User Identification of Pseudonyms without Identity Information Exposure in Access Federations
Sato Hiroyuki, Yasuo Okabe, Motonori Nakamura · 2016
The concept and design of access federations have been widely accepted and their world-wide deployment is in progress. In an access federation, control of user information (personal identification information) is a key issue in its operation in terms privacy. Pseudonym is proposed and implemented as a solution to this problem. We consider a case where the requirement of privacy protection by using pseudonyms and that of user identification for service providing conflict with each other. In this paper, we propose a “counting server” for identification of different pseudonyms or social identities. SPs can use this identification information to provide special services such as student discount and limit of use. We also show an implementation of this scheme on Shibboleth/SAML platforms. Related protocols are designed, another SAML engine are provided on SP, and counting server is provided. Furthermore, we analyze this scheme, and proves the security properties.