For ease in management of user credentials, integration of Identity Provider and Kerberos authentication system is recommended.
The second guide on 'authentication credentials in support of government online services' will provide guidance on the use of identity credentials to support citizen authentication to the government's digital services.
In order to ensure privacy, Cloud based identity management systems must offer encrypted storage and transmission of identity credentials.
A11 Replay Attack Replay attack occurs when an IDMS fails to ensure the security of identity credentials during their transmission.
IDMS should be capable of ensuring strong encryption and secure distribution of identity credentials across multiple servers (Jacobs and Poll [2011]; Zissis and Lekkas [2012]).
The compiled list aided in determining the key security features that a Cloud based IDMS must provide to ensure the protection and security of Identity credentials in Cloud.
These systems are independent of underlying architecture for instance, a User-Centric IDMS might be based on federated identity management architecture, or it may follow the centralized identity management approach for the management and storage of identity credentials.
An IDMS that supports interoperability among various identity management systems (by either offering support to multiple technologies or by following common schema for the exchange of identity credentials) help to ensure consistent user experience while accessing multiple services.
In the hierarchical storage, IDMSs store user information with different access levels considering the sensitivity of identity credentials; therefore, in case if any intermediate node gets compromised, the impact of information loss will be minimal.
The key used for the encryption of identity credentials is securely shared between the communicating parties only so that the information will only be disclosed to the authorized user having the right key pair.
Due to the absence of real-time tracking and activity logging mechanisms, service consumers can easily repudiate their malicious activities that they have actually performed on Cloud servers, such as unauthorized manipulation of data and forgery of identity credentials (Bertino and Takahashi [2010]; Thompson et al. [2006]; Yan et al. [2009]; Zissis and Lekkas [2012]).
