1 / 12

User Managed Privacy Using Distributed Trust

User Managed Privacy Using Distributed Trust. Privacy and Security Research Workshop Carnegie Mellon University May 29-30, 2002 Lark M. Allen / Wave Systems Lallen@wavesys.com. Privacy Challenges.

burton-maynard
Download Presentation

User Managed Privacy Using Distributed Trust

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. User Managed Privacy Using Distributed Trust Privacy and Security Research Workshop Carnegie Mellon University May 29-30, 2002 Lark M. Allen / Wave Systems Lallen@wavesys.com

  2. Privacy Challenges • The Internet ‘exposes’ and ‘creates’ as by-products significant amounts of personal information in its normal mode of operations • Personal information was the primary ‘currency’ which funded the explosive era of the Internet • Most tools were created to track, market, profile, spam, etc. • Success was measured in “eyeballs” and personal data • Current architectural and legislative approaches to privacy focus on restricting uses of information after it is collected, not minimizing the collection of personal information • New identity credentials planned to contain significantly more personal information and biometrics, ie. DMV license • Evolving identity systems will connect more information 11/27/01 2

  3. Strategic New Approach to Privacy • User manages release of personal information from a secure ‘wallet’ or local repository • Personal tools provide full range of protection from anonymous to full disclosure mode • ‘Trusted’ user devices for authentication, access, processing, storage, and protection at the perimeter of the Internet provide local authentication and selective release of required, authorized and essential data into network and centralized sites. • All personal information is ‘bound’ to privacy preferences throughout life of the data to control usage. 11/27/01 3

  4. Privacy is growing social issue, even post 9/11 EU, Canada and others with tough Data Protection laws Authentication and Privacy must find acceptable ‘balance’ Where authentication is done will affect privacy concerns With trusted, intelligent edge devices authentication can be accomplished without releasing personal information Location of Authentication Privacy Concerns User Local Regional National Intrn’l. ‘Near’ User Authentication and Privacy

  5. New Privacy and Security Approach Distributed Trust and Intelligent Web Agents Trusted Client Platform XML Web Agents Strong Security in User Devices for Protection and Distributed Handling of Personal Information

  6. EMBASSY Trusted Client Platform Secure Input Trusted Client Input Device Strong Cryptography • Secure • Processing • Storage • Time Secure Display

  7. Trust Assurance Network Processor Interfaces /Storage Digital Signature Wallet Clock Memory Crypto Strong Auth EMBASSY Trusted Client Subsystem ‘Sovereign and Protected Place in a Hostile Territory’ Identity App. Digital Signature Authentication Application EMBASSY CHIP/ Trusted OS Strong Auth Digital Signature Music DRM Hard Disk Digital Signature Wallet Device Trust Services, Secure Applet Management

  8. XNS is a global identity protocol that uses Web agent technology to: Create a foundation of identity management Link real-world identities to each other Establish permissions governing the exchange or use of identity-related data Based on XML web agent technology for intelligent exchange and processing of information Automatically synchronize changes to this data Build in extensibility to accommodate change Intelligent Identity Solution XNS (eXtensible Name Service) OneName Corporation

  9. PC Internet FW FW Trusted Device Server Cards Tokens Biometrics ID PIN Password Trusted Input Device - Architecture Authentication Authentication Untrusted Trusted • Authentication must be done in a trusted location • Trusted devices can communicate securely over untrusted networks and through untrusted devices

  10. PC Internet FW FW Server Cards Tokens Biometrics ID / PIN Password Extending Trust to the Network Edge • End-end security • Multi-layer protections • Workgroups and peer-peer enabled • Data / user level Trust Boundaries

  11. Information Accessible Smart Card Identity Credential Intelligent, Trusted Reader • Age Bar Applet • Name / Address • Age • Biometrics • Criminal History Police Applet • Contains: • Name and Address • Age • Biometrics • Fingerprints • Facial Image • DNA • Signature • Criminal History • Healthcare Info • Digital IDs, etc. Hospital Applet • Name / Address • Age • Healthcare Info Local Auth Applet • Yes or No Selective Personal Information Access ▒▒▒▒▒▒▒▒▒ ▒▒▒▒▒▒▒▒▒ ▒▒▒▒▒▒▒▒▒ ▒▒▒▒▒▒▒▒▒ • Benefits: • Distributed • Scalable • Enforceable

  12. Allows users to have much more control over the release and usage of personal information Minimize release of information Privacy preferences more granular and situation based Authentication at the network edge with information release Strong, multi-factor authentication Addresses major security exposure – The untrusted PC Minimized need for centralized data bases Solution for selective release of personal information – satisfies basic tenets of ‘need to know’ Secure, multifunction identity credentials Addresses key issues for including finger prints, criminal history, medical information, age, etc. on driver’s licenses More easily addresses issues context based identity needs Benefits – User Managed Privacy

More Related