Secure Roaming with Identity Metasystems

Abstract

The notion of identity metasystem has been introduced as the means to ensure inter-operability among different identity systems while providing a consistent user experience. Current identity metasystems provide limited support for secure roaming: by "roaming" we refer to the ability of an user to use the same set of identities and credentials across different terminals We argue that in order to support different types of roaming, the identity selector system should be structured as a set of distributable components. We describe such distributed client-side software architecture and how that architecture is implemented by adapting Novell's Bandit project. Our implementation shows how added security assurances can be gained from the fact that credentials are stored in one trusted device in the form of a mobile phone but can be used on less trusted terminals in the form of PCs.

The main goal of this thesis is to provide an abstract mechanism for digital identity roaming, allowing end users to manage and use their digital identities with the power of identity metasystem while maximizing the portability and usability of the identity metasystem using mobile trusted devices.