Introduzione ad UMA. Parte I

Questo è il primo di una serie di post che ha l'obiettivo d’illustrare il protocollo User-Managed Access (UMA)  e le principali esigenze che intende indirizzare.

Che cos'è UMA
UMA  è un protocollo progettato per fornire ad un utente web (Authorizing User) un punto di controllo unificato per autorizzare chi e cosa può ottenere l'accesso ai propri dati personali on-line (come attributi d'identità ), il contenuto (come foto) e servizi (come la visualizzazione e la creazione/aggiornamento di uno stato), non importa dove tutte queste informazioni risiedono sul web.

UMA permette all'utente di verificare l'idonietà della parte richiedente (Requesting Party) che riceve l'autorizzazione per l'accesso ai dati personali. Le verifiche possono includere le richieste di informazioni (ad esempio "Chi sei? oppure "hai piu' di 18 anni?") e promesse (ad esempio "Sei d'accordo sui termini di divulgazione di queste informazioni", oppure " puoi confermare che le tua privacy e le politiche di portabilità del dato corrispondono ai miei requisiti?").

La figura seguente illustra il modello architetturale di alto livello e i principali attori coinvolti nel processo autorizzativo del protocollo UMA.

Come UMA indirizza i requisiti di privacy dell’utente e di controllo dell'uso dei dati?
Le verifiche d’idonietà che l'utente potrebbe voler fare sul richiedente non possono essere risolte solo con sistemi di crittografia e protocolli web, ma è necessario fare ricorso ad accordi ed alla responsabilità delle parti.

UMA non adotta tecniche come DRM (Digital Rights Management), mediante il quale è possibile, utilizzando meccanismi crittografici, restringere l’accesso ai dati prima che i dati vengano inviati.
Più semplicemente e più convenientemente per l’utente finale, UMA pone l’attenzione, anche per una facilità di adozione, sulla visibilità dell’utente e sul controllo dell’accesso ai dati da parte di terzi.

UMA ha come obiettivo un livello minimo ragionevole di applicazione degli accordi autorizzativi, tali che se la parte richiedente va contro le promesse a cui ha aderito in fase di accesso, allora il soggetto interessato può ricorrere in giudizio.

Take Control of your Personal Data: An UMA perspective

Recently, the EU commission reviewed the Privacy Directive introducing new rules for the protection of personal data in a data sharing context. The reason is straightforward: the scale of data sharing and collections has increased spectacularly. Online services are increasing and individuals are encouraged to make personal information available publicly and globally.

Even though privacy is a complex problem with many facets - think about the new Google’s Privacy policy, which provide for combination of personal data across different services, and the concern for the compliance with European data protection legislation - there isn't an easy way to address these problems without a legal framework and respect for the individual.

Nevertheless, state of art technology can help individuals to reduce the risk of losing control of their personal data, empowering the user to control personal data distributed among service providers, using a centralized authorization service.

At the Kantara User-Managed Access (UMA) Work Group, headed by Eve Maler, we are developing specs that let an individual control the authorization of data sharing and service access made between online services on the individual's behalf.

UMA is designed with Privacy in mind, with the goal to address the concept of Privacy by Design. UMA is inspired by the paradigm:

"The goal of a flexible, user-centric identity management infrastructure must be to allow the  user to quickly determine what information will be revealed to which parties and for what purposes, how trustworthy those parties are and how they will handle the information, and what the consequences of sharing their information will be" - Ann Cavoukian, Information and Privacy Commissioner of Ontario (Privacy in the clouds). 

This approach helps to reduce sensibly the difficulties for individuals to stay in control of their personal data.

A typical scenario involves online registration for websites to allow an individual to access its online service. This scenario may involve an host where the individual stores the personal data, a requester, which is the website that provides the service and the Authorization Manager which provides the authorization decision on behalf of the individual.

