Persona Concept for Privacy and Authentication

This paper describes ongoing research and development aimed at creating a trustworthy software-based model called the Persona Concept. The “Persona Architecture” uses “web services” to implement this model and is designed to provide the consumer direct control over their identity, credentials and private data. Credentials are expressed as third-party assertions encapsulated in certificates using Secure Assertion Markup Language (SAML) and are digitally signed. The architecture also supports distributed management of electronic credentials and aims at operating across various fixed and mobile platforms including cell phones and wireless Portable Digital Assistants(PDA’s). Introduction Although authentication systems are meant to serve both users and web service providers (WSPs), implementations have not always respected the privacy needs and rights of the individual consumer. This paper introduces a concept and strategy aimed at better serving individual e-business users. The motivation for this work comes from our observation that despite best intentions, the web offers little direct control or accountability to the consumer over their personal and private data. For example, the FBI recently exposed a major identity theft, reported in [14] and [15] where it was estimated that up to 30,000 consumer identities were stolen from a credit bureau and used to produce millions of dollars worth of fraudulent transactions. Consumer privacy is currently in the hands of the web service providers they use. Although the branded web service providers may be trusted in most cases, they too are subject to hacking, viruses and mistakes. And there are plenty of WSPs that do not take proper care or are not aware of the privacy rights or concerns of the consumer and their obligations to protect consumer data. Therefore, the more web services a given consumer uses, the greater the exposure is likely to be. The good news is that the power of the web has the potential of increasing control and privacy of user data. We have already seen technologies like SSL (Secure Sockets Layer) [1] and PGP (Pretty Good Privacy [2] implement security effectively on the web. However, fully deployed PKI (Public Key Infrastructure) [3] and SET (Secure Electronic Transactions) [4] have not lived up to promises or predictions – mostly to do with the complexity of deployment we think. More recently, SSO (Single Sign-On) solutions like MS Passport [5] have been attempting to address some of the problems. And several companies have banded together recently to develop the SAML (Secure Assertion Markup Language) [6] to support an open web interoperability standard. The Persona Concept “Persona” has sometimes been used to represent a user’s profile in cyber space. It has also been used to denote a software agent or assistant interacting with the user to provide advice while brokering web transactions [12]. Our own usage is akin to the first two examples and is not aimed at modeling an individual per the latter example. On the contrary, our Persona concept focuses on providing the user with control over her personal profile maintaining and tracking her identification, authentication, authorization, security assertions (credentials) and other privacy data.