Self-Sovereign Identity (SSI), as a new and promising identity management paradigm, needs mechanisms that can ease a gradual transition of existing services and developers towards it. Systems that bridge the gap between SSI and established identity and access management have been proposed but still lack adoption. We argue that they are all some combination of too complex, locked into specific ecosystems, have no source code available, or are not sufficiently documented. We propose a comparatively simple system that enables SSI-based sign-ins for services that support the widespread OpenID Connect or OAuth 2.0 protocols. Its handling of claims is highly configurable through a single policy and designed for cross-device authentication flows involving a smartphone identity wallet. For external interfaces, we solely rely on open standards, such as the recent OpenID for Verifiable Credentials standards. We provide our implementation as open-source software intended for prototyping and as a reference. Also, we contribute a detailed technical discussion of our particular sign-in flow. To prove its feasibility, we have successfully tested it with existing software and realistic hardware.
Authentication with username and password is becoming an inconvenient process for the user. End users typically have little control over their personal privacy, and data breaches effecting millions of users have already happened several times. We have implemented a proof of concept decentralized OpenID Connect Provider by marrying it with Self-Sovereign Identity, which gives users the freedom to choose from a very large pool of identity providers instead of just a select few corporations, thus enabling the democratization of the highly centralized digital identity landscape. Furthermore, we pr…
Millions of users routinely use Google to log in to websites supporting OAuth 2.0 or OpenID Connect; the security of OAuth 2.0 and OpenID Connect is therefore of critical importance. As revealed in previous studies, in practice RPs often implement OAuth 2.0 incorrectly, and so many real-world OAuth 2.0 and OpenID Connect systems are vulnerable to attack. However, users of such flawed systems are typically unaware of these issues, and so are at risk of attacks which could result in unauthorised access to the victim user's account at an RP. In order to address this threat, we have developed OAut…
User credentials security is one of the most important tasks in Web World. Most Web sites on the Internet that support user accounts store the users credentials in a database. Now a days, most of the web browsers offer auto login feature for the favorite web sites such as yahoo, google, gmail etc. using these credential information. This facilitates the misuse of user credentials. Privatizing user credential information of web services in a shared user environment provides a feature enhancement where the root user will be able to privatize his stored credentials by enforcing some masking techn…
Identity-Bound Academic Credentials on Blockchain: On-Chain Issuer Accreditation with ERC-3643 and OnchainID
Instituto Superior Técnico, Universidade de Lisboa（里斯本大学高等技术学院）；Instituto de Engenharia de Sistemas e Computadores, Investigação e Desenvolvimento em Lisboa (INESC-ID)（里斯本系统计算机工程研究所（INESC-ID））；Instituto Superior de Engenharia de Lisboa, Instituto Politécnico de Lisboa（里斯本理工学院高等工程学院）
In order to increase the value of scientific datasets and improve research outcomes, it is important that only trustworthy data is used. This paper presents mechanisms by which scientists and the organisations they represent can certify the authenticity of characteristics and provenance of any datasets they publish so that secondary users can inspect and gain confidence in the qualities of data they source. By drawing on data models and protocols used to provide self-sovereign ownership of identity and personal data to individuals, we conclude that providing self-sovereignty to data assets off…
COD-ssi: Enforcing Mutual Privacy for Credential Oblivious Disclosure in Self Sovereign Identity
King Abdullah University of Science and Technology (KAUST)（阿卜杜拉国王科技大学）；Institute of Applied Sciences and Intelligent Systems (ISASI), National Research Council of Italy (CNR)（意大利国家研究委员会应用科学与智能系统研究所）；Istituto di Informatica e Telematica (IIT)（信息与电信研究所）；Department of Computer Science, National Research Council of Italy (CNR), University of Pisa（比萨大学计算机系，意大利国家研究委员会）
Vulnerable individuals have a limited ability to make reasonable financial decisions and choices and, thus, the level of care that is appropriate to be provided to them by financial institutions may be different from that required for other consumers. Therefore, identifying vulnerability is of central importance for the design and effective provision of financial services and products. However, validating the information that customers share and respecting their privacy are both particularly important in finance and this poses a challenge for identifying and caring for vulnerable populations. …
Understanding the Identity-Transformation Approach in OIDC-Compatible Privacy-Preserving SSO Services
School of Cyber Security, University of Science and Technology of China（中国科学技术大学网络空间安全学院）；Beijing Zitiao Network Technology Co., Ltd, China（北京字跳网络技术有限公司）；School of Cryptology, University of Chinese Academy of Sciences（中国科学院大学密码学学院）
Several years of academic and industrial research efforts have converged to a common understanding on fundamental security building blocks for the upcoming Vehicular Communication (VC) systems. There is a growing consensus towards deploying a Vehicular Public-Key Infrastructure (VPKI) enables pseudonymous authentication, with standardization efforts in that direction. However, there are still significant technical issues that remain unresolved. Existing proposals for instantiating the VPKI either need additional detailed specifications or enhanced security and privacy features. Equally importa…
The US Department of Transportation (USDOT) issued a proposed rule on January 12th, 2017 to mandate vehicle-to-vehicle (V2V) safety communications in light vehicles in the US. Cybersecurity and privacy are major challenges for such a deployment. The authors present a Security Credential Management System (SCMS) for vehicle-to-everything (V2X) communications in this paper, which has been developed by the Crash Avoidance Metrics Partners LLC (CAMP) under a Cooperative Agreement with the USDOT. This system design is currently transitioning from research to Proof-of-Concept, and is a leading candi…
Credential Control Balance: A Universal Blockchain Account Model Abstract From Bank to Bitcoin, Ethereum External Owned Account and Account Abstraction
Hybrid Scheme of Post-Quantum Cryptography and Elliptic-Curve Cryptography for Certificates -- A Case Study of Security Credential Management System in Vehicle-to-Everything Communications
Pseudonym Scheme Based on Hybrid Certificates for Security Credential Management System in Vehicular Communications
Department of Information and Finance Management, National Taipei University of Technology（国立台北科技大学资讯与财务管理系）；Department of Information Engineering, Feng Chia University（逢甲大学资讯工程学系）
Trustworthy Blockchain-based Federated Learning for Electronic Health Records: Securing Participant Identity with Decentralized Identifiers and Verifiable Credentials
Federal Institute of Education, Science, and Technology of Rio Grande do Norte (IFRN)（里约格兰德北教育科学和技术联邦学院）
In medical emergencies, an instant and secure messaging is an important service to provide quality healthcare services. A session initiation protocol (SIP) is an IP-based multimedia and telephony communication protocol used to provide instant messaging services. Thus, design of secure and efficient SIP for quality medical services is an emerging problem. In this paper, we first explore the security limitations of the existing SIPs proposed by Sureshkumar et al. and Zhang et al. in the literature. Our analysis shows that most of the existing schemes fail to protect the user credentials when une…
