise email deployment is augmented by additional cloud-based services and functionalist. This paper explores identity federation and data loss prevention and describing best practices for evaluating, developing, installing and using cloud-based email security services.1.1Intended Audience Email security services are viewed from two perspectives: the providers of these services and the consumers or purchasers of email security services. key service features is needed for both sides to be aware of and plan for and how these features are used to tackle threats to email security.

ROSTAM: A passwordless web single sign-on solution mitigating server breaches and integrating credential manager and federated identity systems

The challenge of achieving passwordless user authentication is real given the prevalence of web applications that keep asking passwords. Complicating this issue further, in an enterprise environment, a single sign-on (SSO) service is often maintained but not all applications can be integrated with it. We envision a passwordless future which provides a frictionless and trustworthy online experience for users by integrating credential management and federated identity systems. In this regard, our implementation ROSTAM offers a dashboard that presents all applications the user can access with a single click after a passwordless SSO. The security of web passwords on the credential manager is ensured with a Master Key, rather than a Master Password, so that encrypted passwords can remain secure even if stolen from the server. We propose and implement novel techniques for synchronization (pairing) and recovery of this Master Key. We compare our solution to previous work using different evaluation frameworks, demonstrating that our hybrid solution combines the benefits of credential management and federated identity systems.

Digital twins, the journey of an operational weather prediction system into the heart of Destination Earth

Moving a world leading numerical weather prediction system of the European Center for Medium-Range Weather Forecasts (ECMWF), that runs on a dedicated, bespoke, high performance computing cluster and supporting infrastructure, into the heart of the digital twin for climate change adaptation and extreme weather events, developed in the Destination Earth (DestinE) initiative of the European Commission, has been a challenging and exciting journey. In this paper we describe this journey with a focus on those aspects required to leverage the pre-exascale EuroHPC systems that have been made available to DestinE to run its computational representation [1]. EuroHPC systems can be effectively used for DestinE and are in fact key assets to deliver the computational power required for Earth system digital twins at global km-scale resolution. Each of these systems is operated by a national hosting entity that implements its own procedures, e.g. for identity and access management, specific system configuration like schedulers, filesystems, software management systems, and specific, sometimes vendor associated, toolchains, tooling, and container runtimes. In particular, the different scheduling policies encountered required us to adapt our workflows for each site. We found that having dedicated resources available, which was trialed in a period from 16th February to 14th April on LUMI, allowed to achieve high occupation rates, with 92% on the reserved GPU allocation and greater than 97% efficiency on the CPU reservation. Also, a stronger focus on federation of these systems, with a focus not only on federation of identities and accounts, but also in the areas of data ownership/transfer, observability, services and service accounts, maintenance coordination and performance portability could benefit DestinE. In general, it would be beneficial to make it easier to transfer a workload, or a digital twin system, from one EuroHPC site to the next and run and maintain them across several sites concurrently.

Reference Service Model for Federated Identity Management

Reference Service Model for Federated Identity Management

THORIN: an Efficient Module for Federated Access and Threat Mitigation in Big Stream Cloud Architectures

In order to make cloud services attractive for several IT organizations, it is necessary to provide access control and to implement safe and reliable mechanisms of Identity and Access Management (IAM). In this work, we focus on security issues and challenges in the design and implementation of cloud architectures and, in particular, for the management of Big Stream applications in Internet of Things (IoT) scenarios. The proposed work introduces a new set of modules allowing a federated access control policy for cloud users. An analysis of possible threats and attacks against the proposed Big Stream platform is presented, investigating the system performance in terms of detection and elimination of malicious nodes. In particular, we propose a new module, denoted as Traffic Handler Orchestrator & Rapid Intervention (THORIN), which is very efficient in counteracting botnet-based threats.

An attention based approach for automated account linkage in federated identity management

Linking digital accounts belonging to the same user has progressed from a research topic to a foundation for security, user satisfaction, and developing next-generation services. Still, few studies address account linkage in domains other than social networks. This deficiency is particularly apparent in federated domains such as academia, where network-based information and contextual data are typically unavailable. To address this issue, we propose SmartSSO, a framework that aims to automate the account linkage process by analyzing user routines and behavior during login processes. SmartSSO adapts two self-attention-based models to generate new representations from user patterns in a lower-dimensional latent space where the learned structure is employed to identify related accounts held by a user. We show that the trained models on a large corpus of production data, including more than one million samples gathered over six months from 50,000 users, achieve over 98% accuracy in hit-precision.

