Authentication without Identiﬁcation Jan Camenisch · PDF file Authentication –...

© 2016 IBM Corporation
Authentication without Identification
Jan Camenisch IBM Research - Zurich

© 2016 IBM Corporation2 Jan Camenisch - Summer School TrentoJune 30, 2016
We all increasingly conduct our daily tasks electronically
Facts
....are becoming increasingly vulnerable to cybercrimes

33% of cyber crimes, including identity theft, take less time than to make a cup of tea.
Facts

10 Years ago, your identity information on the black market was worth $150. Today….
Facts

$4'500'000'000 cost of identity theft worldwide
Facts

ﾩ
Houston, we have a problem!

ﾩ
Houston, we have a problem!
“Buzz Aldrin's footprints are still up there” (Robin Wilton)

Computers don't forget
% Apps built to use & generate (too much) data
% Data is stored by default
% Data mining gets ever better
% New (ways of) businesses using personal data
% Humans forget most things too quickly
% Paper collects dust in drawers

Where's all my data?
The ways of data are hard to understand
% Devices, operating systems, & apps are getting more complex and intertwined
– Mashups, Ad networks – Machines virtual and realtime configured – Not visible to users, and experts – Data processing changes constantly
→ No control over data and far too easy to loose them

You have no privacy, get over it .....?!?
% Huge security problem! – Millions of hacked passwords (100'000 followers $115 - 2013) – Stolen credit card number ($5 - 2013) – Stolen identity ($150 - 2005, $15 - 2009, $5 – 2013) – Lots of not reported issues (industrial espionage, etc)
% Difficult to put figures down – Credit card fraud – Spam & marketing – Manipulating stock ratings, etc..
% We know secret services can do it easily, but they are not the only ones – this is not about homeland security – and there are limits to the degree of protection that one can achieve
% … end we have not event discussed social issues such as democracy etc
% last but not least: data are the new money, so need to be protected

What can we do?
% Most of the technology is there (but we have to use it)
% Most of the legislation is there (but we have to enforce it)
% Public awareness is growing (but we have to feed it)
→ Privacy by Design!

of course there are limits...
% tracing is so easy – each piece of hardware is quite unique – log files everywhere
% …. but that's not the point! – it's not about NSA et al. – active vs passive “adversaries”
so, still, privacy by design!

The real problem
Applications are designed with the sandy beach in mind but are then built on the moon.
– Feature creep, security comes last, if at all – Everyone can do apps and sell them – Networks and systems hard not (well) protected

We need paradigm shift & build stuff for the moon
rather than the sandy beach!
Security & Privacy is not a lost cause!

That means: % Reveal only minimal data necessary % Encrypt every bit % Attach usage policies to each bit
Cryptography can do that!
Security & Privacy is not a lost cause!

Business Case for Privacy
%Business case always depends on specific example %The bad news: data is money – so every one wants it
– Big data, sensors, etc. – Marketing
%No data is easier to protect than lots of data – e.g., losing credit card number
%Privacy is part of security – identity theft – getting access to and manipulating systems, etc.
%Laws are an important driver – like many other technical areas, cf. cars

Privacy by design....
@ Communication layer – TOR, JAP, etc
@ Authentication layer – privacy-preserving attribute-based credentials
@ Application layer – eVoting, ePolls, .... – all apps should be done as “privacy by design”

Cryptography at the network layer
Anonymous communication e.g., mix networks, onion routing (TOR), DC-nets
Bandwidth suffers Physical layer notoriously hard to protect

Privacy at the Authentication Layer Privacy Friendly Identity Management

What is an identity?
name
salary
credit card number
hobbies
phone number
address
language skills
leisure
shopping
work
public authority
nick name blood group
health care
marital status
birth date
health status
insurance

Identities – Identity Management
■ ID: set of attributes shared w/ someone – attributes are not static: user & party can add
■ ID Management: two things to make ID useful – authentication means – means to transport attributes between parties
■Control attributes with policies: – define requested data – define allowed usage (audience)
■ Privacy by design – minimal amount of data
→ Privacy-preserving attribute-based credentials

Identities Authentication and attribute transfer

Alice wants to watch a movie at Movie Streaming Service
Alice
Movie Streaming Service
I wish to see Alice in Wonderland

