## 3 Literature Review
### Traditional IDMSs  
In [3], a study concerning Digital Identity and IDM Technologies, the author illustrated a variety of technologies used in the field of IDM. Among the several competing standards in the IDM field, the security assertion markup language (SAML) was the only applicable choice, as it had a high level of acceptance at that time. This is because it was part of the solution to the problem of single sign-on. Later, another technology emerged and received some attention in the community, called the WS-Federation. As users need to have multiple identities for different service providers, the multiple identities used can cause a degree of inconvenience to the user in terms of managing them. The author concluded that both are similar in functionality but had different names: IDP and the service provider in SAML; security token service and relying party in WS-Federation. Microsoft CardSpace is a claim-based IDM system proposed by Microsoft to satisfy the seven laws of identity. It gives the user the right to control their digital identities and choose the card after they have completed the SP policy through the identity selector. The identity selector is the intermediary between the user, the IDP, and the SP, as they retrieve the security policy after the user picks the card and completes the user authentication with the IDP on behalf of the user, and then forwards the security token to the SP to log the user in after they have received it from the IDP. The system guarantees the integrity of security tokens through an xml-signature and preserves the confidentiality of the IDP and SP security policies by making transactions over an SSL/TLS channel. However, this model violates user privacy, as it requires presenting the user credentials to the identity selector. Another drawback for this model is that the user must carry out the authentication step every time before a token is issued [42]. Another research study, this time conducted by the Liberty Alliance project, was a single sign-on federated IDMS proposed in 2001. The project proposed several frameworks: the identity federation framework (ID-FF), the identity web services framework (ID-WSF), the identity service interface specification (ID-SIS), the Liberty identity assurance framework (LIAF), and the identity governance framework (IGF). The authentication and authorization frameworks were separated in the system. The user in the Liberty Alliance system was monitored by the IDP, as they knew who all the services providers were accessed by the user, which violated user privacy [6]. In [48], researchers introduced Shibboleth, which is a Federated IDMS, and its single sign-on framework, but it does not support single sign-off. The proposed system tries to increase user privacy by using a short-term, random ID to maintain anonymity. Unlike the previous project, the authentication and authorization frameworks can be combined. In Shibboleth, IDP discovery is performed by the SP using the WAYF technique, which can increase the risks to the user by connecting with a fake IDP, redirecting them via a malicious SP. This also increased the risk of stolen credentials. The OpenID system is an open-source IDMS, released in 2005. It supports SSO and uses the concept of a global identifier to enable the user to contact any OpenID-enabled SP. The system does not use any proof of rightful possession, which makes it vulnerable to the risk of credential theft. In addition, it may create other risks such as directing the user to a fake IDP via a malicious SP, and the risk of a man-in-the-middle (MITM) attack [44]. Reference [43] suggested two proposed solutions in the implementation layer to improve the level of authentication with the user in a claim-based IDMS. A proof-of-authenticity method and challenge-response method appeared as suggested solutions to solve the problem of the malicious IDP, which may cause considerable damage to the SP and the user.