Enhancing Digital Trust in the U.S. Mortgage Industry: A MultiDimensional Approach to Identity Assurance and Federation

This research paper explores the evolving landscape of identity assurance in the U.S. mortgage industry, focusing on the integration of federated identity management and digital authentication technologies. It addresses the challenges posed by digital disruption, such as deepfake threats and privacy concerns, and examines the application of international standards and practices in enhancing identity assurance. Drawing on insights from various frameworks including NIST, Kantara, and OIDC, the study proposes a multi-dimensional approach to strengthen digital trust in mortgage transactions. This approach balances technological advancements with regulatory compliance, offering practical solutions for secure and efficient identity verification in the mortgage sector. The paper serves as a crucial guide for professionals navigating the complexities of identity assurance in an increasingly digitized financial landscape.

T-FIM: Transparency in Federated Identity Management for Decentralized Trust and Forensics Investigation

Federated Identity Management (FIM) has gained significant adoption as a means to simplify user authentication and service authorization across diverse domains. It serves as a centralized authentication and authorization method, enabling users to access various applications or resources using credentials issued by a universally trusted identity provider (IdP). However, recent security incidents indicate that the reliability of credentials issued by IdP is not absolute in practice. If the IdP fails, it can persistently access any application that trusts it as any user. This poses a significant security threat to the entire system. Furthermore, with the increasing adoption of FIM across diverse scenarios, there is a growing demand for the development of an identity management system that can effectively support digital forensics investigations into malicious user behavior. In this work, we introduce transparency to federated identity management, proposing T-FIM to supervise unconditional trust. T-FIM employs privacy-preserving logs to record all IdP-issued tokens, ensuring that only the true owner can access the exact token. We utilize identity-based encryption (IBE), but not just as a black box, encrypting tokens before they are publicly recorded. In addition, we propose a decentralized private key generator (DPKG) to provide IBE private keys for users, avoiding the introduction of a new centralized trust node. T-FIM also presents a novel approach to digital forensics that enables forensic investigators to collect evidence in a privacy-preserving manner with the cooperation of the DPKG. We conduct a comprehensive analysis of the correctness, security, and privacy aspects of T-FIM. To demonstrate the practical feasibility of T-FIM, we evaluated the additional overhead through experimental evaluations. Additionally, we compared its performance with other similar schemes to provide a comprehensive understanding of its capabilities and advantages.

New Directions and Challenges within Identity and Access Management

Identity and access management is a core building block for the majority of web services. Cloud-based services, social webs, mobile apps, but also IoT-related services rely on identity management to provide a seamless and secure user experience. Transmitting and sharing sensitive information with other organizations always poses a security and privacy risk to all participating entities. One solution to tackle this problem is the principle of federated identity management (FIM). FIM is used to authenticate and authorize users across multiple organizations and platforms in order to obtain access to resources and services. The benefits of FIM are, for example, consistent data, reduced amount of sensitive information needed to be shared, as well as less passwords for the user to remember. Both predominant standards, Secure Assertion Markup Language (SAML) 2.0 and Open Authentication (OAuth) 2.0 with the authentication layer OpenID Connect, are in wide-spread practical use for at least a decade. However, these protocols were developed with different requirements in mind than nowadays present. This led to several extensions to tackle real-world problems, making it cumbersome to comply with every flavor. Also, Request for Comments (RFC) 8252 suggests that a native app opens a system browser for user authentication; consequently, new protocols are currently developed. For example, within Internet Engineering Task Force (IETF), Kantara Initiative, and OpenID Foundation, which (should) have three main goals in common: • Reducing the complexity in contrast to SAML 2.0 and OAuth 2.0. • Decreasing the amount of extensions and varieties found in the wild. Both help developers to comply with the standards and, consequently, increase the security. • Including edge and future use cases, making the protocols even more useful. This article gives insights into current developments and possible future paths.

