I am really wondering if, beyond the hype, federated identity management is actually happening – from the end-user/consumer side?
No doubt that federation and SSO solutions are more and more adopted by organisations – primarily driven by the need to cut costs.
But what about the adoption of federated identity management by web service providers, for services accessed by end-users/consumers?
I just read this article, written in 2008, called “Facing the pain of passwords”? Has anything improved? I do not think so …
My personal experience is that more and more accounts (and passwords) need to be created to access ***valuable services*** on the web (from web browsers and/or mobile applications).
Interestingly, this is contrast with the concept of “Personal Cloud” – as, for example, described in this article …
Is there any up-to-date statistic describing the adoption rate of federation for this kind of services? What is the actual impact of federation to easy the pain?
--- Posted by Marco Casassa Mont (here and here) ---
--- NOTE: use this mirror blog if you prefer posting on an external blog site ---
--- NOTE: my original HP blog can be found here ---
Showing posts with label federated identity management. Show all posts
Showing posts with label federated identity management. Show all posts
Sunday, June 20, 2010
Monday, April 7, 2008
HPL Technical Report: On Automatic Compliance of Privacy Policies in Federated Identity Management …
An HPL Technical report has been recently published on the topic of “Automatic Compliance of Privacy Policies in Federated Identity Management”:
“Privacy in the digital world is an important problem which is becoming even more pressing as new collaborative applications are developed. The lack of privacy preserving mechanisms is particularly problematic in federated identity management contexts. In such a context, users can seamlessly interact with a variety of federated web services, through the use of single-sign-on mechanisms and the capability of sharing personal data among these web services. Because of the latter feature, user's privacy is at a stake, if the sharing of such data among federated service providers is not properly controlled to ensure that privacy is preserved and user's privacy preferences are complied with. Current federated identity managed solutions adopt simplistic approaches to privacy management, based on contractual/legal approaches and/or limited simple checks on users' privacy preferences. We argue that more comprehensive privacy policies (consisting of access control and obligation constraints, along with privacy preferences) should be stated by federated service providers and proactively checked by these providers, before disclosing users' data to federated partners. To address such requirements, we introduce mechanisms and algorithms for policy compliance checking between federated service providers, based on an innovative policy subsumption approach. We formally introduce and analyze our approach. We also show how our approach is suitable for deployment and application in existing federated identity management solutions, such as Liberty Alliance, WS-* and Shibboleth.”
Authors: Anna Squicciarini (The Pennsylvania State University), Marco Casassa Mont, Abhilasha Bhargav-Spantzel (Purdue University), Elisa Bertino (Purdue University).
A short paper derived from this technical report has been accepted at IEEE Policy 2008.
--- NOTE: my original HP blog can be found here ---
“Privacy in the digital world is an important problem which is becoming even more pressing as new collaborative applications are developed. The lack of privacy preserving mechanisms is particularly problematic in federated identity management contexts. In such a context, users can seamlessly interact with a variety of federated web services, through the use of single-sign-on mechanisms and the capability of sharing personal data among these web services. Because of the latter feature, user's privacy is at a stake, if the sharing of such data among federated service providers is not properly controlled to ensure that privacy is preserved and user's privacy preferences are complied with. Current federated identity managed solutions adopt simplistic approaches to privacy management, based on contractual/legal approaches and/or limited simple checks on users' privacy preferences. We argue that more comprehensive privacy policies (consisting of access control and obligation constraints, along with privacy preferences) should be stated by federated service providers and proactively checked by these providers, before disclosing users' data to federated partners. To address such requirements, we introduce mechanisms and algorithms for policy compliance checking between federated service providers, based on an innovative policy subsumption approach. We formally introduce and analyze our approach. We also show how our approach is suitable for deployment and application in existing federated identity management solutions, such as Liberty Alliance, WS-* and Shibboleth.”
