Why Identity Federation Helps Improve Privacy

523 VIEWS

I received an inquiry from a certain party and sent a response, so I am sharing it here.
The topic is “Why Identity Federation Helps Improve Privacy.”

“Id federation” refers to “Identity Federation” in English: “an arrangement for exchanging and managing a set of attributes (including authentication results) concerning an entity (an identity), primarily in order to identify that entity across multiple services.” A typical use case is single sign-on (SSO), which allows a user to log in to multiple websites with a single authentication.

This technology contributes greatly to privacy protection. Those of us who have long been involved with Id federation take this for granted, but it does not appear to be generally understood, so I believe there is some value in writing it down here.

Table of Contents

Privacy Principles

In principle, protecting privacy means maintaining a state in which each person is respected as an individual and is guaranteed the right to freely decide matters that belong to their personal sphere. In Japanese law, Article 13 of the Constitution is exactly on point. But this alone is far too abstract and is some distance from practical implementation. Therefore, in many cases, a set of “privacy principles” is established, and privacy is protected by adhering to those principles.

There are various sets of privacy principles. Older examples include the OECD 8 Principles (1980) [← these are currently being revised] and the Council of Europe Convention No. 108, “Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data” [← this is also currently being revised. Incidentally, although it is called the Council of Europe, Japan participates as an observer]. More recent well-known examples include the proposed EU Regulation that drew attention to the “right to be forgotten” and the US “Consumer Privacy Bill of Rights.” Any recent set would produce much the same result, but here, as a country-neutral basis, I will use the ISO/IEC 29100 Privacy Framework, take its 11 principles, and explain how Id federation contributes to each of them.

1. Consent and choice
2. Purpose legitimacy and specification
3. Collection limitation
4. Data minimization
5. Use, retention, and disclosure limitation
6. Accuracy and quality
7. Openness, transparency, and notice
8. Individual participation and access
9. Accountability
10. Information security
11. Privacy compliance

1. Consent and choice

This basically means that meaningful consent must be obtained.
(It does not necessarily have to be explicit consent.)
Naturally, it is important to explain “what will happen” if consent is given and if it is not. On that basis, some form of consent is obtained, whether explicit, implicit, or based on social agreement (= law). It goes without saying that having a choice is important in this process.

There are various approaches to Id federation, but those described as user-centric require that this be guaranteed to the user. OpenID, in particular, makes this a requirement within its specification.

2. Purpose legitimacy and specification

This means that the purpose of use must be legitimate and must also be specified in detail. It also requires consent to be obtained each time a new use is added. This is not a purely technical issue. Therefore, Id federation technology alone cannot solve it. A trust framework contributes by auditing and certifying whether each party requesting information satisfies this condition, while Id federation technology contributes by checking whether the party with which it communicates has received that certification.

3. Collection limitation

This is the condition that no more than the minimum necessary data may be requested.
Although it depends on the type of Id federation technology, OpenID, for example, allows the attributes to be obtained to be selected dynamically. This is precisely intended to satisfy the “collection limitation” requirement.

4. Data minimization

This means that collected data should undergo only the minimum necessary processing and be handled only by the minimum necessary number of people.

Most aspects of processing occur after Id federation and therefore lie outside the scope of Id federation technology. However, in terms of preventing improper record linkage, the use of Pairwise Pseudonymous Identifiers (identifiers specific to each relying party) can provide some degree of deterrence.

Id federation can also contribute through authentication technology with regard to limiting access to the minimum necessary number of people.

5. Use, retention, and disclosure limitation

This is primarily a requirement concerning retention. It requires that data be retained only for the minimum necessary period; that after the purpose of use has been achieved, if the data must be retained due to legal requirements or similar reasons, it be locked so that it cannot be accessed; and that disclosure of the data be limited to the minimum necessary to achieve the purpose of use.

Because Id federation technology makes it possible to federate information whenever it is needed, it reduces the need for the receiving party to retain data. It therefore contributes to this requirement as well.

6. Accuracy and quality

If data is inaccurate, there is a risk that an unfavorable image of the person will be formed. The best way to maintain data accuracy is to obtain it in real time from an authoritative data source. It is also important, as appropriate, for the data source to sign the data so that tampering can be detected.

It is no exaggeration to say that Id federation technology exists precisely for this purpose.

7. Openness, transparency, and notice

This means properly informing individuals of such matters as the policies of the entity processing personal data, the fact that processing has occurred, changes to policies, and how to have the processing stopped.

Although this is a matter of implementation, many IdPs provide a list of the parties to which data has been provided and a way to revoke that provision. I also expect that notifications of policy changes will gradually become possible through IdPs.

In this respect as well, individuals can be said to have far greater means of control than when information is simply provided without any controls.

8. Individual participation and access

This requires that, after Id federation, individuals be able to go to the RP, see what data it retains, and make corrections as necessary.

In Id federation, as a rule, data is retained for only a very short period and the latest data is always obtained. Therefore, together with 7 above, individuals can be said to already have a certain degree of control on the IdP side.

Whether the RP is improperly retaining data is a matter for audits under the trust framework.

9. Accountability

This means that a privacy management system must be operated.¹
Therefore, this is not about Id federation technology itself.
It is a matter for the trust framework.
As noted above, Id federation technology contributes by providing data only to parties certified under the trust framework.

10. Information security

This is not an issue that can be addressed by Id federation technology alone either, but internationally standardized Id federation technologies have been reviewed by many security experts to ensure their security. They can be expected to be far more secure than proprietary technologies.

Viewed as a whole, this is a requirement to operate a management system. A trust framework requires the management system to meet a further defined level. Id federation technology contributes by providing data only to parties certified under the trust framework.

11. Privacy compliance

This is also an issue to be addressed by the trust framework.
Id federation technology contributes by providing data only to parties certified under the trust framework.

That concludes this explanation of “how Id federation contributes to improving privacy.”

Footnotes

Without doing so, accountability cannot be ensured.