Fedidchain: An Innovative Blockchain-Enabled Framework for Cross-Border Interoperability and Trust Management in Identity Federation Systems

Fedidchain: An Innovative Blockchain-Enabled Framework for Cross-Border Interoperability and Trust Management in Identity Federation Systems

A comparative cyber risk analysis between federated and self-sovereign identity management systems

Abstract Self-sovereign identity (SSI) is an emerging and promising concept that enables users to control their identity while enhancing security and privacy compared to other identity management (IDM) approaches. Despite the recent advancements in SSI technologies, federated identity management (FIDM) systems continue to dominate the IDM market. Selecting an IDM to implement for a specific application is a complex task that requires a thorough understanding of the potential external cyber risks. However, existing research scarcely compares SSI and FIDM from the perspective of these external threats. In response to this gap, our article provides an attack surface analysis focused solely on external threats for both systems. This analysis can serve as a reference to compare the relevant security and privacy risks associated with these external threats. The threat landscapes of external attackers were systematically synthesized from the main components and functionalities of the common standards and designs. We further present a use case analysis that applies this attack surface analysis to compare the external cyber risks of the two systems in detail when managing cross-border identity between European countries. This work can be particularly useful for considering a more secure design for future IDM applications, taking into account the landscape of external threats.

Decentralized Identity Management Using Blockchain

This article explores the usage of decentralised identity (DID) management using blockchain in global organisations to support secure usage of information resources. Blockchain as technology was initially introduced as a cryptocurrency and there have been challenges in its adoption for enterprise applications such as identity management. DID is emerging as one of the strong blockchain adoption use cases. Industry pioneers and users across domains have started exploring DID use cases, which help better protect their personal data and application access control as compared to traditional, central, or federated identity management models. In this exploratory work, the authors employ qualitative secondary case-based study research methodology to understand the challenges of the current digital identity management landscape and explore the possible benefits of DID as an emerging identity management paradigm. They propose a conceptual cube framework for analysing and studying various DID platforms thereby contributing to both the theory and practice of digitally secure identity.

A Unified Federated Framework for Internet-of-Things Security Challenges


 The protection of sensitive information is among the top priorities of organizations that are involved in manufacturing. Because of this, businesses are afraid of sharing their data with other parties so that they may construct predictive and prognostic models. In such a situation, it is difficult to construct complete models to forecast the breakdown of assets since data from a single firm would not provide the needed range of operating regimes and failure types. Recently, the Internet of Things (IoT) has gotten a lot of interest because of the vast variety of applications it has in numerous fields that communicate across multiple levels of the Internet infrastructure. The Internet of Things is composed of three layers: the physical layer, the network layer, and the application layer. This paper discusses security threats and responses for each layer of the IoT. The research examines different current state-of-the-art IoT security frameworks and suggests a unified IoT network security framework name "A Unified Federated Security Framework." The fuzzy cognitive maps used in the proposed framework are used to represent and evaluate trust connections between entities in federated identity management systems. For Internet of Things networks, the unified federated security architecture suggested in this paper offers comprehensive security characteristics. It also allows for the accurate categorization of all assaults and the capture of the different dangers, which allows for the development and implementation of improved defenses.

A Dynamic Federated Identity Management Using OpenID Connect

Identity federation allows one to link a user’s digital identities across several identity management systems. Federated identity management (FIM) ensures that users have easy access to the available resources. However, scaling FIM to numerous partners is a challenging process due to the interoperability issue between different federation architectures. This study proposes a dynamic identity federation model to eliminate the manual configuration steps needed to establish an organizational identity federation by utilizing the OpenID Connect (OIDC) framework. The proposed model consists of three major steps to establish dynamic FIM: first, the discovery of the OpenID service provider, which indicates the location of the partner organization; second, the registration of the OpenID relying party, which allows the organization and its partner to negotiate information for establishing the federation; finally, establishing the dynamic trust federation. The proposed dynamic FIM model allows applications to provide services to end-users coming from various domains while maintaining a trust between clients and service providers. Through our proposed dynamic identity federation model, organizations can save hundreds of hours by achieving dynamic federation in runtime and serving a large number of end-users.

