User Identification of Pseudonyms without Identity Information Exposure - A Scenario in Access Federations

Abstract

The concept and design of access federations have been widely accepted and their world-wide deployment is in progress. In an access federation, control of user information (personal identification information) is a key issue in its operation in terms of privacy. Pseudonym is proposed and implemented as a solution to this problem. We consider the case where the requirement of privacy protection by using pseudonyms and that of user identification for service providing conflict with each other. In this paper, we propose a “counting server” for the identification of different pseudonyms or social identities. SPs can use this identification information to provide special services such as student discount and limit of use. We also show an implementation of this scheme on Shibboleth/SAML platforms. Related protocols are designed, another SAML engine is provided on SP, and a counting server is provided. Furthermore, we analyze this scheme, and prove the security properties.