Alice wants to watch a movie at Movie Streaming Service
Alice
You need: - subscription - be older than 12

Watching the movie with the traditional solution
Alice
ok, here's - my eID - my subscription
Using digital equivalent of paper world, e.g., with X.509 Certificates

Alice
Aha, you are - Alice Doe - born on Dec 12, 1975 - 7 Waterdrive - CH 8003 Zurich - Married - Expires Aug 4, 2018
Mplex Customer - #1029347 - Premium Subscription - Expires Jan 13, 2016
...with X.509 Certificates

Alice
Aha, you are - Alice Doe - born on Dec 12, 1975 - 7 Waterdrive - CH 8003 Zurich - Married - Expires Aug 4, 2018
Mplex Customer - #1029347 - Premium Subscription - Expires Jan 13, 2016
This is a privacy and security problem! - identity theft - discrimination - profiling, possibly in connection with other services

Authentication – Traditional approach
ID Management: make ID useful – ID comes w/ authentication means
– Transport of attributes
Is really just paper world made electronic!
% Alice has public and private key % Can use cryptographic identification protocols to
authenticate as owner
% Certificate issued by one party, certificate contains attributes
% Certificate is verified by other party w.r.t. Issuing party's public key (public verification key)

Authentication without Identiﬁcation Jan Camenisch · PDF file Authentication –...

Documents

Transcript of Authentication without Identiﬁcation Jan Camenisch · PDF file Authentication –...

Marco Camenisch: İsyankar bir hayat

Cryptanalysis of Two Dynamic ID-based Authentication Schemes for Multi-Server Architecture

Wireless Authentication Types on Fixed ISR Through Authentication Types on Fixed ISR Through SDM Configuration Example Document ID: 98584 Contents Introduction Prerequisites Requirements

Jonathan Wenk & Kenneth Camenisch PHOTOGRAPHY Matthew Barton Nadia Borowski Aaron Camenisch Mark Cornelison Stephen Patton ... assists students with resume reviews and mock interviews.

Secrets in the Cloud - files. · PDF file spring.application.name + user id (e.g. IP or MAC address) machine authentication role id + secret id cryptographically signed metadata of

FACT SHEET Promoting Caller ID Authentication to Combat ... · PDF file Caller ID authentication technology enables voice service providers to verify that the caller ID information

JAAS Login Modules - · PDF fileUser-centric approach with two components: Authentication (-> login modules) ... Anonymous/guest access User ID / password Form based Basic authentication

PSD2 - Online ID and Strong Authentication in Turmoil

User Authentication: ID protocols - Stanford Crypto Group

Active Authentication to Protect IT Assets - Onion ID

All in One Device for ID Scanning & Authentication · PDF file All in One Device for ID Scanning & Authentication Infi nitID™ off ers the fi rst all in one identity document authentication

User Authentication: ID protocols

Digital ID and Authentication as a Platform

1 Cryptanalysis of Two Dynamic ID-based Authentication Cryptanalysis of Two Dynamic ID-based Authentication Schemes for Multi-Server Architecture Schemes

â€™12 iPECS Training V5.6/V6.0 Features. 1. Security Enhancement IP Authentication 407 Authentication ID and Password (any one can not see password) TLS

Biometric Authentication via IEEE 2410 and Decentralized ... · PDF file 9/19/2018 · Biometric Authentication via IEEE 2410 and Decentralized Identifiers (DIDs) National ID cards:

RFID-based Vehicle Authentication & Confidential ©NeoTechID 2012 RFID Authentication - Overview • RFID tags attached to vehicles • Vehicle ‘ID’ mapped to vehicle owner / group

White Paper on Mobile ID - S ... applications and authentication protocols like FIDO (online authentication), GSMA Mobile Connect (telecommunication sectors), VPN RADIUS (enterprise

Analysis of Palmprint Authentication System Using Analysis of Palmprint Authentication System Using Wavelet Based Multi 573 2. Government applications such as national ID card, correctional

EFM32 USB Smart Card Reader • Secure ID - employee ID badges, citizen ID documents, electronic passports, driver's licenses, online authentication devices • Healthcare - citizen