IDM System Research Articles

Constitutional Conduct Group. An Open Letter to the Citizens of India. CAA-NPR-NRIC. Review and Annotated Version.

The 'Constitutional Conduct Group' of India is a forum of former government officials who have written open letters commenting on the policies of the Narendra Modi administration. On the 10th of January 2020 the group published an open letter on the burning issue of government policy with regards to identity management: Citizenship Amendment Act, National Population Register and National Register of Indian Citizens. Comments on the Open Letter are published here in an annotated version. Our main concern with the Open Letter is that the Conduct Group does not offer an alternative, comprehensive policy, but just suggests targeting some symptoms. Over the past decade India has followed a highly unorthodox identity management path. In stead of addressing foundational weaknesses in its idm systems it has focussed on Aadhaar which ignores citizenship, kicking the can down the road for civil registration and its natural and orthodox culmination in a national population register (including people's citizenship status, NRIC in India). By joining protests re (the conflated) 'CAA-NPR-NRIC', the Conduct Group shows it suggests kicking the can down the road some more. That won't put the genie back into the bottle. (To view comments download PDF, open comments list and expand comment where needed.)

ARIES: Evaluation of a reliable and privacy-preserving European identity management framework

Despite several efforts in the last years to make Identity Management Systems (IdMs) reliable, secured and privacy-respectful, identity-related cybercrimes are still continuously expanding. Current IdMs lack of proper security and privacy mechanisms that can holistically manage user’s privacy, strong authentication and ID-proofing mechanisms based on biometrics, usage of breeder documents, while maintaining usability for mobile, online or face-to-face scenarios. To fill this gap, the ARIES EU project aims to set up a reliable identity ecosystem, combining mature technologies for meet highest level of assurance, such as biometrics or use of secure elements, with innovative credential derivation mechanisms. ARIES has devised and implemented a privacy-preserving and user-centric Identity Management framework as well as associated management practices that ensure usability and flexibility for identity management processes. This paper presents ARIES results obtained after the successful development and validation of the ARIES IdM System in the associated use cases.

Holistic Privacy-Preserving Identity Management System for the Internet of Things

Security and privacy concerns are becoming an important barrier for large scale adoption and deployment of the Internet of Things. To address this issue, the identity management system defined herein provides a novel holistic and privacy-preserving solution aiming to cope with heterogeneous scenarios that requires both traditional online access control and authentication, along with claim-based approach for M2M (machine to machine) interactions required in IoT. It combines a cryptographic approach for claim-based authentication using the Idemix anonymous credential system, together with classic IdM mechanisms by relying on the FIWARE IdM (Keyrock). This symbiosis endows the IdM system with advanced features such as privacy-preserving, minimal disclosure, zero-knowledge proofs, unlikability, confidentiality, pseudonymity, strong authentication, user consent, and offline M2M transactions. The IdM system has been specially tailored for the Internet of Things bearing in mind the management of both users’ and smart objects’ identity. Moreover, the IdM system has been successfully implemented, deployed, and tested in the scope of SocIoTal European research project.

Internet data budget allocation policies for diverse smartphone applications

In recent times, there has been a significant growth in the number of smartphone users and number and types of mobile applications (apps). Such a trend has resulted in increased Internet data consumption, particularly for users of “data hungry” apps. Thus, smartphone apps should be allocated to their required budget to minimize resource wastage without compromising on user’s quality of experience. In this paper, we develop a prioritized and dynamic budget allocation policy framework for ensuring an optimal budget allocation to each app as well as improving system performance. We formulate the optimal Internet data budget management (O-IDM) problem as a mixed-integer nonlinear programming (MINLP) problem, which maximizes the resource utilization and minimizes user penalties. We also employ runtime monitoring technique to estimate future bandwidth utilization so as to ensure budget reservation as close as to the required amount. A heuristic Internet data budget management algorithm (H-IDM) is also presented, which is designed to reduce time complexity and computational overhead of the O-IDM system. The experimental results from test-bed implementation demonstrate the effectiveness of the proposed IDM systems, in comparison to state-of-the-art approaches.

An Event Driven Hybrid Identity Management Approach to Privacy Enhanced e-Health

Credential-based authorization offers interesting advantages for ubiquitous scenarios involving limited devices such as sensors and personal mobile equipment: the verification can be done locally; it offers a more reduced computational cost than its competitors for issuing, storing, and verification; and it naturally supports rights delegation. The main drawback is the revocation of rights. Revocation requires handling potentially large revocation lists, or using protocols to check the revocation status, bringing extra communication costs not acceptable for sensors and other limited devices. Moreover, the effective revocation consent—considered as a privacy rule in sensitive scenarios—has not been fully addressed. This paper proposes an event-based mechanism empowering a new concept, the sleepyhead credentials, which allows to substitute time constraints and explicit revocation by activating and deactivating authorization rights according to events. Our approach is to integrate this concept in IdM systems in a hybrid model supporting delegation, which can be an interesting alternative for scenarios where revocation of consent and user privacy are critical. The delegation includes a SAML compliant protocol, which we have validated through a proof-of-concept implementation. This article also explains the mathematical model describing the event-based model and offers estimations of the overhead introduced by the system. The paper focus on health care scenarios, where we show the flexibility of the proposed event-based user consent revocation mechanism.

The Usage of Information Technology in the Implementation of the Bologna Principle of the Student Mobility

In this paper, student mobility is observed as one of the steps in realization of the Digital Agenda of the European Union. Student mobility, as one of the main principles of the Bologna process, is the means of effectiveness increase and quality of the educational system in European Higher Education Area, EHEA, because it enables better exchange and flow of knowledge and ideas, as well as the adoption of good practices. Management Identity (IdM) system of the Higher Educational institution is a system which supports student mobility by using personal information when accessing data. The basic identity document in this system is a student smart card with the owner’s fingerprint. This biometrical data insures high level of data and identity protection. This paper proposes informational system which, in itself, contains standards for student mobility support as one of the modules of the IdM system of the Higher Educational institution.