Network of Excellence in Future of Identity
Lead Research Organisation:
City, University of London
Department Name: Sch of Engineering and Mathematical Sci
Abstract
Identity has both static, biological as well dynamic, social and psychological components. At a basic and biological level, our identity is unique to us and it is revealed by numerous biometric indicators such as fingerprint and iris patterns. This identity is fixed. All of these indicators track back to a single person, and one of our challenges is to develop systems and infrastructures capable of linking those multiple indicators so that the right people have access to the right services, systems, or information at the right times. Identity management is key in this regard, and it is dependent on robust controls designed to verify that users are who they say they are, across both real and online contexts. Improvements will enable the capability to verify identity, providing access to those who require it whilst ensuring the safety and security of often sensitive information by minimising false positive access of fraudsters. Such verification systems need to be able to operate across the various systems or applications that a single user might use.
At another level, i.e., the social and psychological level, our identity is dynamic and relative. It is defined by the social group we are in and/or the task that we are undertaking, and so we develop and reveal our self-image accordingly. Our identify affords us certain rights and privileges, which may change over time and place. This makes identity a much more challenging concept, and raises an entirely new set of questions which require an entirely new set of methodologies. In this regard, the definition of our identity according to our social group becomes important because it affords a single individual quite different rights and privileges across the many identities that they may hold. In essence, the challenge of identity is then even more complex because each individual can now be understood to hold many roles, and to display many indicators of identity within each of these roles. For instance, if we merely take the name as an indicator of identity, I may have a name that I use in the workplace, a name that I use amongst friends, another within an online social network, and another as a unique email ID. All of these are 'me' across the different roles that I occupy, and all would need to be tracked back to me for a complete understanding of who I am both at psychological level and at an identity management level.
An interdisciplinary perspective is now needed to address the diversity of user and system needs suggested above. Given the complexities introduced by the volume of e-providers, and the demands to comply with the provisions of the Data Protection Act, these are far from trivial problems. Expertise in psychology and human factors is needed to understand the barriers to robust authentication systems, and to explore how best to counteract phishing and other human engineering attacks. Legal expertise is also necessary given that the use of federated identity management (FIM) systems introduces the notion of trust between service providers but also necessitates the introduction of liabilities and warranties against breaches. This network in identity will bring these expertise under one forum to discuss some of the future challenges in the area of establishing identity. In addition to this it will act as a 'one-stop-shop' where industries, government agencies and the academic community can interact and seek the necessary expertise to resolve issues around establishing the identity.
At another level, i.e., the social and psychological level, our identity is dynamic and relative. It is defined by the social group we are in and/or the task that we are undertaking, and so we develop and reveal our self-image accordingly. Our identify affords us certain rights and privileges, which may change over time and place. This makes identity a much more challenging concept, and raises an entirely new set of questions which require an entirely new set of methodologies. In this regard, the definition of our identity according to our social group becomes important because it affords a single individual quite different rights and privileges across the many identities that they may hold. In essence, the challenge of identity is then even more complex because each individual can now be understood to hold many roles, and to display many indicators of identity within each of these roles. For instance, if we merely take the name as an indicator of identity, I may have a name that I use in the workplace, a name that I use amongst friends, another within an online social network, and another as a unique email ID. All of these are 'me' across the different roles that I occupy, and all would need to be tracked back to me for a complete understanding of who I am both at psychological level and at an identity management level.
An interdisciplinary perspective is now needed to address the diversity of user and system needs suggested above. Given the complexities introduced by the volume of e-providers, and the demands to comply with the provisions of the Data Protection Act, these are far from trivial problems. Expertise in psychology and human factors is needed to understand the barriers to robust authentication systems, and to explore how best to counteract phishing and other human engineering attacks. Legal expertise is also necessary given that the use of federated identity management (FIM) systems introduces the notion of trust between service providers but also necessitates the introduction of liabilities and warranties against breaches. This network in identity will bring these expertise under one forum to discuss some of the future challenges in the area of establishing identity. In addition to this it will act as a 'one-stop-shop' where industries, government agencies and the academic community can interact and seek the necessary expertise to resolve issues around establishing the identity.
Planned Impact
The project is supported by the involvement of GCHQ, SOCA, Government Office for Science, Home Office, BT, IBM, GB Group, and Accenture. This direct involvement of the stakeholders in the project will greatly help to exploit the tools and technologies developed in this project. At the WDYTYA (Who do you think you are?) sandpit, the Technical Director of GCHQ made clear that the UK intelligence services now understand the threat posed from the misuse of identity in the cyber world and, in seeking to illuminate 'known unknowns', it is important to extend the research horizons of the closed intelligence community through dialogue with the open academic community. One potential application is related to the challenges that the Home Office/Passport Agency face today in the establishment of identity of citizens applying for UK Passports.
The algorithms, technologies, methodologies and processes developed by the Network members can be used in commercial products and we will take steps to make contact with potential commercial partners, as well as relevant government agencies. The United Kingdom has already several companies that are world leaders in this area of identity management. We will present the results of our investigation to them for possible commercial exploitation or R&D related to the integration in their products.
