Home

Privacy-Enhanced Credentials Going Live – From Theory to Practice, ABC4Trust tutorial at CSP EU Forum, Berlin April, 24th 2012

ABC4Trust will hold a tutorial session at the Cyber Security & Privacy EU Forum 2012 (CSP EU FORUM) under the title “Privacy-Enhanced Credentials Going Live – From Theory to Practice”. The tutorial will be part of the CSP EU Forum  in Berlin, Germany,  on April, 24th 2012.

[Update] The organizers published the agenda with the time slot for our tutorial. Join us on the first day of the conference (April 24th) between 16:00 and 18:00. Please note also that the CSP EU forum is now open for registration.

Trustworthy authentication and authorization is one of the main ingredients to ensure secure transactions over the Internet. The currently prevalent solution for user-authentication is by username and password. In case the authorization requires information about the user such as address or credential card number, these information are typically obtained by exchange with other service providers. Increasingly, cryptographic approaches such as X.509 certificates are used that offer stronger security guarantees. Both of these approaches have considerable privacy concerns. Briefly, the users have to reveal their full identity and personal data to one or more service providers even though that amount of information would not be strictly necessary.
In tutorial session the presenters will discuss how Privacy-ABCs can provide the same, or better, level of strong authentication while preserving the privacy of the user. In a nutshell, privacy-ABCs allow the user to establish several partial identities (1) with each service provider, where they only disclose the information that is minimally required for this purpose. For instance, it often might be sufficient to prove the mere fact that the user is over 18 instead of revealing the full date of birth.
The technology to deploy privacy attribute-based credentials is already available with IBM's Identity Mixer  and Microsoft's U-Prove. Currently, both are being integrated and used for two pilots in the EU-funded project ABC4Trust project which takes up the heritage of the European PRIME  and PrimeLife  projects.
This tutorial aims at providing a better understanding of the features and concepts of Privacy-ABCs and its potential application areas. We will also discuss how the ABC4Trust project advances the current state by identifying a common architecture (2) and deploying Privacy-ABCs in real-life environments. Presentations of the two pilot scenarios and a legal assessment of such privacy-enhancing technologies will complete this tutorial.
 
Agenda of the Tutorial session
More precisely, the tutorial consist of the following three parts:

Features & Concepts of Privacy-ABCs
Jan Camenisch, Anja Lehmann

In the first part of the tutorial we will discuss the privacy issues that are inherent in the currently deployed authentication technologies and show that Privacy-ABCs are a solution that is superior to those. To this end, we will present the main features and concepts of privacy-enhanced attribute-based credentials, such as minimal and conditional disclosure of attributes and the use of unlinkable, yet strictly user-bound, pseudonyms. We will also discuss how traditional features such as revocation or usage-limitation can be achieved for those credentials in a privacy-respecting manner. After having learned about the common capabilities of Privacy-ABCs we will also briefly introduce the cryptographic technologies that are used in Idemix and U-Prove to build such a credential system. (3)
To facilitate the integration and dissemination of Privacy-ABC, the ABC4Trust project now aims at developing a common architecture that can encompass those different underlying technologies by providing common data formats and interfaces that can be used by the high-level applications. This tutorial will include the presentation of a first version of this ABC4Trust architecture, with focus on the technology-independent policy and credential handling.
Use-case examples that will show different practical applications of Privacy-ABCs and their required features complete this first part of the tutorial.

Real-life Pilots
by Souheil Bcheri

In the second part of the tutorial we will present the two pilots of ABC4Trust project that will deploy Privacy-ABCs in real-life environments. The Swedish pilot will use the ABC technology in a Swedish school environment (in Söderhamn) to provide trusted identification while simultaneously protecting the privacy and anonymity of pupils in a social network application. More precisely, the Swedish School Pilot  will develop a new Web Based School Community Application to be used for chat communication, counseling, political discussions, and exchange of sensitive and personal data between pupils, parents, and school personnel such as teachers, administrators, coaches, nurses and psychologist.
Our second pilot  will be performed at the Patras University in Greece, where ABC technology will be used for online course evaluation, to ensure that only eligible students can participate in the evaluation, while guaranteeing their anonymity.

Legal Assessment on Attribute-based Credentials
by Harald Zwingelberg

Privacy-ABCs allow meeting a series of privacy requirements in particular for the authentication and identification processes. They help with data minimization efforts and adhering to the principle that only necessary personal data may be processed. These and other legal privacy requirements need to be assessed for any system processing personal data. This should be done right in the planning phase to ensure legal compliance and to avoid cost intensive redesign (Privacy by Design). During the tutorial Privacy Protection Goals will be described. These allow an assessment of information technology systems by identifying privacy and security requirements and balancing them with appropriate measures in case of conflicting goals.



References
(1) Read more about the concept of partial identities in reports of the PrimeLife project: Partial identities supporting privacy protection throughout a persons lifetime and legal aspects are have been addressed “H1.3.5: Requirements and concepts for identity management throughout life”. The deployment of partial identities in different settings such as healthcare, education and (public) registers has been analysed in “H1.3.3 Analysis  of  Privacy  and Identity Management  throughout  Life”.

(2) See ABC4Trust Deliverable “D2.1 Architecture for Attribute-based  
Credential Technologies – Version 1 ” for the current design of the architecture to be piloted with in ABC4Trust. The Architecture document will be updated at the end of the project to incorporate the results and enhancements from the pilot trails.

(3) Video recordings of a previous tutorial on Attribute-based Credentials are available here.