Identity Management Liberty Alliance Project • Rise of electronic networks: • Need stronger or relevant (business related) use of Setting the Standard identity verification and authorization for Federated Network Identity • Company extranets • Online trading • Identity fraud (#1 consumer complaint): Privacy, Identity Management and Services • Worldwide monetary losses from identity theft were using Liberty technologies in Mobile approximately $8.75 billion in 2002, and are expected to triple to roughly $24 billion in 2003* Environment. • Importance of Identity Management crosses Timo Skyttä industries and sections: • It is required in any B2C, B2B or B2E transaction whether Nokia Mobile Software the entities are private businesses or governmental Strategic Architecture organizations 1 * Aberdeen research 2 Federated Identity & Identity What is the Liberty Alliance ? Management • Federation reflects how relationships are kept in • A business alliance, formed in Sept 2001 with the the real-world goal of establishing an open standard for federated identity management • Not all identity information is held in one place • Global membership consists of consumer-facing • No centralized single point of failure companies and technology vendors as well as policy and government organizations • Opportunity for any trusted business to become a trusted identity provider • The only open organization working to address the • More than single sign-on technology and business issues of federated identity management • It’s how personal information is authenticated, shared and managed 3 4 1 Some current challenges for Mobile Industry Nokia architecture - Identity Manager as the outermost (related to Identity Management) Personal Security & Privacy tool towards services Tightening privacy legislation in EU – use of MSISDN (phone number) as an identifier automatically attached to outgoing HTPP-requests Service User Interface Identity Manager User becomes questionable (browsing/messaging/Java Interface app’s) (invoked if needed) Number portability makes it difficult to associate a phone number to a Secure user certain provider of services – needs to invent a new reference authentication mechanism Services without All other services Identity Manager Many of the mechanisms used in Fixed internet, based on HTTP any need to invoke Identity redirect, cause too many round trips and delays in mobile environment know anything Manager at login, User Profile about the user, when using a form, Consumer awareness and concern over generic privacy and misuse i.e. NO login, Secure use of personal information is growing, need for a “trusted” environment installing/using an Authentication & storage NO on-line forms, ID mechanism or Authorizations A mass market phone doesn’t have full keyboard, and is not likel y to NO hidden ID when initiating a have one in the foreseeable future -> data entry difficulties -> service mechanisms transaction Privacy & Identity adoption problems NOR transactions User’s want personalized services to get quicker access to the content they want, mobile phone screen is small, can present only a limited amount of information – personalization is key, do not compromise Services user’s privacy unnecessarily when doing this To solve Identity Management, including personalized service access, do not create a mobile specific, but a mobile aware solution. This drives adoption both in Mobile and Fixed internet Make the life of user and service provider easy, but trusted and secure 5 6 Before Liberty Use Case After Liberty Use Case Timo has chosen to link his Timo must log-in to portal with three favorite sites an ID and password When Timo logs into the portal, After selecting a TV site he must the mobile operator log-in again automatically authenticates him Log-in’s like above can require 80+ Timo clicks on the TV and is clicks and more than 30 seconds of automatically signed-on time on a typical mobile phone Timo goes to his bookmarks keypad and instantly logs-on to his email Users often give up in frustration, limiting use of mobile data services 7 8 2 Thank You Additional material Questions ? 9 10 Liberty Alliance Vision Defining Liberty Mission: To serve as the premier open Alliance for federated Liberty Alliance IS… Liberty Alliance IS NOT network identity management & services by ensuring IS a member community IS NOT a consumer-facing interoperability, supporting privacy and promoting delivering technical product or service adoption of its specifications, guidelines and best specifications, business and IS NOT developed and practices. privacy best practices supported by one company IS providing a venue for testing IS NOT based on a interoperability and identifying Goals: centralized model business requirements – Provide open standard and business guidelines for federated identity management spanning all network devices IS developing an open, – Provide open and secure standard for SSO with federated identity standard that decentralized authentication and open authorization can be built into other – Allow consumers/businesses to maintain personal companies’ branded products information more securely, and on their terms and services IS driving convergence of open standards 11 12 3 How does Liberty work ? Management Board • 16 founding sponsors • Responsible for overall governance, legal, finances, and operations • Final voting authority for specifications The Business Case Business Technology Services Public Policy Conformance Marketing Expert Expert Expert Group Expert Group Expert Group Group Group The Role of Federated Identity in Web Requirements • Privacy, security, Technical Service Technical req. and use cases and global public architecture marketing Licensing req. Services Responsible for policy issues & requirements Monitor Logo evangelism and • Technical Liaison to privacy specifications usage public relations groups and specifications Manage Business government Defines service Conformance templates and agencies guidelines interoperability testing program • Privacy guidelines & conformance for Core Accelerates and best practices programs specifications market creation for publication All members provide feedback on early drafts 13 14 The Problem Today • Companies need solutions – How to leverage new trends to generate revenue – How to lower lower costs – And still address customer worries about privacy & security “Federated Identity Management is a strategic capability that will solve real business problems” • Companies are spending billions of dollars on Web Service projects (figures vary by analyst) Burton Group, July 2003 – Very few enterprises have completed projects • Current barriers to wide-scale adoption – Lack of technical standards for managing identity – Lack of interoperability between products and services – Lack of a federated model – Lack of privacy and security best practices – Lack of business best practices 15 16 4 Identity problems exploding: Industries Ready for Federated Identity • Wireless – Number Portability Act – enabling customers to retain their mobile phone • No common method to approach identity number when changing carriers – Emerging privacy legislation makes use of phone number as an identifier • Fragmentation of customers identities across towards services quite difficult – Limited data entry capabilities (small screens, small keypads) different many different sources – Users want immediate access to personalized services • Growing privacy / regulatory pressures – Exploitation of data services and m-commerce • Finance • Increasing potential and risk of identity theft - State and national legislation driving need to protect privacy and identity - Increasing opportunity to drive new partnerships and initiatives dependent upon • Convergence of internet and mobile world identity initiatives • Desire to provide higher value-add services to • Healthcare – HIPAA legislation – organizations are responsible for ensuring identifiable customers information is protected while stored or in transit • Government – Increasing incentives for e-filing and online tax returns – Bush administration’s eAuthentication mandate (led by GSA) 17 18 Recent Accomplishments January 2002 – Liberty begins specification development July 2002 – Liberty releases Phase 1 specifications Liberty Progress & Momentum April 2003 – Liberty releases Phase 2 specification drafts; demonstrates interoperability among 20 products; donates Phase 1 specifications to OASIS (SAML) June 2003 – Liberty releases first business guidelines; releases Phase 1 Japanese specifications 19 20 5 Increasingly Diverse Involvement Liberty Alliance Members More than 150 member organizations globally • Growth in government, non-profit and education Driven by end-users, government orgs and vendors sector involvement Led by Technology, Business and Public Policy Expert Groups – GSA, DoD, Canada Post, Hong Kong Post, Royal Mail, TRUSTe, Universitat-Hamburg, U. of Chicago, ISTPA • Close relationships with other standards groups – OMA, OASIS, The Open Group, Internet2 • Increasing global involvement – 25% of members are headquartered in Europe/APAC 21 22 Liberty-enabled products & services Sample Download Statistics Communicator (available) NTT (TBD) SourceID enables Liberty federation and SSO and is a good Computer Associates (Q4*) NTT Software (available) indicator of Liberty interest. Download statistics below* DataKey (available) Oblix (2004) – More than 1,000 downloads in 100 days DigiGan (Q3*) PeopleSoft (available) – Majority of downloads are by global 1000