We also plan to offer advice to governmental agencies about requirements and procurement of systems for identification, which might also include the algorithms and techniques developed in this project.
The algorithms, technologies, methodologies and processes developed by the Network members can be used in commercial products and we will take steps to make contact with potential commercial partners, as well as relevant government agencies. The United Kingdom has already several companies that are world leaders in this area of identity management. We will present the results of our investigation to them for possible commercial exploitation or R&D related to the integration in their products.
We also plan to offer advice to governmental agencies about requirements and procurement of systems for identification, which might also include the algorithms and techniques developed in this project.
Organisations
Publications
Adnan M
(2014)
The Uncertainty of Identity Toolset
Dr A Khan, Pakistan Institute Of Engineering And Applied Sciences
Protection of patient related information and medical images using an intelligent reversible watermarking technique
Dr Di Ma, University Of Michigan USA
Sensing-assisted Identity management with Mobil Devices
Dr G Martinez, University Of Murcia Spain
Managing identity- related information across borders
Dr N Hanley, Queen's University Belfast
Physically unclonable functions and their application to secure information technologies
Dr P Waggett, IBM
Preserving privacy while under constant observation
Dr S Li, University Of Surrey
From digital watermarking to mumtimedia forensics: how can they help to detect lost identities in multimedia work?
Dr S Stevenage, Southampton University
Online and offline identities: can we reverse engineer appearances from Avatars?
Dr S Veluru, City University London
Community detection from virtual identities
Martin A
(2013)
Fixing identity? Biometrics and the tensions of material practices
in Media, Culture & Society
Nicholson J
(2013)
Faces and Pictures: Understanding age differences in two types of graphical authentications
in International Journal of Human-Computer Studies
Professor A Sasse, UCL
Federated identity provider - the user perspective
Professor A Van Moorsel, Newcastle University
Nudging for information security
Professor B Fung, McGill University Canada
AuthorMiner: Identifying individuals by writing styles
Professor B Schafer, University Of Edinburgh
Of Harry Potter and Tanja Grotter: Copyright law, fan fiction and the identity of the fictional object
Professor B Schafer, Unviersity Of Edinburgh
Sailing under false flags in heavy clouds: cloud robotics, military and international humanitarian missions and the law
Professor C Hankin, Imperial College London
Identity and social media
Professor C Mitchell, Royal Holloway, University Of London
Security issues for Google's implementation of OpenID Connect
Professor C Mitchell, Royal Holloway, University Of London;
Vulnerabilities in OAuth-based single sign-on systems
Professor Capkun
Access control in agnostic clouds
Professor Coetzee
Access control for software as a service application
Professor D Chadwick
Adding federated identity management to Openstack
Professor D Chadwick, Unviersity Of Kent
Uniform identity based policies across federated heterogeneous clouds
Professor D Gao, Singapore Management University
Human factors in user authentication
Professor D MCAuley, University Of Nottingham
Digital tool chains get your act together
Professor D Patel, NIT Surat, India
Mumtimedia authorship theft: detection and prevention
Professor D Wall, Durham University
The problem of policing identity crime
Professor D Wall, Durhan University
Identity crimes: New trends in public reporting practices to the police
Professor Desmedt
Clouds: a point of no return?
Professor E Bertino, Purdue University, USA
Protecting against linability in the digital identity ecosystem
Professor H Chen, University Of California USA
Identity and security in mobile computing systems
Professor L Batten, Deakin University Australia
Identity management on Android mobile devices
Professor M K Dhami
Standards for digital forensic analysis
Professor M Nixon, University Of Southampton
Whether identity should or could be concealed in surveillance
Professor N Smart
Multi - party computation
Professor P Briggs
Scoping the future of Identity Management
Professor P Briggs, Northumbria University
An inclusive, value-sensitive and design approach to identity management
Professor P Longley, UCL
The uncertainty of identity toolset: analysing digital traces for user profiling
Professor P Longley, UCL
A name is a statement: Linking real and virtual idetity through geodemographics
Professor R K Shyamasundar, Tata Institute Of Fundamental Research, India
Information flow-labels as a basis for identity in information systems
Professor R Sandhu
Attribute-based access control models and beyond
Professor Rana
Risk assessment for computation and data storage outsourcing
Professor Rashid
Data exfiltration risks in elastic settings
Professor Ryan
Confidentiality from the cloud provider
Professor S Fischer-Hubner, Karlstadt University Sweden
User transparency and user control
Professor S Furnell
Flexible and non-intrusive authentication
| Description | Future of Identity Foresight Report |
| Geographic Reach | National |
| Policy Influence Type | Citation in other policy documents |
| Description | UK government's Identity Assurance Programme |
| Geographic Reach | National |
| Policy Influence Type | Participation in a guidance/advisory committee |
| Impact | The Identity team has been working closely with the UK Government's digital services team to implement the Government's identity assurance programme. The Government gateway to public services will enhance the way the citizens interact with the government online services using digital identities. |
| Description | British Council |
| Amount | £125,000 (GBP) |
| Organisation | British Council |
| Sector | Charity/Non Profit |
| Country | United Kingdom |
| Start | 06/2017 |
| End | 05/2020 |