Overview of “Attribute Aggregation In Federated Identity Management”[1] Presented by Daniel Waymel June 2013 at UT Dallas

Background Foundation – Identity Providers (IdP) – Service Providers (SP) – Attributes Federated Identity Management – ABAC-Based – Unify IdPs In a Trust Relationship – Extends SSO – Enhanced User Convenience – Potentially Enhanced User Privacy Attribute Aggregation – Compilation of Attributes from Multiple IdPs – Greater Convenience Without Complete Loss of Privacy

Existing Solutions [1] SSO certificates Liberty Alliance – Background sharing between IdPs using randomized aliases – Note: User affiliations are known to IdPs – potential privacy leak Partnerships – IdP-Mediated Attribute Aggregation – User-Initiated linking of accounts across IdPs via shared secret – Unified alias can subsequently be passed to SPs along with IdP partnerships – Same privacy issues as with the Liberty Alliance solution myVocs – Identity Proxying – Relies on a single fully trusted IdP which coordinates with all other IdPs – Rarely workable trust relationship as the proxy IdP is trusted absolutely

New Concept John Linking Service 1: Initial Login iBay.com Rainforest.com 2: Ref: IdP1 4: Ref: IdP2 3: Ret: {ibuystuff} 5: Ret: {isellstuff} UserPIDIdPAttributes JohnUid1423iBay.com{PayBuddy account info} JohnUid9687Rainforest.com{Merchant bank account info} Note: A separate user-controlled ACL-like table is also maintained by the Linking Service controlling which attributes are available to which IdPs.

Level of Assurance (LOA) [1] Four levels: 1(lowest) – 4(highest) Registration LOA – Defined by mode of authentication used for initial registration/provisioning Authentication LOA – Defined by the mode of authentication used for return access Session LOA – Defined by the mode of authentication chosen for a given session Registration LOA must dominate Authentication LOA Once authenticated with an LOA of X, only attributes from IdPs whose LOA dominate X may be aggregated, thus maintaining a baseline standard of assurance.

Usage Scenario – Accessing Restricted Content on Rainforest.com John Rainforest.com (SP) Un/pw login screen Two-factor authentication Linking Service 1: Login Request 2: Redir: IdP1 3: Ret: {attributes}, Ref1 4: Ref: LS... IdP3IdPn... 5: Ref: IdP2 6: Ret: {attributes} 5: Ref: IdP3 – IdPn 6: Ret: {attributes} 2.5: login interaction 7: Ret: {aggregated attributes}

Further Details Implementation details are discussed in the paper, but are not discussed here due to scope and brevity.

Reference [1] Chadwick, D. W., & Inman, G. (2009). Attribute aggregation in federated identity management. Computer, 42(5),