Let me explain how this scenario matches the privacy paradigm in the UMA perspective:

What data will be revealed
Individuals can control what data will be revealed because they are involved in the protocol. First, the Subject must register the resource which is collecting the personal data with a centralized Authorization Manager. This allows individuals to maintain a centralized view of what data is being collected.

UMA goes beyond just informing people what will happen if something is shared; it lets them activily control sharing.

For what purpose
Individuals are an active part of defining the how the personal information will be handled in the data sharing process. With UMA’s centralized Authorization Manager, the Subject is able to define sharing policy (a connection), for what purposes the personal data is shared (or collected) and maintaining of control of it, including the possibility of canceling and disabling connection with service providers (Requester) at any time.

With which parties
Any attempts to access to personal data by any party (Requester), will be intercepted by a policy enforcement point (at the local service provider) and to alert the Authorization Manager, which is in charge of taking an authorization decision. In this specific scenario, the Authorization Manager interacts with the subject for requesting consent to grant the access to the own personal data.

The following picture shows an individual online consent request based on UMA User Experience study applied to a mobile context.

The Role of data Visualization
Visualization plays a fundamental role in creating an abstraction layer for controlling distributed personal data. Last summer, I had the opportunity to visit the Newcastle University for 4 weeks on the SmartAM project, which is implementing UMA spec, with the goal of studing and contributing to human interface aspects.

As a result of this study, we introduced two main concepts to enhance the level of control of personal data. First is the connection which defines the context of a data sharing policy. In other words, it’s a visualization technique that help the individual to define and determine what data will be revealed for what purpose, so it defines an appropriate context. The second one is an analytics feature which helps to maintain control of information which is revealed.

The picture below shows an example of how the individual would see all of the connections for own Personal data. In the middle of the example, “Personal Data” is shown in different contexts (i.e. Professional, University, Collab, etc.), each context includes Requester (MySelf, Person, Groups, ect.), which have access to the data and Applications which have access on behalf of the requester.

Building Trust
One of the most important and complex aspects for economic development and for encouraging individuals to adopt distributed authorization system is to build a trusted eco-system among Individual, Service Providers and Requester services. UMA WG is also defining a Trust Model in order to provide baselines to build technical and business Trust. At this link you can read a blog post that presents a brief introduction of the model.

UMA Tweet Chat

If you are interested in User-Managed Access (UMA) from a technical standpoint, including UMA spec, UMA implementations, development advice, best practices and intereroperability testing, don't miss the first-ever UMA Twitter chat on Wednesday, February 8, 2012, at 9-10am Pacific time.

The hosts will be:
Eve Maler, UMA group chair (@xmlgrrl) and
Maciej Machulak, UMA group vice-chair (@mmachulak).

The chat hashtag is #umachat. If you write in, be sure to use it! An easy way to follow along is to use TweetChat.com.

Join us!

UMA: Trust in a distributed authorization system

During the last UMA WG Webinar (slides) which was focused on multiple implementation demos and UMA's OpenID Connect relationship, I had the opportunity to explain the current UMA trust model. Here are some descriptive details about this model.
Many literatures try to define the concept of trust. According to the ITU-T X.509, Section 3.3.54, trust is defined as follows: “Generally an entity can be said to ‘trust’ a second entity when the first entity makes the assumption that the second entity will behave exactly as the first entity expects.”
UMA trust model is built on the following implications that are based on the UMA features:

• Host's Authorization decision is externalized to the Authorization Manager (AM).
• There is no relationship between a Requester and the Authorization manager prior to a request for access. 

Externalizing an authorization decision requires a formal registration process and consequently a delegation of protection of a resource.
Furthermore, because the AM does not know the requester directly, it has to use information from third parties who know the requester better. Normally, the AM trusts these third parties only for certain things and only to certain degrees.
These trust and delegation aspects make UMA's authorization system different from traditional access control.

