Slide 1: Digital Identity within E-Business and E-Government: Where are we now and Where do we go from here William Barnhill Booz Allen Hamilton
Slide 2: Agenda      What are the basics of Identity 2.0? Where are we now? Where are we going? What does the future hold? Questions and Comments?
Slide 3: What are the basics of Identity 2.0?
Slide 4: What identity is and isn’t  Dictionary.com on identity:  The collective aspect of the set of characteristics by which a thing is definitively recognizable or known A digital representation of a set of claims made by one party about itself or another digital subject [Identity Gang]  More precisely:     Some say identity = reputation, others not IMHO, reputation is just a possible set of claims Note the above definition says ‘thing’ not person:    A corporation can and does have an identity So does an online community Less clear are things that cannot express free will: routers, etc.  Identity is not identification, that’s just one use
Slide 5: The Core Concept of Identity 2.0  User-Centric Identity  User consent –  User always can allow or deny whether information about them is released or not (reactive consent management) User has ability to policy-control all exchanges of identity information (proactive consent management) User delegates decisions to identity agents controlled through policy Pete Rowley describes this core subset of the previous two as ‘People in the protocol’ User is actively involved in information disclosure policy decisions at run time  User control –    User-centered –  
Slide 6: Identity In e-Business and e-Gov  Identity 2.0 drivers in e-Business and e-Gov     Spam: > 50% of blogs are spam blogs (splogs) Growing risk of identity theft Niche marketing requires greater identity Regulation: e.g. China’s 18-digit ID numbers to combat gaming addiction in those under 18 No single identity solution will work for everyone Consistent user experience across different systems Interoperability of identifiers, identity claims through encapsulating protocol...the IP of identity  The Identity Meta-System   
Slide 7: Where are we now?
Slide 8: Identity standards in our hands      SAML 2.0 : OASIS OpenId: OpenID.net Liberty ID-WSF CardSpace: Microsoft Username/Password Source: Eve Maler, from http://www.xmlgrrl.com/blog/archives/2007/03/28/the-venn-of-identity/
Slide 9: Where are the problems?         We are in the pre-IP world of Ethernet, Token Ring, etc (SAML, OpenID, i-names, WS-Trust, ID-WSF) Publish your information once, relinquish control SPAM cost $21.58 billion annually, according to the 2004 National Technology Readiness Survey Identity fraud cost $56.6 billion in 2006 Existing standards have not been used to solve the above problems Each existing standard addresses different facets of identity from the perspective of different users No single standard acts as the gem that holds the facets together Thorny issues:    How do we represent claims in a way translatable to everyone? How do we represent claims in a way translatable to everyone? How do we capture negotiation of what claims are needed?
Slide 10: Identity standards on the horizon  The identity meta-system  MS vision, implemented in InfoCard Novell’s vision for an identity meta-system, implemented in the Bandit project Community vision for very lightweight identity meta-system, implemented in Apache Heraldry project Extensible Resource Identifiers (XRI) are exponentially more valuable for a lightweight identity system, implemented in XDI ibrokers  Higgins   OpenID   i-names   Many others, see http:// wiki.idcommons.net/moin.cgi/IdentityLandscape
Slide 11: Where are we going?
Slide 12: Kim Cameron’s Laws of Identity        User Control and Consent: Identity systems must only reveal information identifying a user with the user's consent. Minimal Disclosure for a Constrained Use: The identity system must disclose the least identifying information possible, as this is the most stable, long-term solution. Justifiable Parties: Identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship. Directed Identity: A universal identity system must support both "omni-directional" identifiers for use by public entities and "uni-directional" identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles. Pluralism of Operators and Technologies: A universal identity solution must utilize and enable the interoperation of multiple identity technologies run by multiple identity providers. Human Integration: Identity systems must define the human user to be a component of the distributed system, integrated through unambiguous humanmachine communication mechanisms offering protection against identity attacks. Consistent Experience Across Contexts: The unifying identity metasystem must guarantee its users a simple, consistent experience while enabling separation of contexts through multiple operators and technologies. Source: http://msdn2.microsoft.com/en-us/library/ms996422.aspx#identitymetasy_topic2
Slide 13: Will they work in the enterprise?   Short answer: Yes Inward facing answer: Yes, but…   Enterprise security and compliance requirements may force up front user consent within the enterprise May limit operators and technologies allowed Your customers, and quite possibly future laws, will require enterprises to protect the identity of their consumers Enterprises will be required to protect their own identity to combat phishing and spam  Outward facing answer: Unqualified yes  
Slide 14: Identity Meta-system Requirements  For adoption…   Open in all senses of the word…a communal barn-raising Simply complex…Simple at its core, with the capability of handling complexity by adding plug-ins of some form A way to represent identities using claims A means for identity providers, relying parties, and subjects to negotiate An encapsulating protocol to obtain claims and requirements A means to bridge technology and organizational boundaries using claims transformation A consistent user experience across multiple contexts, technologies, and operators  Microsoft’s Kim Cameron states 5 key pieces:     
Slide 15: Convergence in the Identity space     URL-based vs Card-based vs Token-based Convergence between URL-based and Cardbased identity Convergence starting to happen between URL based and token based identity Towards full convergence and a true identity meta-system    URL-based identity => Resource identifier-based XRI-based identity => a possible full convergence The i-broker concept
Slide 16: Identity Standards Adoption   Adoption is happening right now The grassroots/Web 2.0 adoption vector  URL-based identity: OpenID, YADIS Token+Card-based identity (WS-Trust, CardSpace)  The Enterprise adoption vector 
Slide 17: What does the future hold?
Slide 18: Identity 2.0 Services are a Blue Ocean   Blue Ocean vs a Red Ocean Characteristics of a Blue ocean market    Pioneering vs. Competitive, breeds cooperation Creating or redefining demand Key to sustainable success    Many service offering possibilities, few providers Current providers are more co-operative, incl. Microsoft So…Identity 2.0 Services is a blue ocean
Slide 19: What the future may hold    An Identity Meta-System (IMS) standard that specifies core IMS requirements and possible profiles Multiple flavors of an Identity Meta-System (InfoCard, Bandit, XDI I-Brokers) that implement that standard Standards for reputation representation and interchange, leading to reputation as a real value currency
Slide 20: What you can do  Help raise the barn!  Join two Open Source projects Because you’ll be looking at the problem from different perspectives, and because we need more people as bridges  Why two?    Join or form OASIS Identity-related technical committees Talk to your enterprise leadership:    How user-centric is their identity? Do they have documented Identity Management policies and procedures? If not, help them write them, or out-source it (in the interests of full disclosure, Booz Allen has an IdM group)
Slide 21: Summary     User-centric identity will be crucial as softwareas-service, knowledge management, and social software become widespread in the enterprise Adopting the right emerging identity standard for your enterprise will have significant ROI Identity 2.0 brings several new market opportunities, most of them tied to Open Source We’re still at the stage where an Identity Management (IdM) consultant needs to know many standards, but convergence is happening.
Slide 22: Questions and Comments?