Friday, February 20, 2015

SPID and User Perspective about Privacy

In the last blog, I’ve introduced the Italian Digital Identity Initiative, called SPID (Sistema Pubblico Identit√† Digitali).

Technically, SPID will provide an Identity ecosystem for trusted digital identities based on a federated Identity Management system, where citizen can access to public administration (or private) online service using trusted credentials, with the goals to improve accessibility, trust and online security.

With SPID, from an user experience standpoint, when user attempts to access to a online service (Service Provider or Relying Party), he/she is redirect to a Identity Provider (IdP) for the authentication process.

The mechanism is based on SAMLv2 protocol, where the Service Provider (SP) initializes the process (SP-initiated-SSO), requiring an authentication assertion, with a specific level of assurance, to the Identity Provider. Based on user authentication the IdP releases an authentication assertion to the SP.

This approach introduces a potential issue about the user’s privacy, indeed the direct interaction between the SP and IdP, allow the IdP to trace the user transaction with online services, that is the IdP know which government service (or private services) they’re accessing. Considering that the Identity Providers will be, mainly, private companies, this can be a real threat to the user's privacy, which need to be addressed with appropriate regulations and technical solutions.

A possible approach to this problem, with the goal to mitigate user's privacy issue, is the Identity Hub model, which is used in other digital identity initiatives around the world, like Connect.Gov (US) and Gov.UK Verify (UK).

Connect.Gov, for example, acts as Hub and it’s in charge to manage the communication between customers, online agency applications and Identity Providers. "The service allows customers to establish their identity in a secure, privacy-enhancing manner, while also providing government agencies assurance of valid customer identification."