Affiliations: [a] Department of Computer Science, University of California, Irvine, CA 92697, USA. E-mail: goodrich@acm.org | [b] Department of Computer Science, Providence, RI 02912, USA. E-mail: rt@cs.brown.edu | [c] Department of Computer Science, Rutgers University, Piscataway, NJ 08854, USA. E-mail: danfeng@cs.rutgers.edu
Note: [*] This work was supported in part by the National Science Foundation under grants IIS-0324846, IIS-0713403 and OCI-0724806, and by IAM Technology, Inc. The work of the first author was done primarily as a consultant to Brown University. A preliminary version of this paper appeared in Proceedings of the 20th Annual IFIP WG 11.3 Working Conference on Data and Applications Security (DBSec’06), Sophia Antipolis, France, July 2006, LNCS, Vol. 4127, Springer-Verlag, Berlin–Heidelberg, 2006, pp. 133–147.
Abstract: We propose a notarized federated identity management model that supports efficient user authentication when providers are unknown to each other. Our model introduces a notary service, owned by a trusted third-party, to dynamically notarize assertions generated by identity providers. An additional feature of our model is the avoidance of direct communications between identity providers and service providers, which provides improved privacy protection for users. We present an efficient implementation of our notarized federated identity management model based on the Secure Transaction Management System (STMS). We also give a practical solution for mitigating aspects of the identity theft problem and discuss its use in our notarized federated identity management model. The unique feature of our cryptographic solution is that it enables one to proactively prevent the leaking of secret identity information.
