Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

IBM's 'Need to Know' Software

IBM's Idemix application lets consumers do business on the Web without giving away unnecessary personal data

You've seen it before: A Website wants to verify that you're over 18, so they require you to enter a credit card number. They want to prove that you're a U.S. citizen, so they require a driver's license number or Social Security ID. And there you go again -- putting your entire electronic identity at risk just to enter an electronic contest or buy online movie tickets.

Can't Websites find a way to get the data they need without forcing you to input the very information that identity thieves crave?

Later this year, some Websites may be able to do just that. IBM today announced software that allows people to hide or make anonymous their personal information on the Web. Developed by researchers at IBM's laboratory in Zurich, Switzerland, the software (codenamed Identity Mixer, or Idemix for short) will enable consumers to purchase goods and services on the Internet while disclosing only the personal information the merchant truly needs to know.

As consumers hand over personal details in exchange for downloading music or subscribing to online newsletters, they leave a data trail that reveals pieces of information about the size, frequency, and source of their online purchases. This can be traced back to the user, IBM observes. IBM's Idemix software eliminates that trail by using artificial identity information -- called "pseudonyms" -- to make online transactions anonymous.

For example, the software allows people to purchase books or clothing without revealing their credit card number. It can confirm someone's spending limit without sharing their bank balance, or provide proof of age without disclosing date of birth.

Essentially, Idemix is a cryptographic go-between, explains Nataraj Nagaratnam, chief architect for identity management at IBM's Tivoli unit. "It lets the user establish trust without giving up their privacy."

With Idemix software, a user can get an anonymous digital credential, or voucher, from a trusted third party, like a bank or government agency, such as the Department of Motor Vehicles. A bank would provide a credential containing a credit card number and expiration date, and when an online purchase is made, the Idemix software digitally seals the information by transforming the credential so the user can send it to the online merchant.

By using sophisticated cryptographic algorithms, the Idemix software acts as the middleman confirming bank authorization for the purchase -- so the real credit card numbers are never revealed to the merchant. The next time a purchase is made, a new, encrypted credential would be used.

"When people don't have to disclose their personal information on the Web, the risk of identity theft is dramatically reduced," explains John Clippinger, senior fellow at the Berkman Center for Internet and Society at Harvard Law School. "The ability to anonymize transactions using Idemix has the potential to bolster consumer confidence."

IBM will contribute its Idemix software to the Eclipse Higgins project, an open source effort dedicated to developing software for "user-centric" identity management. As Nagaratnam explains it, the goal is to create a "digital wallet" in which the user can establish various "tokens" of trust and authentication, such as credit cards, driver's licenses, bank accounts, and so forth. Depending on the online transaction, the user could supply one or more of these tokens to provide the necessary third-party verifications -- without actually giving the token to the merchant.

IBM plans to deliver Idemix later this year, and it will probably be another year or two before the fruits of Idemix and the Higgins project will become widely available to consumers, Nagaratnam says. But technologies such as Idemix and Microsoft's CardSpace -- a function of Vista -- will eventually help end users build a secure way to store personal information while continuing to do business online, he says.

"The market is finally going to have its chance to test the theories and the hype behind the electronic information card," said Mike Neuenschwander, research director for Burton Group's Identity and Privacy Strategies service, in a report issued earlier this week. "With the appearance of Microsoft CardSpace, user-centric identity technologies are moving off the discussion boards and into products."

— Tim Wilson, Site Editor, Dark Reading

  • IBM Corp. (NYSE: IBM)
  • Microsoft Corp. (Nasdaq: MSFT)
  • IBM Tivoli Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    COVID-19: Latest Security News & Commentary
    Dark Reading Staff 10/27/2020
    6 Ways Passwords Fail Basic Security Tests
    Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
    'Act of War' Clause Could Nix Cyber Insurance Payouts
    Robert Lemos, Contributing Writer,  10/29/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    How to Measure and Reduce Cybersecurity Risk in Your Organization
    In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
    Flash Poll
    How IT Security Organizations are Attacking the Cybersecurity Problem
    How IT Security Organizations are Attacking the Cybersecurity Problem
    The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-27652
    PUBLISHED: 2020-10-29
    Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
    CVE-2020-27653
    PUBLISHED: 2020-10-29
    Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
    CVE-2020-27654
    PUBLISHED: 2020-10-29
    Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.
    CVE-2020-27655
    PUBLISHED: 2020-10-29
    Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.
    CVE-2020-27656
    PUBLISHED: 2020-10-29
    Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.