Johanneke Siljee

Comparing Identity Management Frameworks in a Business Context

Several frameworks for identity management exist, each of them with its own distinguishing features. These frameworks are complex however, and their features not easily understood. This makes it hard for businesses to understand the intricacies, and difficult to select and deploy one. This paper develops business selection criteria and applies them to four popular identity management frameworks. The resulting score card (1) helps businesses to select and deploy an identity management system, and (2) provides valuable feedback to developers of identity management systems on the criteria that they should take into account when designing and implementing an identity management system that is useful for specific businesses.

Privacy transparency patterns

This paper describes two privacy patterns for creating privacy transparency: the Personal Data Table pattern and the Privacy Policy Icons pattern, as well as a full overview of privacy transparency patterns. It is a first step in creating a full set of privacy design patterns, which will aid software developers with the realization of privacy by design. Privacy design patterns are design solutions to recurring privacy problems; as such they can facilitate the development of privacy-by-design solutions. Privacy design patterns as such exist, but a complete, uniform and readily applicable overview does not exist. This paper presents such an overview for privacy transparency patterns: they focus on solutions on how to create privacy transparency. Two privacy transparency patterns are fully described: the Personal Data Table pattern and the Privacy Policy Icons pattern.

UbiKiMa: ubiquitous authentication using a smartphone, migrating from passwords to strong cryptography

Passwords are the only ubiquitous form of authentication currently available on the web. Unfortunately, passwords are insecure. In this paper we therefore propose the use of strong cryptography, using the fact that users increasingly own a smartphone that can perform the required cryptographic operations on their behalf. This is not as trivial as it sounds. Services will not migrate to new forms of authentication if few users have the means to use it. Similarly, users will not acquire the means if there are few services that accept them. Moreover, enabling ones smartphone to seamlessly sign in at a website when browsing on an arbitrary PC is non-trivial. We propose a system, based on a smartphone app, that can be used to sign in with username and password to arbitrary websites using an arbitrary PC or laptop. We describe the protocol and implementation to achieve this without the need for typing usernames and passwords. Furthermore, we propose an authentication protocol based on public key cryptography, integrated in the same smartphone app. This allows websites to seamlessly migrate towards a much more secure authentication method on the web, independently of each other. A prototype of our system has been developed.