Authors: Anna Squicciarini (The Pennsylvania State University), Marco Casassa Mont, Abhilasha Bhargav-Spantzel (Purdue University), Elisa Bertino (Purdue University).
A short paper derived from this technical report has been accepted at IEEE Policy 2008.
--- NOTE: my original HP blog can be found here ---
Tuesday, April 1, 2008
New HPL Technical Report: “Assurance for Federated Identity Management”
A new HP Labs technical report (called “Assurance for Federated Identity Management” - revisiting and extending a previous one, on the same topic), has been published:
"Federated Identity Management is an emerging paradigm that is rightly getting a lot of standardization and research attention. One aspect that is not receiving enough attention is assurance. Given the challenges enterprises faced trying to demonstrate appropriate control of their internal and monolithic identity management systems, the problem of how to provide assurance to multiple stakeholders that controls, operations and technologies that cut across organisational boundaries, are appropriately mitigating risk, looks daunting. The paper provides an exposition of the assurance process, how it applies to identity management and particularly to federated identity management. Our contribution is to show technology can be used to overcome many of trust, transparency and information reconciliation problems. Specifically we show how declarative assurance models can orchestrate and automate much of the assurance work, how certain enforcement technologies can radically improve identity assurance, and how an assurance framework can provide a basis for judging the assurance value of security technologies."
HPL Authors: Baldwin, Adrian; Casassa Mont, Marco; Beres, Yolanda; Shiu, Simon
--- NOTE: my original HP blog can be found here ---
"Federated Identity Management is an emerging paradigm that is rightly getting a lot of standardization and research attention. One aspect that is not receiving enough attention is assurance. Given the challenges enterprises faced trying to demonstrate appropriate control of their internal and monolithic identity management systems, the problem of how to provide assurance to multiple stakeholders that controls, operations and technologies that cut across organisational boundaries, are appropriately mitigating risk, looks daunting. The paper provides an exposition of the assurance process, how it applies to identity management and particularly to federated identity management. Our contribution is to show technology can be used to overcome many of trust, transparency and information reconciliation problems. Specifically we show how declarative assurance models can orchestrate and automate much of the assurance work, how certain enforcement technologies can radically improve identity assurance, and how an assurance framework can provide a basis for judging the assurance value of security technologies."
HPL Authors: Baldwin, Adrian; Casassa Mont, Marco; Beres, Yolanda; Shiu, Simon
--- NOTE: my original HP blog can be found here ---
Sunday, February 3, 2008
Are Legal Obstacles Delaying Federated Identity Management?
This is a key point made in Thomas J. Smedinghoff’s article, titled “Legal Obstacles Delaying Federated Identity Management”:
“Without some type of a legal framework to address these issues, however, a federated identity model will likely not scale. At least in the case of economically significant transactions, the risks to each of the parties of such unresolved issues are simply too great to justify reliance on the federated process. These questions, and others like them, are the legal land mines that stand in the way of a viable federated identity management infrastructure.”
The issues mentioned above are about: Identification Process, Personal Information, Scope of Assertion, Use of Assertion and Liability.
I agree that having a proper legal framework in place can help. I would argue, though, that proper “identity assurance” must also be put in place in the context of federated identity management, as discussed in a HPL Technical Report.
--- NOTE: my original HP blog can be found here ---
“Without some type of a legal framework to address these issues, however, a federated identity model will likely not scale. At least in the case of economically significant transactions, the risks to each of the parties of such unresolved issues are simply too great to justify reliance on the federated process. These questions, and others like them, are the legal land mines that stand in the way of a viable federated identity management infrastructure.”
The issues mentioned above are about: Identification Process, Personal Information, Scope of Assertion, Use of Assertion and Liability.
I agree that having a proper legal framework in place can help. I would argue, though, that proper “identity assurance” must also be put in place in the context of federated identity management, as discussed in a HPL Technical Report.
