  Identity federations operating in a business or consumer context need to
prevent the collection of user data across trust service providers for legal
and business case reasons. Legal reasons are given by data protection
legislation. Other reasons include business owners becoming increasingly aware
of confidentiality risks that go beyond traditional information security, e.g.,
the numbers of authentications to an EDI service might provide insights into
the volume of invoices, from which one could derive insider information. This
paper proposes extended technical controls supporting three privacy
requirements: a) Limit d Linkability: Two service providers cannot link data
related to a user without the help of a third party, using neither an
identifier nor other identifying attributes like email addresses or payment
data; b) Limited Observability: An identity provider cannot trace which
services a user is using without the help of a third party; c) Non-Disclosure:
Attributes provided to the service provider by an attribute provider are not
disclosed to the identity provider or an intermediate service broker. Using a
hub-and-spoke federation style following the privacy-by-design principle, this
reference architecture addresses the privacy controls mentioned above.
