Strengthening and formally verifying privacy in identity management systems

In a digital world, users’ Personally Identifiable Information (PII) is normally managed with a system called an Identity Management System (IMS). There are many types of IMSs. There are situations when two or more IMSs need to communicate with each other (such as when a service provider needs to obtain some identity information about a user from a trusted identity provider). There could be interoperability issues when communicating parties use different types of IMS. To facilitate interoperability between different IMSs, an Identity Meta System (IMetS) is normally used. An IMetS can, at least theoretically, join various types of IMSs to make them interoperable and give users the illusion that they are interacting with just one IMS. However, due to the complexity of an IMS, attempting to join various types of IMSs is a technically challenging task, let alone assessing how well an IMetS manages to integrate these IMSs. The first contribution of this thesis is the development of a generic IMS model called the Layered Identity Infrastructure Model (LIIM). Using this model, we develop a set of properties that an ideal IMetS should provide. This idealized form is then used as a benchmark to evaluate existing IMetSs. Different types of IMS provide varying levels of privacy protection support. Unfortunately, as observed by Jøsang et al (2007), there is insufficient privacy protection in many of the existing IMSs. In this thesis, we study and extend a type of privacy enhancing technology known as an Anonymous Credential System (ACS). In particular, we extend the ACS which is built on the cryptographic primitives proposed by Camenisch, Lysyanskaya, and Shoup. We call this system the Camenisch, Lysyanskaya, Shoup - Anonymous Credential System (CLS-ACS). The goal of CLS-ACS is to let users be as anonymous as possible. Unfortunately, CLS-ACS has problems, including (1) the concentration of power to a single entity - known as the Anonymity Revocation Manager (ARM) - who, if malicious, can trivially reveal a user’s PII (resulting in an illegal revocation of the user’s anonymity), and (2) poor performance due to the resource-intensive cryptographic operations required. The second and third contributions of this thesis are the proposal of two protocols that reduce the trust dependencies on the ARM during users’ anonymity revocation. Both protocols distribute trust from the ARM to a set of n referees (n > 1), resulting in a significant reduction of the probability of an anonymity revocation being performed illegally. The first protocol, called the User Centric Anonymity Revocation Protocol (UCARP), allows a user’s anonymity to be revoked in a user-centric manner (that is, the user is aware that his/her anonymity is about to be revoked). The second protocol, called the Anonymity Revocation Protocol with Re-encryption (ARPR), allows a user’s anonymity to be revoked by a service provider in an accountable manner (that is, there is a clear mechanism to determine which entity who can eventually learn - and possibly misuse - the identity of the user). The fourth contribution of this thesis is the proposal of a protocol called the Private Information Escrow bound to Multiple Conditions Protocol (PIEMCP). This protocol is designed to address the performance issue of CLS-ACS by applying the CLS-ACS in a federated single sign-on (FSSO) environment. Our analysis shows that PIEMCP can both reduce the amount of expensive modular exponentiation operations required and lower the risk of illegal revocation of users’ anonymity. Finally, the protocols proposed in this thesis are complex and need to be formally evaluated to ensure that their required security properties are satisfied. In this thesis, we use Coloured Petri nets (CPNs) and its corresponding state space analysis techniques. All of the protocols proposed in this thesis have been formally modeled and verified using these formal techniques. Therefore, the fifth contribution of this thesis is a demonstration of the applicability of CPN and its corresponding analysis techniques in modeling and verifying privacy enhancing protocols. To our knowledge, this is the first time that CPN has been comprehensively applied to model and verify privacy enhancing protocols. From our experience, we also propose several CPN modeling approaches, including complex cryptographic primitives (such as zero-knowledge proof protocol) modeling, attack parameterization, and others. The proposed approaches can be applied to other security protocols, not just privacy enhancing protocols.

Preface [From The Third Knowledge City World Summit 2010 proceedings]

‘Knowledge’ is a resource, which relies on the past for a better future. In the 21st century, more than ever before, cities around the world depend on the knowledge of their citizens, their institutions and their firms and enterprises. The knowledge image, the human competence and the reputation of their public and private institutions and corporations profiles a city. It attracts investment, qualified labour and professionals, as well as students and researchers. And it creates local life spaces and professional milieus, which offer the quality of life to the citizens that are seeking to cope with the challenges of modern life in a competitive world. Integrating knowledge-based development in urban strategies and policies, beyond the provision of schools and locations for higher education, has become a new ambitious arena of city politics. Coming from theory to practice, and bringing together the manifold knowledge stakeholders in a city and preparing joint visions for the knowledge city is a new challenge for city managers, urban planners and leaders of the civic society . It requires visionary power, creativity, holistic thinking, the willingness to cooperate with all groups of the local civil society, and the capability to moderate communication processes to overcome conflicts and to develop joint action for a sustainable future.

