Periodic Reporting for period 2 - OLYMPUS (Oblivious identitY Management for Private and User-friendly Services) Reporting period: 2020-03-01 to 2021-11-30 Summary of the context and overall objectives of the project OLYMPUS project will leverage the central concept of oblivious identity management in order to realize the convenience of online identity management without introducing a central identity provider that forms a single point of failure in terms of security and privacy.The main problem with the former solutions is that the trusted third party becomes a security and privacy bottleneck in the system, as it can impersonate and track its users online. The main issues hampering of wider usage of Privacy-ABCs are that service providers have to change their infrastructure to support Privacy-ABCs, and that users have to rely on secure hardware such as smartcards or secure elements. The latter is not only needed to protect credentials against compromise, but also to prevent illegitimate sharing of credentials. This is a particular problem in privacy preserving solutions: whereas the accounts of uniquely identified users can easily be blocked as soon as abuse is detected, the same cannot be done for anonymous users, thereby removing a deterrent for users to share their credentials.The oblivious identity management scheme proposed by OLYMPUS will be associated to the use of privacy-preserving identity management solutions by establishing an interoperable European identity management framework based on novel cryptographic approaches applied to currently deployed identity management technologies.The design will be integrated into popular existing identity solutions such as SAML, Identity Mixer, or OpenID Connect in order to minimize the changes required for service providers. OLYMPUS will also address the security problems of virtual identities by linking citizens’ physical identities to their digital identities, but in such a way that new digital identities can be derived to preserve citizens’ privacy when accessing different online and offline services.The objectives of OLYMPUS are aligned with these requirements. These goals are:· Establish an oblivious identity management framework that ensures secure and privacy friendly virtual identity management interactions for citizens accessing services in Europe, based on novel cryptographic mechanisms. More specifically, the developed mechanisms will use distributed cryptography to split up the role of the IDP over multiple authorities, thereby preventing any single authority from tracking or impersonating its users. Design and development of a secure infrastructure to enable citizens to use different virtual identities when accessing different online/offline services, supporting privacy preservation and anonymization capabilities.· Establish solid links between citizens’ physical and digital identities and the derivation of additional digital identities to enable privacy-preserving transactions backed by strong identities for citizens. To this end, user surveys will be conducted to understand how to create a user experience in which these novel technologies are used. Based on these, the design and development of user-friendly tools will be required to foster the full acceptance of the different stakeholders.· Ease the integration of the OLYMPUS identity management system into existing technologies and deployments by minimizing the requirements on user hardware, offering user-friendly authentication using passwords or biometrics, without requiring trusted hardware or software. Also, minimize the impact on service providers by adhering as closely as possible to existing identity management frameworks (IdM) such as SAML, Identity Mixer, or OpenID Connect. Such integration will be built upon the results of previous EU projects by considering a multidisciplinary environment in which OLYMPUS approach is aligned with eIDAS and GDPR regulations.· Validate and evaluate the OLYMPUS framework in high-impact real-world scenarios that allow to prove the feasibility and advantages of the proposed ecosystem to address technological, legal and social requirements on secure digital identities in Europe. Also, to perform user studies to improve and validate the user interfaces of the OLYMPUS framework.Finally, OLYMPUS will produce a GDPR-compliant procedural and legal standard to make use of the obliviously identity management scheme in real business processes, maximising user privacy while maintaining or even increasing the security levels required by service providers. The application of GDRP recognized security measures such as data minimisation and separation, pseudonyms and cryptographic techniques will also reduce legal risk to service providers, especially in respect to explicit consent management. Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far WP1 sets up the “ethic requirements” that the OLYMPUS project must comply with. In that sense the corresponding requirements deliverables have been submitted.WP2 deals with the management of the project. Financial, Scientific and Technical monitoring activities have been performed from the start of the project. Also the Quality Assurance Plan has been created.WP3: A set of technical and legal requirements for Enhanced Digital Identity has been defined, which together with the previously identified use cases, result in the OLYMPUS architecture blueprint.WP4: A core cryptographic protocol called PESTO was jointly developed by the partners. Both PESTO and suitable plug-in modules for the offline use case have been implemented.WP5: Various interfaces suitable for external integration of the cryptographic protocols have been defined. Implementation work and configuration of an automated test environment has also been carried out.WP6: A first testing phase integrated the use cases with the existing IDEMIX solution. A second phase started after the first PESTO implementation, integrating the pilots with the solution.As part of WP7 activities, OLYMPUS has been presented in international conferences and to the ISO Working Group responsible for the Mobile Drivers’ Licence. Several papers were accepted at prestigious scientific conferences and journals. Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far) OLYMPUS objective it is to define, design and develop the main mechanisms to realize the oblivious IdM system. After an initial phase of reviewing existing technologies and literature and collecting desireable functionality and security aspects of the OLYMPUS IdM system, a core cryptographic protocol called PESTO was jointly developed by the partners. PESTO is a flexible password-authenticated distributed Single Sign On solution that can be easily adapted to the offline/mobile Drivers Licence use case. It has strong security properties and distributes trust among a set of identity providers. Consecutively to the development phase, both PESTO and suitable plug-in modules for the offline use case have been implemented. GDPR-related constraints were discussed in the consortium and will be taken into account in the prototype.The OLYMPUS IdM solution will be tested on two use cases. As the initial phase of WP6, the consortium discussed the needs of the use cases and, as a result, a collection of requirements was defined to be used in WP3. That led to a first testing phase where the use cases were integrated with the existing IDEMIX solution meanwhile the first implementation of PESTO protocol was being implemented. Once a first PESTO implementation was developed, the integration of the pilots with the solution has started. The purpose of this integration is to evaluate the OLYMPUS IdM solution by covering the online and offline scenarios and its results. imagen1.png
