Author:

Abstract:

Identity management encompasses two distinct, yet related, activities. First, it refers to the definition, designation and administration of identity attributes (e.g., names, addresses, relationships, qualifications). It also deals with the management of access rights to applications, services, resources and information (e.g., to determine who can create, update, delete information).Identity management systems have been deployed in many contexts for a broad range of applications. Examples include government services or healthcare services that manage information about people (citizens, patients, employees), or companies that manage information about their clients, suppliers and products. Identity management systems form the organizational and technical infrastructure that supports the management of information specific to (uniquely identifiable) entities, i.e., citizens, clients, suppliers, etc.This thesis focuses on large-scale identity management systems, such as those used in the government and healthcare sector. While the identity and information management concepts that are presented have a generic nature, the Belgian eGovernment and eHealth services serve as use cases to illustrate the drivers, implementations and functionalities of large-scale identity management systems. This thesis starts with an analysis of the core concepts and objectives underlying identity management systems. This analysis is followed by a description of issues related to the identity management systems that are currently in use. In particular, it focuses on the means that the Belgian government has issued to individuals and organizations which allow them to authenticate themselves or specific information. The analysis also includes a discussion on the mechanisms that can be implemented to increase the transparency of identity management systems, as well as the techniques that can be utilized by users to delegate their rights.This thesis further proposes a number of systems that address security and privacy issues that have surfaced in practice. The first solution consists of the introduction of a dedicated smart card reader for Belgian eID cards which mitigates the risk of inappropriate use of the electronic identity card. The second solution consists of a proposal to restrict the unnecessary propagation of a citizen’s national registry number when she uses her electronic identity card, e.g., while authenticating herself on the Internet. Lastly, this thesis introduces an electronic voting system that resolves the shortcomings that have been identified in relation to the electronic voting system that is currently used for pubic-sector elections in Belgium.