## 2 Identity Model
From an end user's perspective, whether it is a federated IdM model with a specialized trusted IdP in charge of gathering and providing users' identity information or it is a centralized IdM model, it is the same [14]. The end user logs into the service provider with a single user identity. Often found in a secure domain, this model supports Single Sign On (SSO) and distributes user-identification data to various SPs. However, the IdP faces the issue of a single point of failure if the entire identity management system fails like the centralized IdM model. However, each service provider has a different IdP in the backend. To support SSO to users joined to distinct IdPs and SPs, it is necessary to create a trust relationship between the SPs and the IdPs. Authentication is integrated by SSO and authorization is covered by entitlement management with XACML [18; 19; 20]. However, SSO also has a problem with the reliance on the IdP portal and SP in terms of access control of the cloud CDM. The federated IdM model is a method in which different service providers form a trust relationship for user convenience and jointly manage the user's identity. It is suitable for SSO support between hospital and cloud CDM networks. However, for federated identity management, it is necessary to establish a trust relationship between hospitals and cloud CDM, and when identity management is concentrated on a specific service provider, it has the same limitations as the centralized type. Federated IdM systems allow users at separate institutes to use the same verification method for access to applications and other resources. Identity federation delivers efficiency to institutes, as it allows them to streamline the processes for verifying their users. This federated IdM model implies a separation of the authentication performed by the IdP and the authorization performed on behalf of the SP. In the federated identity model, some identity federation require the IdP administrators to explicitly give permission to pass on the user attributes to any SP. In a centralized or federated identity model, users create accounts to access systems and to authenticate transactions with many different identity providers. Organizations collect and store personal and sensitive information about their users to enable services. This results in our digital identities being spread all over the web, making identity theft, credential compromise, and breaches a real possibility with potentially significant long-term impacts for both individuals and businesses. However, it is not easy to protect the problem caused by security breaches resulting in unauthorized access to personal data in the organization. In the cloud CDM, most SPs play a role as IdPs, as shown in Figure 2. If they desire to use services from the SP, such dual personality compels users to register within its domain [18]. For a better understanding, the following is the operation scheme in a cloud CDM. A researcher has the researcher ID of the researcher portal and submits the researcher information to the IRB. The IRB stores the researcher information in the research workflow based on the researcher information. After that, the IRB provides the researcher with approval or refusal to conduct the research. The investigator uses their investigator IDto access the CDM provider, which passes the investigator ID to the IRB. After the IRB confirms the researcher's eligibility to conduct the research through the research workflow, the CDM provider sends approval or refusal to the CDM provider. The CDM provider, which plays the role of an SP in the corresponding cloud CDM, depends on the research workflow of the IRB to access its own service. The current central identity management method delegates the management responsibility of the IRB to the researcher, and the delegation of the IRB follows the processing flow of the central model and has difficulties in the detailed management of the researcher's qualifications. It has a security vulnerability by using only the fixed researcher ID for user authentication.