Federation of circles of trust and secure usage of digital identity
Résumé
The joint growths of digital services and identity fraud exploiting poor identity management solutions have led to an identity crisis on the Internet. People struggle to keep control over their fragmented digital identities, and user privacy is not correctly enforced. As countermeasures, new digital identity initiatives include several distinct federated identity models, like Liberty Alliance or InfoCard. Based on the results of a French innovative R&D project called FC² (Federation of Circles of Trust), this paper investigates the ways to create a federated identity architecture compatible with the major existing identity technologies while providing a secure and coherent user experience. In the light of a practical use case involving a bike rental service requiring attributes from its users to complete their registration, the card-based identity selector seems to arise as a major client identity component. The first project results highlight the need for clear and simple user information on service providers about identity exchanges. A "Simplified Sign-On" procedure for users and the need for digitally certified attributes are also exposed. On the business side, possible future models are sketched with their benefits for the different actors of the identity value chain. Eventually, studying the legal issues related to the federated identity model show that the responsibilities of the different actors should carefully be established within a circle of trust