A Hybrid Model of Attribute Aggregation in Federated Identity Management

Abstract

The existing model of Federated Identity Management (FIM) allows a user to provide attributes only from a single Identity Provider (IdP) per service session. However, this does not cater to the fact that the user attributes are scattered and stored across multiple IdPs. An attribute aggregation mechanism would allow a user to aggregate attributes from multiple providers and pass them to a Service Provider (SP) in a single service session which would enable the SP to offer innovative service scenarios. Unfortunately, there exist only a handful of mechanisms for aggregating attributes and most of them either require complex user interactions or are based on unrealistic assumptions. In this paper, we present a novel approach called the Hybrid Model for aggregating attributes from multiple IdPs using one of the most popular FIM technologies: Security Assertion Markup Language (SAML). We present a thorough analysis of different requirements imposed by our proposed approach and discuss how we have developed a proof of concept using our model and what design choices we have made to meet the majority of these requirements. We also illustrate two use-cases to elaborate the applicability of our approach and analyse the advantages it offers and the limitations it currently has.

Social Anchor: Privacy-Friendly Attribute Aggregation From Social Networks

“…As per [2], Attribute Aggregation is the process that allows a user to aggregate or combine her attributes from several identity providers and release them to an SP in a single session. Since a profile is utilised while attributes are released from an IdP to an SP, we can regard the attribute aggregation process as the aggregation of profiles of a user from different IdPs.…”

“…A SAML protocol flow between a user (denoted as u), an IdP (denoted as idp) and an SP (denoted as sp) is presented below using the notations presented in Table 1 [2].…”

“…Among them, only Shibboleth and SimpleSAMLphp are widely used. In [2], it has been analysed how SAML and SimpleSAMLphp have been combined for attribute request, selective disclosure and attribute aggregation. For brevity, we are not repeating the analysis process here.…”

“…Towards this aim, we present Social Anchor, a system for attribute aggregation from social networks in a privacyfriendly fashion. Social Anchor is based on the work of Ferdous et al [2] and allows a user aggregating attributes from different social networks and release them to a service provider in a secure and privacy-friendly mechanism with different levels of privacy control.…”

“…Section III presents our analysis on how attributes are released from different SN IdPs using different protocols and highlights the major limitations of the existing approach and the impact it has on the privacy of users. Social Anchor is based on the work of [2] in which a Hybrid model of Attribute Aggregation is showcased. We briefly describe the Hybrid Model in Section IV and underline the necessity of introducing Social Anchor.…”