Provisional supervision in Hong Kong : third time lucky?

Provisional supervision (PS) is Hong Kong’s proposed new corporate rescue procedure. In essence, it is a procedure for the preparation by a professional, usually an accountant or a solicitor, of a proposal for a voluntary arrangement, supported by a moratorium. There should be little court involvement in the process and it is anticipated that the costs and delays of the process would be less than alternate, currently available procedures. This article will retrace some of the key events and issues arising from the numerous policy and legislative debates about PS in Hong Kong. At present the Hong Kong government is in the midst of drafting a new Bill on corporate rescue procedure to be introduced to the HKSAR Legislative Council. This will be the third attempt. Setting aside the controversies and the content of this new effort by the Hong Kong administration, the Global Financial Crisis in 2008 has signalled to the international policy and business community, free markets alone cannot be an effective regulatory mechanism. Having legal safeguards and clear rules to regulate procedures and conduct of market participants are imperative to avoid future financial meltdowns.

Consumer satisfaction and redress with a government third-party complaints agency

As governments around the world adopt a marketing orientation, the importance of consumer satisfaction to the effectiveness of the organization is being recognized. While some investigation of satisfaction with a government agencies' service has occurred, there is little examination of satisfaction with a government agency that acts as a third-party on the behalf of consumers to gain marketplace redress. Given the number of third-party complaints is increasing as a result of internet access to complaint channels, this research is a timely investigation. This study reports the findings of a survey of 454 complainants to an Australian Government agency: the Office of Fair Trading (OFT). The findings show that satisfaction with the service was subjectively experienced, based around individual expectations of the redress and satisfaction levels were higher when the redress sought was financial compared with non-financial forms of redress such as apology.

Privacy v IP Litigation : preliminary third party discovery on the Internet

The enforcement of Intellectual Property rights poses one of the greatest current threats to the privacy of individuals online. Recent trends have shown that the balance between privacy and intellectual property enforcement has been shifted in favour of intellectual property owners. This article discusses the ways in which the scope of preliminary discovery and Anton Piller orders have been overly expanded in actions where large amounts of electronic information is available, especially against online intermediaries (service providers and content hosts). The victim in these cases is usually the end user whose privacy has been infringed without a right of reply and sometimes without notice. This article proposes some ways in which the delicate balance can be restored, and considers some safeguards for user privacy. These safeguards include restructuring the threshold tests for discovery, limiting the scope of information disclosed, distinguishing identity discovery from information discovery, and distinguishing information preservation from preliminary discovery.

Anchoring and exposing in the third place : regular identification at the boundaries of social realms

Harry’s is my favourite bar in my neighbourhood. It is a small wine bar, owned by three men in their late thirties and targeted at people like them; my gentrifying inner city neighbourhood’s 20 to 40 something urban middle class. Harry’s has seats along the bar, booths inside, and a courtyard out the back. The seating arrangements mean that larger groups tend to gather outside, groups of two to four spread around the location, and people by themselves, or in groups of two, tend to sit at the bar. I usually sit at the bar....

Practice and procedure : a recent Court of Appeal case examines the meaning of 'third party payer' in terms of Part 3.4 of the Legal Profession Act 2007.

In Legal Services Commissioner v Wright [2010] QCA 321 the Queensland Court of Appeal allowed an appeal from the first instance decision. The decision involved the construction of “third party payer” in Part 3.4 of the Legal Profession Act 2007 (Qld).

Composing services for third-party service delivery

This paper proposes a model-based technique for lowering the entrance barrier for service providers to register services with a marketplace broker, such that the service is rapidly configured to utilize the brokerpsilas local service delivery management components. Specifically, it uses process modeling for supporting the execution steps of a service and shows how service delivery functions (e.g. payment points) ldquolocalrdquo to a service broker can be correctly configured into the process model. By formalizing the different operations in a service delivery function (like payment or settlement) and their allowable execution sequences (full payments must follow partial payments), including cross-function dependencies, it shows how through tool support, the non-technical user can quickly configure service delivery functions in a consistent and complete way.

