Subject: [KEYPROV] Credential Management by "Cloud" Services

From: Anders Rundgren <[email-masked]>
Date: Fri, 23 Apr 2010 11:33:22 +0200

If credentials are issued by "Cloud" Services it seems reasonable that 
the very same
services would be interested in managing the credentials they have 
issued as well.

However, to actually do that they need access to the user's credential 
store/wallet
which calls for solutions that confine providers to "sandboxes" in 
several aspects:

- A "Cloud" Service must not be able to learn a user's relations with other
  providers by looking into the credential store/wallet

- A "Cloud" Service must only be able to manipulate credentials it has 
issued

The following document outlines a Cloud-based credential management scheme
that through the use of fairly advanced cryptography tries to combine 
privacy and
security/integrity with robustness:

http://webpki.org/papers/keygen2/sec-mgmt-of-objts-in-rmot-cntrs-shrd-by-mltple-issrs2.pdf

Pardon the format which is a little bit like a patent application[1], 
but it is short,
illustrated, and written in the author's favorite tech. lingo, SwEnglish 
[2] :-)

Anders

1] http://priorartdatabase.com/IPCOM/000195189

2] Originally introduced by Abba and Roxette, pronounced "Swinglish"