Note: this blog is a mirror of my HP Labs Blog, on the same topic, accessible at: http://h30507.www3.hp.com/t5/Research-on-Security-and/bg-p/163

Thursday, October 25, 2007

2012: A Day in the Life of John Webber

How digital-personae, identity management and web 2.0 will impact, influence and reshape people lives and organisations during the next 5 years? What is going to be “hot” in 2012?

Difficult questions … A few colleagues of mine and I tried to explore future scenarios and opportunities in the space of digital identity and identity management. We wrote a story, “2012: A Day in the Life of John Webber”. We would like to share it with this community, to open a debate and exchange opinions. Enjoy it …

--- 2012: A Day in the Life of John Webber ---

“John Webber is a young, ambitious professional. He has a very intense life with interests spanning work, social and political aspects, many friends spread all over the world and a girlfriend. He is accustomed to using new technologies and web 3.0 services: he sees them as a way to simplify his life and enable the broad, rich set of personal and digital interactions that he requires on daily basis in his life.

John works for a multinational enterprise. He uses his mobile appliances (laptop, office PC, smartphone, etc.) in an interchangeable way, to interact with colleagues, send/receive multimedia e-mails and edit reports and critical information for his company. On a daily basis he accesses state-of-the art enterprise services, to collaborate with project colleagues all over the word. This is a simple and gratifying experience thanks to the latest generation, enterprise web 3.0 collaborative, integrated services – where multimedia information is easily collected, stored and indexed for future usage, as well as securely and privately protected, based on the “value” of the content.

John gets access to all these services with his “personae-selector” (virtual) device, installed on his Smartphone. Recognizing John using multiple biometric sensors, the device suggests a persona relevant to the current context or allows John to override the automatic selection. This (virtual) device securely interacts with other of John’s devices and authorised enterprise devices (including that new, secure Printer, and associated Print 3.0 services, recently deployed in John’s office).

John is aware that to be successful in his job, he needs to have constant interactions with other professionals and experts around the world: he wants to exchange opinions and have an early understanding of new trends and exciting initiatives. This is now a recognised need and common practice within modern enterprises.

John runs a few, interactive, multimedia external blogs to expose his views, start discussions and get feedback. He is aware of confidentiality aspects that might rise from his interactions with external people: he uses ad-hoc personae to interact with these services, by exposing a profile and information compatible with his company’s business policies and his privacy preferences. An online, trusted “personal guardian angel” service, accessible via his “personae-selector” (virtual) device, helps him to handle these different personae and to get reminders about the context he is interacting with.

The multinational he works for is aware that people and information are the most valuable assets in these days. On one hand it recognises the need to enable collaborative interactions of its employees with the external world. On the other hand it is aware of potential risks and threads for its own security and businesses.
Thanks to the new generation of “Identity Risk Management and Assessment” services jointly run by the CIO/CPO Offices, enterprise officers periodically scan various sources on the web (including social networks, blogs, etc.) against any improper leak of confidential data or information that could harm enterprise business and employees. This service provides reports on critical issues and confidential and personalised suggestions (on how to mitigate risks) to employees, in case of any problem.

Today, John works from home. It is his girlfriend’s (Alice) birthday. This is special occasion he wants to properly celebrate. By using his home laptop he accesses his preferred “federated service provider community” and in few minutes makes all the required arrangements to celebrate this event: buying Alice’s preferred flowers at “Flowers’R Us”, arranging for an exclusive dinner at the “Genuine Italian Food Restaurant” and buying that jewellery ring that Alice desired so much.
From his laptop John securely links to his “personae-selector” (virtual) device to authenticate and access these various service providers in a transparent way – thanks to their integrated single-sign-on capabilities (via interoperable Liberty Alliance 3.0, OpenId 3.0 and CardSpace 3.0 protocols). In 5 minutes, he buys flowers (to be delivered at the restaurant), arranges for a table at the restaurant and buys the present for Alice. His interactions with these service providers is smooth and simple, as it is mediated by a “joint-collaboration” between his “personae-selector” device and the “personal guardian angel” service, that ensure that a “personae-handover” process happens across various service providers (i.e. different personae are automatically used in different contexts) and the right credentials (including credit card details) and contextual data are exposed based on John’s privacy preferences and interaction policies.

The service providers involved above use the latest, state-of-the-art “Personae-aware” Identity and Privacy Management Services to seamlessly engage in federated contexts and properly handle and process personal information disclosed by John. They ensure his privacy preferences are enforced along with current world-wide (privacy and data protection) legislation. They also use a new generation of “Risk Management and Assessment” services to check their own compliance to business objectives and legislation and automatically report any violation (and start remediation steps). Consistently with this, they offer John a tailored (persona-aware) service experience, in suggesting a customised but not invasive interaction.

It is still early for John to meet with Alice. A good opportunity for John to socialise with his friends spread all over the world and engage in these social networks he likes so much. John connects to a few of them by using appropriate personae (thanks to the help of his “personae-selector” device) and starts posting and chatting.

John is aware that he his using multiple personae and the implications and possible risks that exposing information on the web could have, such as correlation, deductions and misuse of this information to commit crimes. His trusted “personal guardian angel” service helps him to keep track of John’s personae, automatically updating changes and providing additional, useful services. John chooses to have all his interactions on the internet monitored by his trusted “personal guardian angel” service: he configures it to monitor his social network interactions and warn him of any danger, in particular related to disclosure of personal details and information. This has been a wise choice: the interactions with a new guy - Charles, a friend of his friend Bob is strange. His questions and request for work information are going in a direction that could be dangerous. The “personal guardian angel” service warns John of the risks of disclosing some information and the implications this could have for his work and social life. John decides that it is best to drop the call …

Reminded of these potential dangers, John, whilst he is dressing up to go out with Alice, starts a “Personae-Risk Scan” check via his “personal guardian angel” service. This checks for any information directly/indirectly exposed on the web or via his various social network links (Facebook 3.0, MySpace 3.0, LinkedIn 3.0, YouTube 3.0, Second and Third Life 3.0, etc.) and service accounts. It compares retrieved information against perceived threads and risks and provides a meaningful, user friendly report along with suggestion on how to mitigate problems. This time John is lucky: nothing to worry about.

Alice is going to be a little bit late. Why not doing a back-up of John “personae-selector” (virtual) device – as prompted by the device itself? After all it is a “virtual” device: a few seconds and its entire content is securely copied and protected in his new Smartphone along with an image of its personae and preferences.

This was a good move: at the restaurant, perhaps distracted by the good Italian food, a thief steals his current Smartphone with his “personae-selector” (virtual) device. No problem: just the hassle of reporting this (online) to the police. He can carry on celebrating with Alice.

The thief didn’t realise he had no way to access the content and use the device, thanks to its biometric-based protection and encrypted content. It is a “useless tool” to be thrown away at the first opportunity. So he does.
This is good for John: the discarded device is quickly located via GPS and the collaboration with its “personal guardian angel” service. The device is back home the next day.”

--- NOTE: my original HP blog can be found here ---

No comments: