OLYMPUS project will leverage the central concept of oblivious identity management in order to realize the convenience of online identity management without introducing a central identity provider that forms a single point of failure in terms of security and privacy.
The main problem with the former solutions is that the trusted third party becomes a security and privacy bottleneck in the system, as it can impersonate and track its users online. The main issues hampering of wider usage of Privacy-ABCs are that service providers have to change their infrastructure to support Privacy-ABCs, and that users have to rely on secure hardware such as smartcards or secure elements. The latter is not only needed to protect credentials against compromise, but also to prevent illegitimate sharing of credentials. This is a particular problem in privacy preserving solutions: whereas the accounts of uniquely identified users can easily be blocked as soon as abuse is detected, the same cannot be done for anonymous users, thereby removing a deterrent for users to share their credentials.
The oblivious identity management scheme proposed by OLYMPUS will be associated to the use of privacy-preserving identity management solutions by establishing an interoperable European identity management framework based on novel cryptographic approaches applied to currently deployed identity management technologies.
The design will be integrated into popular existing identity solutions such as SAML, Identity Mixer, or OpenID Connect in order to minimize the changes required for service providers. OLYMPUS will also address the security problems of virtual identities by linking citizens’ physical identities to their digital identities, but in such a way that new digital identities can be derived to preserve citizens’ privacy when accessing different online and offline services.
The objectives of OLYMPUS are aligned with these requirements. These goals are:
· Establish an oblivious identity management framework that ensures secure and privacy friendly virtual identity management interactions for citizens accessing services in Europe, based on novel cryptographic mechanisms. More specifically, the developed mechanisms will use distributed cryptography to split up the role of the IDP over multiple authorities, thereby preventing any single authority from tracking or impersonating its users. Design and development of a secure infrastructure to enable citizens to use different virtual identities when accessing different online/offline services, supporting privacy preservation and anonymization capabilities.
· Establish solid links between citizens’ physical and digital identities and the derivation of additional digital identities to enable privacy-preserving transactions backed by strong identities for citizens. To this end, user surveys will be conducted to understand how to create a user experience in which these novel technologies are used. Based on these, the design and development of user-friendly tools will be required to foster the full acceptance of the different stakeholders.
· Ease the integration of the OLYMPUS identity management system into existing technologies and deployments by minimizing the requirements on user hardware, offering user-friendly authentication using passwords or biometrics, without requiring trusted hardware or software. Also, minimize the impact on service providers by adhering as closely as possible to existing identity management frameworks (IdM) such as SAML, Identity Mixer, or OpenID Connect. Such integration will be built upon the results of previous EU projects by considering a multidisciplinary environment in which OLYMPUS approach is aligned with eIDAS and GDPR regulations.
· Validate and evaluate the OLYMPUS framework in high-impact real-world scenarios that allow to prove the feasibility and advantages of the proposed ecosystem to address technological, legal and social requirements on secure digital identities in Europe. Also, to perform user studies to improve and validate the user interfaces of the OLYMPUS framework.
Finally, OLYMPUS will produce a GDPR-compliant procedural and legal standard to make use of the obliviously identity management scheme in real business processes, maximising user privacy while maintaining or even increasing the security levels required by service providers. The application of GDRP recognized security measures such as data minimisation and separation, pseudonyms and cryptographic techniques will also reduce legal risk to service providers, especially in respect to explicit consent management.
