Improving the Security of CardSpace. (26th March 2009)

• Record Type: Journal Article
• Authors: Alrodhan, Waleed A.; Mitchell, Chris J.
• Other Names: Vielhauer Claus Academic Editor.
• Is Part Of: EURASIP journal on information security. Volume 2009(2009)
• Publication Date: 2009-03-26
• Subjects: Computer security -- Periodicals; Computer networks -- Security measures -- Periodicals; Data encryption (Computer science) -- Periodicals; Cryptography -- Periodicals; 005.8
• DOI: 10.1155/2009/167216
• Languages: English
• ISSNs: 1687-417X

Abstract

Abstract : CardSpace (formerly known as InfoCard) is a digital identity management system that has recently been adopted by Microsoft. In this paper we identify two security shortcomings in CardSpace that could lead to a serious privacy violation. The first is its reliance on user judgements of the trustworthiness of service providers, and the second is its reliance on a single layer of authentication. We also propose a modification designed to address both flaws. The proposed approach is compatible with the currently deployed CardSpace identity metasystem and should enhance the privacy of the system whilst involving only minor changes to the current CardSpace framework. We also provide a security and performance analysis of the proposal.