Identity management and its support of multilateral security

Abstract We show our approach in developing an identity management system with respect to multilateral security. After examining digital pseudonyms and credentials as basic concepts of such a system, we give an introduction to technologies for multilateral security and describe an architecture which enables multilaterally secure communication. By means of different scenarios we show requirements of an identity management system, and outline an approach in developing an identity manager and its infrastructure. Finally, we discuss problems and risks of identity management systems which must be considered when using such a system.

[1]  Oliver Berthold,et al.  Identity Management Based on P3P , 2000, Workshop on Design Issues in Anonymity and Unobservability.

[2]  Andreas Pfitzmann,et al.  Properties of protection goals and their integration into a user interface , 2000, Comput. Networks.

[3]  Andreas Pfitzmann,et al.  Multilateral Security: Enabling Technologies and Their Evaluation , 2001, Informatics.

[4]  Daniela Gerd tom Markotten,et al.  Usability meets security - the Identity-Manager as your personal security assistant for the Internet , 2000, Proceedings 16th Annual Computer Security Applications Conference (ACSAC'00).

[5]  David Chaum,et al.  Security without identification: transaction systems to make big brother obsolete , 1985, CACM.

[6]  Herbert Burkert,et al.  Some Preliminary Comments on the DIRECTIVE 95/46/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. , 1996 .

[7]  Hannes Federrath,et al.  Anonymity and Unobservability in the Internet , 1999 .

[8]  J. Horrigan,et al.  Trust and privacy online: Why Americans want to rewrite the rules , 2000 .

[9]  Andreas Pfitzmann,et al.  Anonymity, Unobservability, and Pseudonymity - A Proposal for Terminology , 2000, Workshop on Design Issues in Anonymity and Unobservability.

[10]  Stefan A. Brands,et al.  Rethinking Public Key Infrastructures and Digital Certificates: Building in Privacy , 2000 .

[11]  Andreas Pfitzmann,et al.  Networks without user observability , 1987, Comput. Secur..

[12]  David Chaum,et al.  Showing Credentials Without Identification: SIgnatures Transferred Between Unconditionally Unlinkable Pseudonyms , 1985, EUROCRYPT.

[13]  Birgit Pfitzmann,et al.  Secure and Anonymous Electronic Commerce: Providing Legal Certainty in Open Digital Systems Without , 2000 .

[14]  Nils Löhndorf,et al.  E-Commerce meets E-Privacy , 2000 .

[15]  Alexander Schill,et al.  A Java-Based Distributed Platform for Multilateral Security , 1998, Trends in Distributed Systems for Electronic Commerce.