Threat Analysis and Attack Modeling for Identity Management Solutions

The increased use of digitization has given rise to “Digital Identity”. Existing models have been in use with number of improvisations throughout these years. But, the more centralized nature and control given to service providers have made these models vulnerable to various threats. The identity model is a structure which depicts the entities in a digital identity flow. Apart from having their own pros and cons with respect to application requirements, the models also face threats in a cyber space. Identifying the threats to the identity models will bridge the gap between weaknesses of the system and mitigation strategies. The traditional identity models show the identity management by depicting the relation between service providers and users. Attack tree is one of the many existing threat modeling tools. The simplicity and preciseness of this tool make it a suitable approach for threat analysis of identity models. The risk assessment matrix reflects the level of severity, which helps in identifying the Mitigation Strategy. This paper helps in analyzing the threats with the help of attack trees and risk matrix model. The paper will also explore the vulnerabilities of the identity models and propose mitigation strategies for the threats. The gap analysis presented paves a path for a comparatively better Identity Management Model known as Self-Sovereign Identity, which gives user a complete ownership of his identity.