Improving the security of cardspace

Authors:
Waleed A. Alrodhan;Chris J. Mitchell
Affiliations:
Information Security Group, Royal Holloway, University of London, Egham, Surrey, UK;Information Security Group, Royal Holloway, University of London, Egham, Surrey, UK
Venue:
EURASIP Journal on Information Security
Year:
2009

Citing 5
Cited 0

Zero knowledge proofs of identity

STOC '87 Proceedings of the nineteenth annual ACM symposium on Theory of computing
Handbook of Applied Cryptography

Handbook of Applied Cryptography
Efficient Identification and Signatures for Smart Cards

CRYPTO '89 Proceedings of the 9th Annual International Cryptology Conference on Advances in Cryptology
Establishing and protecting digital identity in federation systems

Proceedings of the 2005 workshop on Digital identity management
Addressing privacy issues in CardSpace

IAS '07 Proceedings of the Third International Symposium on Information Assurance and Security

Quantified Score

Hi-index	0.00

Visualization

Abstract

CardSpace (formerly known as InfoCard) is a digital identity management system that has recently been adopted by Microsoft. In this paper we identify two security shortcomings in CardSpace that could lead to a serious privacy violation. The first is its reliance on user judgements of the trustworthiness of service providers, and the second is its reliance on a single layer of authentication. We also propose a modification designed to address both flaws. The proposed approach is compatible with the currently deployed CardSpace identity metasystem and should enhance the privacy of the system whilst involving only minor changes to the current CardSpace framework. We also provide a security and performance analysis of the proposal.