--- NOTE: my original HP blog can be found here ---
Friday, January 18, 2008
Liberty Alliance “Identity Assurance Special Interest Group (IASIG)”
The kick-off meeting of the Liberty Alliance “Identity Assurance Special Interest Group (IASIG)” is going to happen on January, 30th 2008 to discuss the Identity Assurance Framework and the proliferation of standard Levels of Assurance in digital commerce:
“The IASIG was formed alongside the Identity Assurance Expert Group (IAEG), as a public Special Interest Group (SIG) within the Liberty Alliance to continue and extend the Trust Framework of the EAP (Electronic Authentication Partnership), the Credential Assessment Framework of the US E-Authentication Initiative, and other industry contributions, into a harmonized, best-of-breed industry standard operational framework for managing trusted credentials across identity federations to foster inter-federation on a global scale.”
More details about this event can be found here.
--- NOTE: my original HP blog can be found here ---
“The IASIG was formed alongside the Identity Assurance Expert Group (IAEG), as a public Special Interest Group (SIG) within the Liberty Alliance to continue and extend the Trust Framework of the EAP (Electronic Authentication Partnership), the Credential Assessment Framework of the US E-Authentication Initiative, and other industry contributions, into a harmonized, best-of-breed industry standard operational framework for managing trusted credentials across identity federations to foster inter-federation on a global scale.”
More details about this event can be found here.
--- NOTE: my original HP blog can be found here ---
Thursday, November 1, 2007
The Basics of Identity Management?
An interesting article has been recently written by John Dunn, Techworld, called “The Basics of Identity Management”.
This article actually focuses on “Federated Identity Management (FIM)”. It analyses aspects of FIM and provides the author’s view about what FIM can offer to IT planners. A key point is made by the author:
“To succeed, FIM has to undo half a century of IT, based on the idea that IT is constructed around the logical arrangement and securing of systems into which users are placed. FIM, by contrast, has the potential to be radically user-centric, making users the centrepiece of an IT system, around which systems are built as digital supports. A systems mentality looks on users as existing on a hierarchy of privilege, with higher rungs gaining more authorisation and power, but within defined geographical and logical limits. A FIM way of looking at users is to see these systems from their point of view. That information, or the ability to transact, resides on the network of another company matters not if that it essential to the business objective. It should be accessible.
For the time-being, FIM will most likely be restricted to specific projects – getting two partners working together - with defined goals and timescales. Longer term, it has the potential to transform even the humblest IT operation into something quite new. But as a concept, federation surely represents the future of networks, so that they become not as islands of digital power, but overlapping ‘networks of networks’. It is happening already. But it will force companies to re-examine their own security processes before they jump into its whirlpool of potential difficulties.”
--- NOTE: my original HP blog can be found here ---
This article actually focuses on “Federated Identity Management (FIM)”. It analyses aspects of FIM and provides the author’s view about what FIM can offer to IT planners. A key point is made by the author:
“To succeed, FIM has to undo half a century of IT, based on the idea that IT is constructed around the logical arrangement and securing of systems into which users are placed. FIM, by contrast, has the potential to be radically user-centric, making users the centrepiece of an IT system, around which systems are built as digital supports. A systems mentality looks on users as existing on a hierarchy of privilege, with higher rungs gaining more authorisation and power, but within defined geographical and logical limits. A FIM way of looking at users is to see these systems from their point of view. That information, or the ability to transact, resides on the network of another company matters not if that it essential to the business objective. It should be accessible.
For the time-being, FIM will most likely be restricted to specific projects – getting two partners working together - with defined goals and timescales. Longer term, it has the potential to transform even the humblest IT operation into something quite new. But as a concept, federation surely represents the future of networks, so that they become not as islands of digital power, but overlapping ‘networks of networks’. It is happening already. But it will force companies to re-examine their own security processes before they jump into its whirlpool of potential difficulties.”