An International Federal Hyperledger Fabric Verification Framework for Digital COVID-19 Vaccine Passport.

The COVID-19 virus has been spreading worldwide on a large scale since 2019, and the most effective way to prevent COVID-19 is to vaccinate. In order to prove that vaccination has been administered to allow access to different areas, paper vaccine passports are produced. However, paper vaccine passport records are vulnerable to counterfeiting or abuse. Previous research has suggested that issuing certificates digitally is an easier way to verify them. This study used the consortium blockchain based on Hyperledger Fabric to upload the digital vaccine passport (DVP) to the blockchain network. In order to enable collaboration across multiple systems, networks, and organizations in different trust realms. Federated Identity Management is considered a promising approach to facilitate secure resource sharing between collaborating partners. Therefore, the international federal identity management architecture proposed in this study enables inspectors in any country to verify the authenticity of the DVP of incoming passengers using the consortium blockchain. Through practical construction, the international federal Hyperledger verification framework for the DVP proposed in this study has shown the feasibility of issuing a global DVP in safety analysis and efficacy testing.

Blockchain-Based Cross-Domain Authentication for Intelligent 5G-Enabled Internet of Drones

While 5G can facilitate high-speed Internet access and make over-the-horizon control a reality for unmanned aerial vehicles (UAVs; also known as drones), there are also potential security and privacy considerations, for example, authentication among drones. Centralized authentication approaches not only suffer from a single point of failure but they are also incapable of cross-domain authentication. This complicates the cooperation of drones from different domains. To address these limitations, a blockchain-based cross-domain authentication scheme for intelligent 5G-enabled Internet of drones is proposed in this article. Our approach employs multiple signatures based on threshold sharing to build an identity federation for collaborative domains. This allows us to support domain joining and exiting. Reliable communication between cross-domain devices is achieved by utilizing smart contract for authentication. The session keys are negotiated to secure subsequent communication between two parties. Our security and performance evaluations show that the proposed scheme is resistant to common attacks targeting Internet of Things (IoT) devices (including drones), as well as demonstrating its effectiveness and efficiency.

User-Centric Privacy for Identity Federations Based on a Recommendation System

Specifications such as SAML, OAuth, OpenID Connect and Mobile Connect are essential for solving identification, authentication and authorisation in contexts such as mobile apps, social networks, e-commerce, cloud computing or the Internet of Things. However, end-users relying on identity providers to access resources, applications or services lose control over the Personally Identifiable Information (PII) they share with the different providers composing identity federations. This work proposes a user-centric approach based on a recommendation system to support users in making privacy decisions such as selecting service providers or choosing their privacy settings. The proposed Privacy Advisor gives end-users privacy protection by providing personalised recommendations without compromising the identity federations’ functionalities or requiring any changes in their underlying specifications. A proof of concept of the proposed recommendation system is presented to validate and evaluate its utility and feasibility.

A Secure and Trusted Fog Computing Approach based on Blockchain and Identity Federation for a Granular Access Control in IoT Environments

Fog computing is a new computing paradigm that is an extension of the standard cloud computing model, which can be adopted as a cost effective strategy for managing connected objects , by enabling real-time computing and communication for analytical and decision making. Nonetheless, even though Fog-based Internet of Things networks optimize the standard architecture by moving computing, storage, communication, and control decision closer to the edge network, the technology becomes open to malicious attackers and remains many business risks that are not yet resolved. In fact, access control, privacy as well as trust risks present major challenges in Internet of Things environments based on Fog computing due to the large scale distributed nature of devices at the Fog layer. In addition, the traditional authentication methods are not adequate in Fog-based Internet of Things contexts since they consume significantly more computation power and incur high latency. To deal with these gaps, we present in this paper a secure and trusted Fog Computing approach based on Blockchain and Identity Federation technologies for a granular access control in IoT environments. The proposed scheme uses Smart Contract concept and Attribute-Based Access Control model to ensure the level of security and scalability required for data integrity without resorting to a central authority to make an access decision.