Providing Secured Access Delegation in Identity Management Systems

• Tipo: Artigo em Livro de Atas de Conferência Internacional
• Data: 2020

Autores

Shehu, AS (Autor) Outra; Pinto, A (Autor) Outra; Manuel E Correia (Autor) FCUP

Ata de Conferência Internacional

Título: Proceedings of the 17th International Joint Conference on e-Business and Telecommunications, ICETE 2020 - Volume 2: SECRYPT, Lieusaint, Paris, France, July 8-10, 2020.

Páginas: 638-644

Indexação

ISI Web of Knowledge - 0 Citações

Scopus - 2 Citações

Classificação Científica

FOS: Ciências exactas e naturais > Ciências da computação e da informação

CORDIS: Ciências Tecnológicas > Engenharia > Engenharia de computadores

Outras Informações

ID Authenticus: P-00S-GJM

DOI: 10.5220/0009892206380644

Abstract (EN): The evolutionary growth of information technology has enabled us with platforms that eases access to a wide range of electronic services. Typically, access to these services requires users to authenticate their identity, which involves the release, dissemination and processing of personal data by third parties such as service and identity providers. The involvement of these and other entities in managing and processing personal identifiable data has continued to raise concerns on privacy of personal information. Identity management systems (IdMs) emerged as a promising solution to address major access control and privacy issues, however most research works are focused on securing service providers (SPs) and the services provided, with little emphases on users privacy. In order to optimise users privacy and ensure that personal information are used only for intended purposes, there is need for authorisation systems that controls who may access what and under what conditions. However, for adoption data owners perspective must not be neglected. To address these issues, this paper introduces the concept of IdM and access control framework which operates with RESTful based services. The proposal provides a new level of abstraction and logic in access management, while giving data owner a decisive control over access to personal data using smartphone. The framework utilises Attribute based access control (ABAC) method to authenticate and authorise users, Open ID Connect (OIDC) protocol for data owner authorisation and Public-key cryptography to achieve perfect forward secrecy communication. The solution enables data owner to attain the responsibility of granting or denying access to their data, from a secured communication with an identity provider using a digitally signed token.

Idioma: Inglês

Tipo (Avaliação Docente): Científica

Nº de páginas: 7