--- NOTE: my original HP blog can be found here ---
Saturday, September 22, 2007
Webcast (11 Oct 2007) - Federated Identity Management, Web Services and Health Information Exchange …
You might be interested in attending this online webcast by Ignacio Alamillo of CATCert (topic: “Federated Identity Management, Web Services, and Health Information Exchange: Technology, Policy, Case Study and Best Practices”) on October, 11 2007:
“The adoption of health information technology (HIT) with the development of decentralized, interoperable health information networks, is widely regarded as critical to enhancing the performance of our health care systems locally and globally. Health information exchange involving disparate networks enabling access to personal and public health information regardless of source or format will require scalable, affordable authentication and authorization individuals accessing these systems. Federated identity management provides real world solutions for real world identity management problems. This discussion will explore and describe the technology needed and policy considerations through the lens of a Case Study (Catalonia ePrescribing project) that delivers best practices guidance.”
Webcast registration information is available here.
--- NOTE: my original HP blog can be found here ---
“The adoption of health information technology (HIT) with the development of decentralized, interoperable health information networks, is widely regarded as critical to enhancing the performance of our health care systems locally and globally. Health information exchange involving disparate networks enabling access to personal and public health information regardless of source or format will require scalable, affordable authentication and authorization individuals accessing these systems. Federated identity management provides real world solutions for real world identity management problems. This discussion will explore and describe the technology needed and policy considerations through the lens of a Case Study (Catalonia ePrescribing project) that delivers best practices guidance.”
Webcast registration information is available here.
--- NOTE: my original HP blog can be found here ---
Wednesday, September 12, 2007
To Be or Not To Be an Identity Provider?
Yesterday, in a post of mine called “What is the Business Case for Identity Providers?”, I was wondering what would be the incentive for an organization to be an “Identity Provider”(IdP) and, in particular one that just plays this role i.e. with no additional stake in providing other services
Of course there is no constraint for being both an IdP and also a Service Provider (SP). Actually this is the most likely case to happen – in my view. I would not be surprised if Federated Identity Management will consolidate and happen for cases based on a dominant organization/service provider and other subordinated service providers, where the dominant organization plays both the IdP and SP roles and use federation to simplify the life of its customers, in a well controlled environment. This is already happening in telecom and outsourcing contexts …
In theory, being just an IdP would be the ideal case, with a clear “separation of duty” between who manage identities (on behalf of users) and who “consumes” them. But, in practice, does this make any sense? Here are some initial thoughts:
Of course there is no constraint for being both an IdP and also a Service Provider (SP). Actually this is the most likely case to happen – in my view. I would not be surprised if Federated Identity Management will consolidate and happen for cases based on a dominant organization/service provider and other subordinated service providers, where the dominant organization plays both the IdP and SP roles and use federation to simplify the life of its customers, in a well controlled environment. This is already happening in telecom and outsourcing contexts …
In theory, being just an IdP would be the ideal case, with a clear “separation of duty” between who manage identities (on behalf of users) and who “consumes” them. But, in practice, does this make any sense? Here are some initial thoughts:
- Would the Identity Provider have to charge users to store their personal data and enable their SSO across various Service Providers? Not sure if users are really willing to pay for this kind of service …
- Would the Identity Provider have to charge Service Providers, let’s say on transactional basis? But would Service Providers (1) be willing to give up the control that currently have on personal data and (2) have also to pay for it?
- Would the Identity Provider make a living based on advertisement? Maybe, but then the temptation to use stored personal data for providing better, customised advertising to users or for potentially other purposes would be too strong. Would users be happy about this?
- Would the Identity Provider be the user itself? If so, what would be the practical implications?
I think this is an important aspect to understand - independently from various approaches, standards and technologies that are emerging (and competing) in this space – in particular for its implications on trust, privacy and assurance matters.
--- NOTE: my original HP blog can be found here ---
Tuesday, September 11, 2007
What is the Business Case for Identity Providers?
