Identity management is crucial for any electronic service that needs to authenticate its users. Different identity-management models have been introduced and rolled out on a large scale during the past decades. Key distinguishing criteria of these models are the storage location of users' identity data and the degree of involvement of central entities such as identity providers, which can potentially track user behavior. Growing privacy awareness has led to a renaissance of user-centric identity-management models during the past few years. In this context, especially the concept of wallets applied to the digital identity domain has recently attracted attention, putting users into direct control of their identity data. Various approaches and solutions relying on this concept have been introduced recently. However, no generally accepted definitions of the concept “digital identity wallet” and of its related features and implementations exist so far, leading to considerable confusion in this domain. This paper addresses this issue by providing a systematic literature review on wallets applied to the digital identity domain to identify, analyze, and compare existing definitions, features, and capabilities of such solutions. By means of two research questions, this paper thereby contributes to a better understanding of identity wallets and the various recent developments in this domain.

Blockchains are append-only data structures, meaning their size increases steadily. As of March 2021, new nodes connecting to the Bitcoin blockchain already need to synchronize and validate more than 330 GB of data. Already now, this is an issue for resource-constrained thin clients who lack the required download, storage, or computing capacities to achieve this. In future, this issue will become even more relevant when blockchain technology is applied to new domains like the Internet of Things (IoT). We propose a new blockchain architecture that addresses this issue. Our proposal relies on incremental snapshot blocks that allow new and occasionally used clients to synchronize with the current state of the blockchain efficiently. The snapshot blocks form a second linked blockchain and are secured by the blockchain consensus algorithm. In this paper, we describe the proposed architecture in detail and evaluate its storage-saving potential using the Bitcoin blockchain. The evaluations performed show that our design can reduce the volume of data that needs to be downloaded and stored by up to 98%, thus facilitating secure blockchain-based applications also on resource-constrained thin clients like smartphones, netbooks, or IoT devices.

Personalized electronic services, e.g. from the e-government domain, need to reliably identify and authenticate users. During user-authentication processes, the electronic identity of the respective user is determined and required additional attributes, e.g. name and date of birth, linked to this identity are collected. This attribute-collection process can become complex, especially if required attributes are distributed over various attribute providers that are organized in a federated identity-management system. In many cases, these identity management systems rely on different ontologies and make use of different languages. Hence, identity federations, such as the one currently established across the European Union, require effective solutions to collect user attributes from different heterogeneous sources and aggregate them to a holistic user facet. At the same time, these solutions need to comply with minimum disclosure rules to preserve users’ privacy. In this article, we propose and introduce a solution for privacy-preserving attribute aggregation. Our solution combines attributes from different domains using ontology alignment and makes use of locality sensitive hashing functions to preserve users’ privacy. Evaluation results obtained from conducted experiments demonstrate our solution’s advantages for both, service providers and users. While service providers can be provided with a larger set of attributes, users remain in full control of their data and can decide on which of their attributes shall be revealed.

Many different technologies fostering and supporting distributed and decentralized computing scenarios emerged recently. Edge computing provides the necessary on-demand computing power for Internet-of-Things (IoT) devices where it is needed. Computing power is moved closer to the consumer, with the effect of reducing latency and increasing fail-safety due to absent centralized structures. This is an enabler for applications requiring high-bandwidth uplinks and low latencies to computing units. In this paper, a new use case for edge computing is identified. Mobile devices can overcome their battery limitations and performance constraints by dynamically using the edge-computing-provided computational power. We call this new technology Hybrid Mobile Edge Computing. We present a general architecture and framework, which targets the mobile device use case of hybrid mobile edge computing, not only considering the improvement of performance and energy consumption, but also providing means to protect user privacy, sensitive data and computations. The achieved results are backed by the results of our analysis, targeting the energy saving potentials and possible performance improvements.

Electronic signatures are frequently used in security-critical fields of application such as e-government or e-banking. During the past years, especially server-based signature solutions have gained popularity, as they solve usability problems of traditional client-based approaches. Unfortunately, server-based signature solutions and their underlying security concepts are usually tailored to classical end-user devices such as desktop PCs or laptops. Therefore, these solutions cannot be used on mobile end-user devices such as smartphones. This excludes an increasing number of potential users, who prefer mobile end-user devices to access e-government and e-banking applications. To solve this problem, we propose a new server-based signature solution that is tailored to the special characteristics of mobile devices. The proposed solution is evaluated by means of a concrete prototype implementation. This prototype proves the feasibility of the proposed solution and demonstrates its capability to leverage the use of electronic signature based applications on mobile end-user devices.

Unique identification and secure authentication are essential processes in various areas of application, e.g. in e-Government, e-Health, or e-Business. During the past years several identity management-systems and models have evolved. Many organizations and enterprises or even countries for their national eID solutions rely on identity management-systems for securing their applications. Since more and more applications are migrated into the cloud, secure identification and authentication are also vital in the cloud domain. How- ever, cloud identity management-systems need to meet slightly different requirements than traditional identity management-systems and thus cannot be clustered into the same model types or categories. Therefore, in this paper we give an overview of different cloud identity management-models that have already emerged up to now. We further compare these models based on selected criteria, e.g. on practicability and privacy aspects.

Single Sign-On (SSO) has become a popular technology allowing users to identify and authenticate once and to gain access to different resources in a distributed computing environment. Austrian e-Government relies on a secure and privacy-preserving sectoral identity management model. Even if a sectoral identifier model improves privacy, it also negatively affects the usability of authentication processes. In Austria, most public sector applications use an open-source identity provider called MOA-ID. However, due to the sectoral identity management MOA-ID has not been Single Sign-On-capable. In this paper we present a security architecture that enables Single Sign-On between different governmental applications using MOA-ID as identity provider while meeting the requirements for sectoral data privacy protection at the same time. We achieve this by transforming unique sectoral identifiers of users with the help of an additional trusted attribute provider.