Digital Identity Management

Maryline Laurent, Samia Bouzefrane

• Publisher: ISTE Press - Elsevier
• Year: 2015
• Print ISBN: 9781785480041
• eBook ISBN: 9780081005910
• Topic: Computer Science
• Subtopic: Computer Networking
• Index: Computer Science

In the past four decades, information technology has altered chains of value production, distribution, and information access at a significant rate. These changes, although they have shaken up numerous economic models, have so far not radically challenged the bases of our society.This book addresses our current progress and viewpoints on digital identity management in different fields (social networks, cloud computing, Internet of Things (IoT), with input from experts in computer science, law, economics and sociology. Within this multidisciplinary and scientific context, having crossed analysis on the digital ID issue, it describes the different technical and legal approaches to protect digital identities with a focus on authentication systems, identity federation techniques and privacy preservation solutions. The limitations of these solutions and research issues in this field are also discussed to further understand the changes that are taking place. - Offers a state of the discussions and work places on the management of digital identities in various contexts, such as social networking, cloud computing and the Internet of Things - Describes the advanced technical and legal measures to protect digital identities - Contains a strong emphasis of authentication techniques, identity federation tools and technical protection of privacy

1

Digital Identity

Maryline Laurent; Julie Denouël; Claire Levallois-Barth; Patrick Waelbroeck

Abstract

According to the records on “digital trust” from ACSEL [ACS 13], which is an acronym for the French Digital Economy Association, French Internet users used an average of 16.4 digital IDs¹ in 2013, compared to 12.2 in 2009. By digital ID, we mean information – like login and password – needed to activate an account, but also any traces left by an individual due to their activities or technological devices (IP address, photos, types of purchase, etc.). Ninety percent of Internet users use their digital IDs to access e-administration and e-commerce services, 8% for online banking, and 77% for social networks. The same ACSEL study measures the risks perceived by Internet users with regard to their digital ID and observes that 42% of them fear errors with their ID (compared to 34% in 2009) and 40% misuse of their data. It is important to know that the French are victims of 400,000 identity thefts per year on average. ACSEL argues that an Internet user’s “breaking point with regards to trust” occurs “when the risks perceived by the user are considered to be greater than the use value of a digital service”.

Keywords

Centralized model

Expressive approach

Federated model

Identity and Web 2.0

Identity management systems

Isolated/silo model

Risk-seeking approach

Socio-technical processes

Technicist approach

User-centric model

1.1 Introduction

According to the records on “digital trust” from ACSEL [ACS 13], which is an acronym for the French Digital Economy Association, French Internet users used an average of 16.4 digital IDs¹ in 2013, compared to 12.2 in 2009. By digital ID, we mean information – like login and password – needed to activate an account, but also any traces left by an individual due to their activities or technological devices (IP address, photos, types of purchase, etc.). Ninety percent of Internet users use their digital IDs to access e-administration and e-commerce services, 8% for online banking, and 77% for social networks. The same ACSEL study measures the risks perceived by Internet users with regard to their digital ID and observes that 42% of them fear errors with their ID (compared to 34% in 2009) and 40% misuse of their data. It is important to know that the French are victims of 400,000 identity thefts per year on average. ACSEL argues that an Internet user’s “breaking point with regards to trust” occurs “when the risks perceived by the user are considered to be greater than the use value of a digital service”.

The level of user trust in a system is also mentioned by Catherine Kherian in Les Focus de Solucom [KHE 13], as one of the three conditions to be met for the wider adoption of digital ID, namely: universality of use, user trust in the system (made possible through user control over personal information), and service providers (SPs), trust in using the same system (based on the information reliability). A step in this direction was made by the European Commission in 2012 with its project on the regulation of “electronic identification and trust services for electronic transactions in the internal market” (eIDAS Regulation) which would see each member state identify the “electronic identification systems that they accept under their jurisdiction when electronic identification is required for public services”. In this sense, the French government – which aborted numerous projects considered as violation of individual freedoms – revived the project IDéNum in 2013 which is funded by a joint public–private partnership.

The topic of digital ID is an extremely sensitive and pervasive subject. On the one hand, the Internet has been built up over the years as a space of unregulated freedom for the individual, where everyone is free to exhibit themselves, consume, educate themselves, have a social life, etc. This “métamorphose numérique” [digital metamorphosis], as named by Francis Jutand [JUT 13], is not without consequences: economic consequences, with a large volume of transactions evading tax regulations, and consequences in terms of security, for citizens who are subject to harmful upshots (identity theft, e-pornography and harassment). In this context, the state whose mission is to protect its citizens, and to ensure a public service via a sufficient treasury, has no alternative but to intervene in this digital world, in order to implement a regulation that will protect the interests of the state and its citizens, and to define an adequate investigation, identification and sanction system. As such, digital identity is a challenging and critical topic, especially due to its international range, its huge economic stakes and the targeted objective of our society to find its place within this digital metamorphosis.

