1. 10.20.2007, Josef NollNISnet NISnet meeting 10.10.2007 Mobile Applied Trusted Computing Josef Noll, josef@unik.no

2. 10.10.2007, Josef NollNISnet Security and authentication: Leading questions What do I fear? – That somebody steals my identity and I can't do anything about it. – That biometrics takes it all – and privacy disappears What can I use to make life more comfortable? – Reduce number of “secure devices” I have to carry (BankID, Telenor access card, keys, money, credit card, …) – Have a device which is secure (enough). Why is my phone the security infrastructure? – Because I can ask my operator to block it, if it gets stolen. – Because it is not an insecure Microsoft device.

3. 10.10.2007, Josef NollNISnet Summary: Identity in the virtual world Real world: see and/or talk Voice Face Virtual world: email, web Username, passwd SIM, PKI Security, privacy Service world (between providers) Identity management Service level agreement (SLA) Trust relation

4. 10.10.2007, Josef NollNISnet Introduction: Identity Identity is attributes of your persona – Social, Corporate and Private IDs Internet was built without an identity layer – Identity 2.0 stems from Web 2.0 – People, information and software – More user-oriented (wikis, comments, tags) – More seamless web services (AJAX) Service related security – Provide just the information which is necessary Mobile challenges

5. 10.10.2007, Josef NollNISnet Summary: Identity 2.0 – The goal User centric – More like real life ID’s (passport, license) – Multiple ID’s (PID, SID, CID) – Certificates and preferences – Choose attributes ~more privacy ID providers – Multiple providers – Own certificates Mobile, and de-centralized Personal (PID) Corporate (CID) Social (SID) Identity

6. 10.10.2007, Josef NollNISnet Challenge: Role based service access Next Generation Applications: – Customized services – Remote services – Proximity services – High flexibility – Telecom-IT integration Challenges – Privacy – Trust – Application security App x App y App z Identity provider Corporate - CID VPNadmittance Public Authority … Bank Application providers Certificate Social - SID sportsorigin Private - PID Mastercard, Visa Soc. sec. number Certificate Telecom JosefRole based service access My identities

7. 10.10.2007, Josef NollNISnet New role: Identity provider Certificate Josefine Remote servicesProximity services Who provides? – ID provider Where to store? – Network – Phone How to store/backup? – long term, short term

8. 10.10.2007, Josef NollNISnet Summary: Security Challenges Mobile based access and payment – Next generation SIM cards – Virtualization of SIM credentials – Contactless access through NFC – (out-of-band) key distribution in heterogeneous networks User privacy enhancing technologies – service specific authentication methods – role-based access mechanisms Semantic Web and Web Services – Policies and rules support in ontologies – Trust distribution in distributed ontologies – Privacy protection in social networks