Future of Mobile User-Centric Identity Management in an Ambient Intelligence (AmI) World

AmI manifests itself through a collection of everyday devices incorporating computing and networking capabilities that enable them to interact with each other, make intelligent decisions and interact with users through user friendly multimodal

interfaces. Ambient intelligence is driven by users’ needs and the design of its capabilities should be driven by users’ requirements.

Ambient Intelligence technologies are expected to combine concepts of ubiquitous computing and intelligent systems putting humans in the center of technological developments. In deed, the Internet extension to home and mobile networks, the multiplication of modes of connection will make the individual the central point. Therefore, the identity is a challenge in this environment and will guarantee the infatuation with Ambient Intelligence. Moreover, AmI will be the future environment where we shall be surrounded by mobile devices which will be more and more used for mobile interactions with things, places and people.

The low-cost and the shrinking size of sensors as well as the ease of deployment will aid ambient intelligence research efforts for rapid prototyping. Evidently, a sensor combined with unique biometric identifiers is becoming more frequently utilized in access a system, and supposedly provide proof of a person’s identity and thus accountability for subsequent actions.

To explore these new AmI technologies, it is easier to investigate a scenario related to ubiquitous computing in an ambient intelligence environment.

4.5.1 AmI Scenario

A person having a mobile device, GPS (or equivalent) and an ad-hoc communication network connected to sensors, visits an intelligent environment supermarket and would like to acquire some merchandise. We illustrate below how this person can benefit from mobile identity.

When this person enters the supermarket, he/she is identified by means of his/her mobile device or implemented RFID tag and a special menu is displayed to him/her. His/her profile, related to his/her context identity, announces a discount if there is one. The members of his/her social network could propose him/her a connection if they are present and even guide him to their location.

Merchandise on display could communicate with his/her device to show prices and details. Location-based services could be offered to quickly find his/her specific articles. His device could help him to find diabetic foods or any restrictions associated with specific articles. A secure Web connection could be initiated to give more information about purchases and the user account.

An adaptive screen could be used by the supermarket to show him/her information that is too extensive for his/her device screen. Payment could be carried out using payment identity stored in his/her device and even a biometric identity to prevent identity theft. Identity information and profiling should be portable and seamless for interoperability. The identity must be managed to ensure user control. Power and performance management in this environment is a must.

The concept of authentication between electronic devices is also highlighted. In order to use identity management, the user needs an appropriate tool to facilitate the management for the disclosure of personal data. A usable and secure tool should be proposed to help even inexperienced users manage their general security needs when using the network.

We need mobile identity management, which is a concept that allows the user to keep his or her privacy, depending on the situation. By using identity management, the user’s device acts in a similar way to the user. In different contexts, the user

presents a different appearance. Devices controlled by identity management change their behavior similar to the way in which a user would.

4.5.2 Requirements for Mobile User-centric Identity Management in an AmI world As the network evolution is toward mobility with the proliferation of ubiquitous and pervasive computing systems, the importance of identity management to build trust relationships in the context of electronic and mobile (e/m) government and business is evident [30, 31]. Thereby, all these systems require advanced, automated identity management systems in order to be cost effective and easy to use.

Several mobile devices such as mobile phones, smart cards of RFID are used for mobility. As mobile devices have fixed identifiers, they are essentially providing a mobile identity that can be liked to a user. Mobile identity takes into account location data of mobile users in addition to their personal data. A recent court decision in the UK has established as proof of location of the accused the location trace of his mobile phone which implies a de facto recognition of the identity of a citizen as the identity of her mobile telephones. [1]

That is why Mobile identity management (MIdm) is necessary to empower mobile users to manage their mobile identities to enforce their security and privacy interests. Mobile identity management is a special kind of identity management.

For this purpose, mobile users must be able to control the disclosure of their mobile identity dependent on the respective service provider and also their location via mobile identity management systems.

Ambient Intelligence emphasizes the principles of secure communication anywhere, anytime, with anything. The evolution of AmI will directly influence identity management with this requirement to ensure mutual interaction between users and things. Being Anywhere will imply more and more mobility, interoperability and profiling. At Anytime will imply online as well as offline connection as the network does not have a 100% coverage and will imply power as well as performance management in order to optimize use battery. With anything will imply sensor use, biometrics and RFID interaction; and Securely implies more and more integration of privacy, authentication, anonymity and prevention of identity theft.

From multilateral security [39,38], Jendricke [36] has derived privacy principles for MIdm and we have completed them below with a few other important principles.

Management systems:

1. Context-detection a. Sensors b. Biometrics c. RFID 2. Anonymity 3. Security

a. Confidentiality b. Integrity c. Non-repudiation

d. Availability 4. Privacy

a. Protection of location information 5. Trustworthiness

a. Segregation of power, separating knowledge, integrating independent parties

b. Using Open Source

c. Trusted seals of approval seal 6. Law Enforcement / Liability

a. Digital evidence b. Digital signatures c. Data retention 7. Usability

a. Comfortable and informative user interfaces b. Training and education

c. Reduction of system’ complexity d. Raising awareness

8. Affordability

a. Power of market :Produce MIMS that are competitive and are able to reach a remarkable penetration of market

b. Using open source building blocks

c. Subsidies for development, use, operation, etc.

9. Power management : the energy provided by the batteries of mobile devices is limited and that energy must be used with care on energy-friendly applications and services

10. Online and offline identity proof

11. Small screen size and lower computational capability 12. Interoperability

13. Identity needs to be portable to be understood by any device.