In this chapter, three research professors, Patrick Waelbroeck, Doctor of Economic Sciences, Julie Denouël, Doctor of Linguistics, and Maryline Laurent, Doctor in Network and Computer Science, will share their views and personal reflections on how to comprehend digital identity, how difficult it is to manage them, and the remaining challenges in their respective disciplines. These works related to digital identity are part of the activities of the multidisciplinary chair on values and policies of personal information² at the Mines-Télécom Institute in France. This chair aims to help businesses, citizens and public authorities in their reflections on the collection, use and sharing of personal information, namely information relating to individuals (their private lives, professional activities, digital identities, and contributions on social networks, etc.) including the information collected by the communicating devices surrounding them (smartphones, smart meters, smart televisions and smart NFC games, etc.). Authors Maryline Laurent and Patrick Waelbroeck are cofounders of that chair along with Pierre-Antoine Chardel. Claire Levallois-Barth is the coordinator.

1.2 The social dimension of online self-representation

Since personal web pages in the course of the 1990s up to more recent blogs and social network sites, the democratization of the Internet has been accompanied by the dissemination of communication devices “functionally dedicated to the presentation of self” [HON 07], which have allowed composite and plural identity elements to become visible (from physical characteristics to identity traits, tastes and/or personal content). In this section, we intend to address the issue of self-presentation online by drawing upon research which, coming from the sociology of uses [DEN 11, JAU 11], is interested in social uses of these technical devices and have been able to provide numerous insights into the different approaches based on digital identity.

1.2.1 Digital identity: at the crossroads of platform configuration and Internet user tactics

1.2.1.1 Personal identity through the prism of the sociology of uses

If the sociology of uses is based on a combination of approaches and fields of research for the least plural³, we nevertheless notice that the work carried out on this all pays particular attention to the socio-technical processes, observing the reflexive relations that take place between the technical configuration of the device and the organization of interactional and social practices. Because it is necessarily sensitive to the process of “double mediation” both technical and social [JOU 00], the research in sociology of uses which is interested in personal identity has thus addressed this problem by carefully observing the prescriptive part of Information and Communication Technologies (ICTs) in the organization of self-presentation practices. Throughout the 1990s, the massification of the use of personal web pages offered, for example, fertile ground for the analysis of what we will call self-expression. However, many studies have highlighted the fact that the affordances specific to personal web pages tend to frame the way in which Internet users present or reveal themselves online [BEA 99, DOR 02]. Self-presentation, produced in (and via) these services, thus appears to be a composite phenomenon. It is intrapersonal, because a personal web page is conducive to self-narrative or the exposure of the facets of the self, interpersonal, because it allows links to other pages to be integrated and dynamic since the page can be enriched and updated at will.

1.2.1.2 Identity and Web 2.0

More recently, the dissemination of the use of Web 2.0, and more particularly of socio-digital networks [COU 11], has allowed these initial questions to develop. In fact, today, we have moved on from the issue centered on the means of online self-presentation and self-expression, to analysis centered on the processes for making oneself visible, self-deprivatization, or even self-exposure. These analytical categories, which are the result of qualitative research based on the detailed examination of empirical data, also show researchers’ marked increase in attention to the relationship between the configuration of Web 2.0 platforms, identity practices implemented by Internet users, but also changing social cultures.

In 2008, Danah Boyd and Nicole Ellison gave an initial definition of social network sites (SNS) as web services which allow users to: (1) construct a public or semi-public profile within a defined system, (2) maintain a list of users with whom they have friendships, (3) be able to see and browse their list of friendships and those set up by other individuals via the same platform. As it marks the central role of user profiles, this first definition is interesting, but regrettably it takes a very formal point of view which fails to consider the activities carried out by Internet users on these platforms. As within these social networking sites, it is in fact possible to distinguish between at least two groups of devices: interpersonal platforms that are linked to networking activities (e.g. Facebook, Twitter or LinkedIn) and self-production platforms more dedicated to the storage and sharing of recycled or self-produced content (e.g. Youtube, Soundcloud, Tumblr). In terms of the different formats of activities that these two types of platform make possible, the new analysis that Ellison has recently proposed seems to take better account of the diversity of practices carried out on these sites [ELL 11]. In this context, Ellison stresses that an SNS is above all “a platform for networked communication in which participants: (1) have profiles which can be uniquely identified that are created via a combination of content provided by the user, content provided by ‘friends’ and system data; (2) can publicly expose relationships that are likely to be viewed and consulted by others; (3) can access streams of content including content generated by the user – particularly combinations of texts, photos, videos, Website updates and/or links – provided by their contacts on the site” [ELL 11]. By highlighting the fact that each profile (even private ones) presents a minimum degree of visibility and that includes content produced by the Internet user, but also by their “friends”, Ellison correlatively draws out one of the most ...

Table of contents

• Cover image
• Title page
• Table of Contents
• Copyright page
• Foreword
• List of Acronyms
• 1. Digital Identity
• 2. The Management of Identity by the Federation
• 3. Authentication Systems
• 4. Privacy Management and Protection of Personal Data
• 5. Digital Identity in Cloud Computing
• List of Authors
• Index