OIDC-PRINCE

The OIDC PRINCE project aims to enhance the privacy support in user consents used in OpenID Connect  authentication and authorization processes.

Nowadays the consent to access the claims about end-user and authentication events (e.g., gender, birthdate, phone number), may have associated privacy issues. Users need to be informed regarding the potential risk of providing consent for the personal information access by services/entities that may not be trusted by the user and the OpenID Provider, which is responsible to manage the authentication and authorization.

OpenID PRINCE introduces the proof of privacy regulations compliance (e.g., compliance with GDPR) in the OIDC discovery and registration processes using data privacy vocabulary (DPV) specification that can be certified by entities external to the OIDC authentication process. These proofs can be stored securely in a EMV compliant blockchain.

OIDC PRINCE also enables privacy analysis to assess the risk of services accessing the end-user private information. This analysis, performed by Fuzzy Logic models considers the claims which access is being requested and the profile of the service requesting the access, for instance if it is a service associated with acquisitions or a service for education and learning.

OIDC PRINCE contributes to enhance the support of privacy in OpenID connect by enabling informed consents, and by minimizing the data sharing with entities that are not trusted, or that do not provide evidence of being trustworthy in terms of privacy management.

Team

Bruno Sousa

Assistant professor at the university of Coimbra

Tiago Galvão

Researcher at the CISUC.

Bernardo Arzileiro

Master student enrolled at Master in Engineering Informatics, at the University of Coimbra

Paulo Silva

Master student enrolled at Master in Informatics Security, at the University of Coimbra

Entities

University of Coimbra

The University of Coimbra (UC) is a public higher education institution founded in 1290.

Website: https://www.uc.pt/