The following diagram illustrates is an high level representation of the UMA Trust Model which describes the trust relationship. We use a multiple triangles representation because it's useful to represent this complex  trust relationship (2 parties + one authority).

In the diagram are represented the three main aspects of the trust model: Registration, Trusted Claims and Delegation of Authority respectively related to the UMA functional model which includes: Protect, Authorize and Access (that you can see in the centered triangle). 

The Registration aspect describes the Host-AM Trust Relationship, this includes technical procedures (such as private key exchange), legal agreements and policies.
On the left side, the vertex called "Accreditation system" represents a third party (e.g. Registration Authority) that we think could be involved to guarantee an adequate level of trustworthiness about the parties in case of a specific business (i.e. Healthcare, financial credit). It is not about identity exclusively.

The Trusted Claims aspect describes the AM-Requester Trust Relationship. For this specific aspect we leverage OpenID Connect specification and its levels of assurance to enable an Claim-based authorization system (see slideshare here). The SmartAM demo in the webinar showed a case of OpenID Connect-sourced trusted claims.

Last is the Delegation of Authority aspect which describes the Host-Requester Trust relationship, which is based on a delegation process, specific of the UMA protocol sequence which enables the propagation of trust.
Examples of delegation are:

• The Authorizing User delegates rights of protecting its resource to the Authorization Manager.
• The Host delegates rights of authorizing decision to the Authorization Manager. 
• The Authorization Manager delegates rights of the Requester’s proof-of claims’s to a 3rd party Claims Provider.

For more details about the expectations and responsibilities of various parties interoperating in the User-Managed Access (UMA) context, please take a look at UMA Trust Model document and the approach for Measuring Element of Trust.
See also UMA Trust and Security Implication FAQ 

Privacy Control for User-Managed Access

This post is about my recent work at Newcastle University as contributor on the Smart project. The study explores visualization techniques to enhance privacy control user experience for User-Managed Access (UMA) protocol, applied to SmartAM system.
The goal is to mitigate risks of lost of privacy and the exploitation of online personal data caused from user difficulty to maintain control, correlate web resources and assign privileges for specific scope in the data sharing process.
The approach (see slideshare presentation below) introduces the concepts of Connection, Control bridge and visualization tools for this purpose.

Exploring Visualization Techniques to Enhance Privacy Control UX for User-Managed Access

View more presentations from domcat

UMA & OpenID Connect

As part of my visit at the Newcastle University, thanks to the Smart team and prof. Aad van Moorsel,  last Wednesday, I had the opportunity to talk at the Computer Science Group Talk to a group of PhD students and researchers about UMA protocol and the extension to support Trusted Claims using OpenID Connect. The integration scenario (see slideshare below) shows an user interaction to get access to UMA protected resource with access restrictions based on requester's information/claims (i.e. email address, age, and gender) using OpenID Connect.
Interestingly, yesterday was released a first OpenID Connect demo w/Google. This is very useful for a further investigation about the integration approach and interfaces between UMA and OpenID Connect!

UMA Trusted Claims

View more presentations from domcat

Smart team at Newcastle University

User-Managed Access (UMA): Power to the people

As contributor and member of the leadership team at Kantara UMA WG, I'm very excited for the announced release of a first draft recommendation for UMA to the IETF for consideration.

This is a fundamental milestone for the creation of a new generation of authorization system which gives data-sharing power to the people.

The  approach addresses the emerging issues for data-sharing and identity in the cloud. From a security and privacy perspective, UMA protocol, which is build on top of the IETF Oauth 2.0 effort, gives the user the capabilities to control what information will be revealed, for what purpose and with which party, indipendently from where the user information are stored. 

This announce happens meanwhile I'm visiting Newcastle University where I joint the Smart team for contributing on SmartAM project (another exciting challenge!!), which implements UMA specification.

The Working group will demonstrate UMA's benefits in a public webinar on Wednesday, July 13, at 9am pacific time. Join us. 

You can register here.