Towards Automation of Privacy and Security Risks Analysis in Identity Management Systems

Currently, risk analysis methods for identity management systems (IDMSs) mainly rely on manual inspections. Manual inspection is time consuming and expensive. This article introduces the executable model-based risk analysis method (EM-BRAM) with the aim of automating privacy and security risks analysis in IDMSs. The EM-BRAM identifies risk factors inherent in IDMSs and uses them as inputs to a colored petri nets (CPNs) model of a targeted IDMS. It then verifies the system´s risk using CPNs´ state space analysis and queries. We apply the method to analyze privacy and security risk in the OpenID IDMS.