An Entity-Centric Approach for Privacy and Identity Management in Cloud Computing

TLDR

In cloud computing, entities authenticate to service providers using personally identifiable information, and traditional application‑centric identity management tracks identities per application, which can lead to mapping of an entity’s PII across services when multiple accounts are involved. The authors propose an entity‑centric identity‑management approach for the cloud. The approach employs active bundles that contain PII, privacy policies, and a virtual machine enforcing those policies, along with anonymous identification to mediate interactions between entities and cloud services. It is independent of third parties, supplies minimal information to service providers, and enables the use of identity data on untrusted hosts.

Abstract

Entities (e.g., users, services) have to authenticate themselves to service providers (SPs) in order to use their services. An entity provides personally identifiable information (PII) that uniquely identifies it to an SP. In the traditional application-centric Identity Management (IDM) model, each application keeps trace of identities of the entities that use it. In cloud computing, entities may have multiple accounts associated with different SPs, or one SP. Sharing PIIs of the same entity across services along with associated attributes can lead to mapping of PIIs to the entity. We propose an entity-centric approach for IDM in the cloud. The approach is based on: (1) active bundles-each including a payload of PII, privacy policies and a virtual machine that enforces the policies and uses a set of protection mechanisms to protect themselves, (2) anonymous identification to mediate interactions between the entity and cloud services using entity's privacy policies. The main characteristics of the approach are: it is independent of third party, gives minimum information to the SP and provides ability to use identity data on untrusted hosts.