Achieving Privacy in a Federated Identity Management System

Federated identity management allows a user to efficiently authenticate and use identity information from data distributed across multiple domains. The sharing of data across domains blurs security boundaries and potentially creates privacy risks. We examine privacy risks and fundamental privacy protections of federated identity-management systems. The protections include minimal disclosure and providing PII only on a “need-to-know” basis. We then look at the Liberty Alliance system and analyze previous privacy critiques of that system. We show how law and policy provide privacy protections in federated identitymanagement systems, and that privacy threats are best handled using a combination of technology and law/policy tools.

• Type: Conference
• Year: 2009
• Where: FC
• Authors: Susan Landau, Hubert Lê Van Gông, Robin Wilton
• Keywords: Cryptography, FC 2009, Privacy, Privacy Protections, Privacy Risks