Enhancing User Privacy in Information Card-Based Identity Management Systems

Information Card-based Identity Management (ICIM) is one of the most prominent user-centric schemes. In this paper we identify two security flaws in ICIM systems that may lead to a serious privacy violation. The first is the reliance on Internet user judgements of the authenticity of service providers, and the second is the reliance of the system on a single layer of authentication. We also propose a solution designed to address both flaws. The proposed solution enhances the privacy of ICIM systems by mitigating the risk of users being deceived by fake service providers. It also reduces the risk of an attacker impersonating a legitimate user to access services offered by one or more service providers, after having broken the only means employed to authenticate the user to identity provider. We also provide a security and performance analysis of the proposed solution. In this paper, CardSpace is used as an example of an ICIM system, and the modification is described in the context of this system.