The software, called "Identity Mixer," was developed by IBM researchers. The idea is that people provide encrypted digital credentials issued by trusted parties like a bank or government agency when transacting online, instead of sharing credit card or other details in plain text, Anthony Nadalin, IBM's chief security architect, said in an interview.
"Today you traditionally give away all of your information to the man in the middle and you don't know what they do with it," Nadalin said. "With Identity Mixer you create a pseudonym that you hand over."
For example, when making a purchase online, buyers would provide an encrypted credential issued by their credit card company instead of actual credit card details. The online store can't access the credential, but passes it on to the credit card issuer, which can verify it and make sure the retailer gets paid.
"This limits the liability that the storefront has, because they don't have that credit card information anymore," Nadalin said. "All you hear about is stores getting hacked."
Similarly, an agency such as the Department of Motor Vehicles could issue an encrypted credential that could be used for age checks, for example. A company looking for such a check won't have to know an individual's date of birth or other driver's license details; the DMV can simply electronically confirm that a person is of age, according to IBM.
The encrypted credentials would be for one-time use only. The next purchase or other transaction will require a new credential. The process is similar to the one-time-use credit card numbers that Citigroup card holders can already generate on the bank's Web site.
IBM hopes technology such as its Identity Mixer helps restore trust in the Web. Several surveys in past years have shown that the seemingly incessant stream of data breaches andare eroding consumer confidence in online shopping and activities such as banking on the Web.
To get Identity Mixer out of the lab and into the real world, IBM is donating its work to, a broad, open-source effort that promises to give people more control of their personal data when doing business online. Higgins also aims to make the multiple authentication systems on the Net work together, making it easier for people to manage Internet logins and passwords.
"We expect Higgins to get wide deployment and usage. You'll get the ability by using Higgins to anonymize data," Nadalin said.
Higgins is still under development. A first version of the projects work is slated to be done sometime midyear, said Mary Ruddy, a Higgins project leader. "We were thrilled to get this donation to Higgins, IBM has done a lot of good work."