1 / 22

Digital Identity within E-Business and E-Government: Where are we now and Where do we go from here

Digital Identity within E-Business and E-Government: Where are we now and Where do we go from here. William Barnhill Booz Allen Hamilton. Agenda. What are the basics of Identity 2.0? Where are we now? Where are we going? What does the future hold? Questions and Comments?.

honey
Download Presentation

Digital Identity within E-Business and E-Government: Where are we now and Where do we go from here

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Digital Identity within E-Business and E-Government:Where are we now andWhere do we go from here William Barnhill Booz Allen Hamilton

  2. Agenda • What are the basics of Identity 2.0? • Where are we now? • Where are we going? • What does the future hold? • Questions and Comments?

  3. What are the basics of Identity 2.0?

  4. What identity is and isn’t • Dictionary.com on identity: • The collective aspect of the set of characteristics by which a thing is definitively recognizable or known • More precisely: • A digital representation of a set of claims made by one party about itself or another digital subject [Identity Gang] • Some say identity = reputation, others not • IMHO, reputation is just a possible set of claims • Note the above definition says ‘thing’ not person: • A corporation can and does have an identity • So does an online community • Less clear are things that cannot express free will: routers, etc. • Identity is not identification, that’s just one use

  5. The Core Concept of Identity 2.0 • User-Centric Identity • User consent – • User always can allow or deny whether information about them is released or not (reactive consent management) • User control – • User has ability to policy-control all exchanges of identity information (proactive consent management) • User delegates decisions to identity agents controlled through policy • User-centered – • Pete Rowley describes this core subset of the previous two as ‘People in the protocol’ • User is actively involved in information disclosure policy decisions at run time

  6. Identity In e-Business and e-Gov • Identity 2.0 drivers in e-Business and e-Gov • Spam: > 50% of blogs are spam blogs (splogs) • Growing risk of identity theft • Niche marketing requires greater identity • Regulation: e.g. China’s 18-digit ID numbers to combat gaming addiction in those under 18 • The Identity Meta-System • No single identity solution will work for everyone • Consistent user experience across different systems • Interoperability of identifiers, identity claims through encapsulating protocol...the IP of identity

  7. Where are we now?

  8. Identity standards in our hands • SAML 2.0 : OASIS • OpenId: OpenID.net • Liberty ID-WSF • CardSpace: Microsoft • Username/Password Source: Eve Maler, from http://www.xmlgrrl.com/blog/archives/2007/03/28/the-venn-of-identity/

  9. Where are the problems? • We are in the pre-IP world of Ethernet, Token Ring, etc (SAML, OpenID, i-names, WS-Trust, ID-WSF) • Publish your information once, relinquish control • SPAM cost $21.58 billion annually, according to the 2004 National Technology Readiness Survey • Identity fraud cost $56.6 billion in 2006 • Existing standards have not been used to solve the above problems • Each existing standard addresses different facets of identity from the perspective of different users • No single standard acts as the gem that holds the facets together • Thorny issues: • How do we represent claims in a way translatable to everyone? • How do we represent claims in a way translatable to everyone? • How do we capture negotiation of what claims are needed?

  10. Identity standards on the horizon • The identity meta-system • MS vision, implemented in InfoCard • Higgins • Novell’s vision for an identity meta-system, implemented in the Bandit project • OpenID • Community vision for very lightweight identity meta-system, implemented in Apache Heraldry project • i-names • Extensible Resource Identifiers (XRI) are exponentially more valuable for a lightweight identity system, implemented in XDI i-brokers • Many others, see http://wiki.idcommons.net/moin.cgi/IdentityLandscape

  11. Where are we going?

  12. Kim Cameron’s Laws of Identity • User Control and Consent: Identity systems must only reveal information identifying a user with the user's consent. • Minimal Disclosure for a Constrained Use: The identity system must disclose the least identifying information possible, as this is the most stable, long-term solution. • Justifiable Parties: Identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship. • Directed Identity: A universal identity system must support both "omni-directional" identifiers for use by public entities and "uni-directional" identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles. • Pluralism of Operators and Technologies: A universal identity solution must utilize and enable the interoperation of multiple identity technologies run by multiple identity providers. • Human Integration: Identity systems must define the human user to be a component of the distributed system, integrated through unambiguous human-machine communication mechanisms offering protection against identity attacks. • Consistent Experience Across Contexts: The unifying identity metasystem must guarantee its users a simple, consistent experience while enabling separation of contexts through multiple operators and technologies. Source: http://msdn2.microsoft.com/en-us/library/ms996422.aspx#identitymetasy_topic2

  13. Will they work in the enterprise? • Short answer: Yes • Inward facing answer: Yes, but… • Enterprise security and compliance requirements may force up front user consent within the enterprise • May limit operators and technologies allowed • Outward facing answer: Unqualified yes • Your customers, and quite possibly future laws, will require enterprises to protect the identity of their consumers • Enterprises will be required to protect their own identity to combat phishing and spam

  14. Identity Meta-system Requirements • For adoption… • Open in all senses of the word…a communal barn-raising • Simply complex…Simple at its core, with the capability of handling complexity by adding plug-ins of some form • Microsoft’s Kim Cameron states 5 key pieces: • A way to represent identities using claims • A means for identity providers, relying parties, and subjects to negotiate • An encapsulating protocol to obtain claims and requirements • A means to bridge technology and organizational boundaries using claims transformation • A consistent user experience across multiple contexts, technologies, and operators

  15. Convergence in the Identity space • URL-based vs Card-based vs Token-based • Convergence between URL-based and Card-based identity • Convergence starting to happen between URL based and token based identity • Towards full convergence and a true identity meta-system • URL-based identity => Resource identifier-based • XRI-based identity => a possible full convergence • The i-broker concept

  16. Identity Standards Adoption • Adoption is happening right now • The grassroots/Web 2.0 adoption vector • URL-based identity: OpenID, YADIS • The Enterprise adoption vector • Token+Card-based identity (WS-Trust, CardSpace)

  17. What does the future hold?

  18. Identity 2.0 Services are a Blue Ocean • Blue Ocean vs a Red Ocean • Characteristics of a Blue ocean market • Pioneering vs. Competitive, breeds cooperation • Creating or redefining demand • Key to sustainable success • Many service offering possibilities, few providers • Current providers are more co-operative, incl. Microsoft • So…Identity 2.0 Services is a blue ocean

  19. What the future may hold • An Identity Meta-System (IMS) standard that specifies core IMS requirements and possible profiles • Multiple flavors of an Identity Meta-System (InfoCard, Bandit, XDI I-Brokers) that implement that standard • Standards for reputation representation and interchange, leading to reputation as a real value currency

  20. What you can do • Help raise the barn! • Join two Open Source projects • Why two? • Because you’ll be looking at the problem from different perspectives, and because we need more people as bridges • Join or form OASIS Identity-related technical committees • Talk to your enterprise leadership: • How user-centric is their identity? • Do they have documented Identity Management policies and procedures? • If not, help them write them, or out-source it (in the interests of full disclosure, Booz Allen has an IdM group)

  21. Summary • User-centric identity will be crucial as software-as-service, knowledge management, and social software become widespread in the enterprise • Adopting the right emerging identity standard for your enterprise will have significant ROI • Identity 2.0 brings several new market opportunities, most of them tied to Open Source • We’re still at the stage where an Identity Management (IdM) consultant needs to know many standards, but convergence is happening.

  22. Questions and Comments?

More Related