With e-commerce now exceeding 1 trillion USD per annum, the sharing economy on the rise, and the emergence of the Internet of Things, the need for reliable and user-friendly authentication and authorization mechanisms is more pressing than ever. Researchers from IMDEA Networks are collaborating in the newly launched ReCRED (ReCRED: Real-world Identities to Privacy-preserving and Attribute-based CREDentials)– a research project that aims to improve end-user internet security using the mobile as an authorization proxy.
The ultimate goal of ReCRED is to promote the user’s personal mobile device to the role of a unified authentication and authorization proxy towards the digital world. ReCRED adopts an incrementally deployable strategy in two complementary directions: extensibility in the type and nature of supported stakeholders and services (from local access control to online service access), as well as flexibility and extensibility in the set of supported authentication and access control techniques; from widely established and traditional ones to emerging authentication and authorization protocols as well as cryptographically advanced attribute-based access control approaches.
Simplicity, usability, and users privacy is accomplished by: (i) hiding inside the device all the complexity involved in the aggregation and management of multiple digital identifiers and access control attribute credentials, as well as the relevant interaction with the network infrastructure and with identity consolidation services; (ii) integrating in the device support for widespread identity management standards and their necessary extensions; and (iii) controlling the exposure of user credentials to third party service providers.
ReCRED addresses key security and privacy issues…