Third-order theory of spectacle lenses applied to correction of peripheral refractive errors

Purpose: To demonstrate that relatively simple third-order theory can provide a framework which shows how peripheral refraction can be manipulated by altering the forms of spectacle lenses. Method: Third-order equations were used to yield lens forms that correct peripheral power errors, either for the lenses alone or in combination with typical peripheral refractions of myopic eyes. These results were compared with those of finite ray-tracing. Results: The approximate forms of spherical and conicoidal lenses provided by third-order theory were flatter over a moderate myopic range than the forms obtained by rigorous raytracing. Lenses designed to correct peripheral refractive errors produced large errors when used with foveal vision and a rotating eye. Correcting astigmatism tended to give large errors in mean oblique error and vice versa. When only spherical lens forms are used, correction of the relative hypermetropic peripheral refractions of myopic eyes which are observed experimentally, or the provision of relative myopic peripheral refractions in such eyes, seems impossible in the majority of cases. Conclusion: The third-order spectacle lens design approach can readily be used to show trends in peripheral refraction.

Using a thimble to drink from a fire hydrant: information anxiety and the third sector

In the last 10 years, the third sector has seen an eruption of texts, websites, discussion forums, conferences, new journals, new research centres and sector-specific degrees. This growing abundance of information allows for hitherto impossible networking, collaboration and general awareness of what is happening in the sector. At the same time, however, like staff in many industries, nonprofit professionals can suffer from an increasingly common 21st century malaise known as ‘information anxiety’. It is worth examining the sector through the lens of Information Studies theory, to question what the information technology needs of nonprofits are and how their information management techniques may differ from those in the public and private sectors. There are implications of this both for those within the industry (in terms of governance, training and public relations) and those external to it (who may form relationships with nonprofits on the basis of access to information).

Managing an ageing third sector workforce: international and local perspectives

Australia, like all developed and most developing countries, is facing major contextual changes, one of which is an ageing population, largely through declining fertility and increasing longevity (WHO 2002). This will impact on most aspects of global, national, local, community, family and individual interactions and decision-making, including for the nonprofit sector. The sector should be aware that population ageing is increasingly being addressed in public finance and policy agendas within Australia (see, for example, Intergenerational Report 2002-3), as well as by governments in countries such as the United Kingdom, United States and New Zealand, and the Organisation for Economic Co-operation and Development (OECD) and European Economic Policy Committee (EEPC).

Third sector partnerships : opportunities and risks

The establishment by the Prime Minister of the Community Business Partnerships Board along with recent taxation reform has drawn attention to corporate philanthropy in Australia. Definitions and models are needed as each of the potential partners – government, corporations and nonprofit organisations – attempts to come to grips with opportunities. The intending partners will need to determine their responsibilities and desired outcomes so that they may work effectively towards mutually beneficial working relationships. Performance indicators need to be determined, benchmarks developed and best practice promoted. A dearth of research exists in this area (Burch, 1998; Industry Commission Report, 1995; Lyons & Hocking, 1998). More exhaustive research, collection and analysis of appropriate data will aid the process. This particular research indicates a lack of understanding between corporations and nonprofit organisations. There are risks inherent in the proposed partnerships, such as inability to reach agreement, potential for increased costs, and failure to deliver by one of the partners. This paper assesses opportunities and risks, suggests topics for high level debate, and indicates models for the development of partnerships.

Dimensions of the third sector : comparative perspectives on structure and change

Cross-nationally, the introduction of New Public Management coincides with a significant growth phase of the nonprofit or third sector. This growth has disproportionately been an expansion of the economic dimensions (employment, turnover) and basically involved the greater use of third sector organisations as service providers. Such provision uses complex contract regimes, and typically takes place in some form of public-private partnership with either public or private funding agencies. Other parts of the third sector such as membership, volunteering and giving have generally grown less. The paper suggests that the sector is becoming qualitatively different, although the nature and strength of this change depends on the nonprofit regime type in a given country. Generally, however, third sector growth has led to differentiation processes that involve new organisational forms, and changes in activities and overall composition. The paper explores the measurement aspects of the quantitative-qualitative jump in third sector development by trying to "map" changes in core facts or dimensions over time. In closing, the paper suggests to examine recombination and refunctionality processes in the third sector.