Claim-Based versus Network-Based Identity Management: A Hybrid Approach

Abstract

This paper proposes a hybrid approach that combines claimbased and network-based identity management. Partly by virtue of the principle of separation of concerns, better security and privacy properties are attained. Overall trust is diminished, while simultaneously reducing multiple actors' exposure and value as a target of attack. The proposed architecture also facilitates interoperability and pluralism of credential technologies, authentication protocols and operators. In addition, the user has more control over his personal data than with current network-based identity management systems. A prototype demonstrates the feasibility of the proposed approach.

Making OpenID Mobile and Privacy-Friendly

“…To start authenticating, the user provides his identifier to the relying party (1). Using this identifier, the relying party carries out a discovery, the result of which is the identity provider's URL (2). Next, a session is established between the relying party and the identity provider (3).…”

“…What's more, multiple security-critical responsibilities are fulfilled by the identity provider: authentication, attribute storage, as well as provisioning. This makes it a high-value attack target [2].…”

“…Boukayoua et al [2] outline a number of complementary weaknesses and strengths in network-based and claim-based identity management systems. In a networkbased system, storage of user attributes is centralised at the identity provider, making it a high-value attack target.…”