OIDC-PRINCE: OpenID Connect with Privacy-Enhanced Consents
Tiago Galvão, Bernardo Arzileiro, Bruno C. de Sousa · 2024
The OIDC-PRINCE project strives to enhance privacy support in user consents for OpenID Connect authentication and authorization mechanisms. It concentrates on educating users about the potential risks of granting access to their personal data to services or organizations that may not be entirely trusted by the user or the OpenID Provider. OIDC-PRINCE incorporates GDPR compliance verification within the OIDC discovery and registration stages by utilizing the Data Privacy Vocabulary (DPV) specification. These verifications may be validated by third-party entities outside the OIDC authentication process and securely preserved on an EVM-compatible blockchain. Further-more, OIDC-PRINCE enables privacy assessments to evaluate the risks related to services that access users' private data. OIDC-PRINCE improves privacy support in OpenID Connect by facilitating informed consents and reducing data sharing with entities that are either untrustworthy or do not demonstrate reliable privacy management practices.