IBM's 'Need to Know' Software

You've seen it before: A Website wants to verify that you're over 18, so they require you to enter a credit card number. They want to prove that you're a U.S. citizen, so they require a driver's license number or Social Security ID. And there you go again -- putting your entire electronic identity at risk just to enter an electronic contest or buy online movie tickets.

Can't Websites find a way to get the data they need without forcing you to input the very information that identity thieves crave?

Later this year, some Websites may be able to do just that. IBM today announced software that allows people to hide or make anonymous their personal information on the Web. Developed by researchers at IBM's laboratory in Zurich, Switzerland, the software (codenamed Identity Mixer, or Idemix for short) will enable consumers to purchase goods and services on the Internet while disclosing only the personal information the merchant truly needs to know.

As consumers hand over personal details in exchange for downloading music or subscribing to online newsletters, they leave a data trail that reveals pieces of information about the size, frequency, and source of their online purchases. This can be traced back to the user, IBM observes. IBM's Idemix software eliminates that trail by using artificial identity information -- called "pseudonyms" -- to make online transactions anonymous.

For example, the software allows people to purchase books or clothing without revealing their credit card number. It can confirm someone's spending limit without sharing their bank balance, or provide proof of age without disclosing date of birth.

Essentially, Idemix is a cryptographic go-between, explains Nataraj Nagaratnam, chief architect for identity management at IBM's Tivoli unit. "It lets the user establish trust without giving up their privacy."

With Idemix software, a user can get an anonymous digital credential, or voucher, from a trusted third party, like a bank or government agency, such as the Department of Motor Vehicles. A bank would provide a credential containing a credit card number and expiration date, and when an online purchase is made, the Idemix software digitally seals the information by transforming the credential so the user can send it to the online merchant.

By using sophisticated cryptographic algorithms, the Idemix software acts as the middleman confirming bank authorization for the purchase -- so the real credit card numbers are never revealed to the merchant. The next time a purchase is made, a new, encrypted credential would be used.

"When people don't have to disclose their personal information on the Web, the risk of identity theft is dramatically reduced," explains John Clippinger, senior fellow at the Berkman Center for Internet and Society at Harvard Law School. "The ability to anonymize transactions using Idemix has the potential to bolster consumer confidence."

IBM will contribute its Idemix software to the Eclipse Higgins project, an open source effort dedicated to developing software for "user-centric" identity management. As Nagaratnam explains it, the goal is to create a "digital wallet" in which the user can establish various "tokens" of trust and authentication, such as credit cards, driver's licenses, bank accounts, and so forth. Depending on the online transaction, the user could supply one or more of these tokens to provide the necessary third-party verifications -- without actually giving the token to the merchant.

IBM plans to deliver Idemix later this year, and it will probably be another year or two before the fruits of Idemix and the Higgins project will become widely available to consumers, Nagaratnam says. But technologies such as Idemix and Microsoft's CardSpace -- a function of Vista -- will eventually help end users build a secure way to store personal information while continuing to do business online, he says.

"The market is finally going to have its chance to test the theories and the hype behind the electronic information card," said Mike Neuenschwander, research director for Burton Group's Identity and Privacy Strategies service, in a report issued earlier this week. "With the appearance of Microsoft CardSpace, user-centric identity technologies are moving off the discussion boards and into products."

— Tim Wilson, Site Editor, Dark Reading