I’ve recently been asked by a customer what would be the business case for Identity Providers, in the context of federated identity management …
This question specifically referred to Identity Providers that just play this role i.e. have no additional stake in providing other services (e.g. being also Service Providers) and, by doing this, ensure real “separation of duty” between who handle identities & authentication (them) and relying parties that “consume” this information.
Any link to available material (so far, I haven’t found anything particularly relevant)? Any thought?
--- NOTE: my original HP blog can be found here ---
This question specifically referred to Identity Providers that just play this role i.e. have no additional stake in providing other services (e.g. being also Service Providers) and, by doing this, ensure real “separation of duty” between who handle identities & authentication (them) and relying parties that “consume” this information.
Any link to available material (so far, I haven’t found anything particularly relevant)? Any thought?
--- NOTE: my original HP blog can be found here ---
Monday, September 10, 2007
Liberty Alliance - a New Identity Assurance Initiative
On Sunday, 9th September, Liberty Alliance has announced the creation of a new Identity Assurance initiative:
“Liberty Alliance, the global identity consortium working to build a more trusted Internet for consumers, governments and businesses worldwide, today announced it has formed a new expert group to deliver the Liberty Trust Framework, an organizational framework designed to fill industry requirements for standardized identity assurance criteria for use in a broad range of federation scenarios. Liberty’s Identity Assurance Expert Group (IAEG) was established by the recent merge of the Electronic Authentication Partnership (EAP) into Liberty Alliance, and consists of representatives from the worldwide financial services, government, healthcare and service provider sectors working collaboratively to release the Liberty Trust Framework for public review and input later this year. The Liberty Trust Framework will remove a major barrier to global inter-federation deployments: the complexity of assessing the level of identity assurance among all organizations participating in federated relationships. Currently, different federations have varying policies and processes governing identity operations, the interpretation of which adds to the cost and complexity of deploying assured identity services. …”
Hopefully this initiative will help to define comprehensive requirements and criteria for “Identity Assurance” in Federated Identity Management contexts.
A few colleagues of mine and I recently wrote an HP Labs Technical report on a related topic, called “On Identity Assurance in the Presence of Federated Identity Management Systems”.
In our view Identity Assurance must be concerned with the proper management of risks associated with identity management. In an enterprise context, “processes” define how identity information has to be managed; identity management technologies ease the burden of dealing with them, by automating some of the related operational aspects. However, it is of paramount importance to ensure that these processes are well controlled and therefore risk is controlled – hence the need for identity assurance. Prior to defining an identity assurance framework, a risk analysis needs to be carried out identifying the identity assets (e.g. user accounts, user profiles, user rights, etc.) and the impact if there is a loss of confidentiality, availability or integrity along with threats that could lead to such losses. From an understanding of risks an enterprise can make decisions about the control objectives (strategies for mitigating risks) they need and ultimately design the controls that need to operate to achieve these objectives. Typically controls will be additional stages in management processes designed to mitigate risks (e.g. an approval step) although they may be technological mechanisms.
The interesting challenge is how to enable Identity Assurance in a federated identity management context, where multiple organisations need to collaborate and share information to achieve this. In our paper we suggested a potential approach to move forward …
--- NOTE: my original HP blog can be found here ---
“Liberty Alliance, the global identity consortium working to build a more trusted Internet for consumers, governments and businesses worldwide, today announced it has formed a new expert group to deliver the Liberty Trust Framework, an organizational framework designed to fill industry requirements for standardized identity assurance criteria for use in a broad range of federation scenarios. Liberty’s Identity Assurance Expert Group (IAEG) was established by the recent merge of the Electronic Authentication Partnership (EAP) into Liberty Alliance, and consists of representatives from the worldwide financial services, government, healthcare and service provider sectors working collaboratively to release the Liberty Trust Framework for public review and input later this year. The Liberty Trust Framework will remove a major barrier to global inter-federation deployments: the complexity of assessing the level of identity assurance among all organizations participating in federated relationships. Currently, different federations have varying policies and processes governing identity operations, the interpretation of which adds to the cost and complexity of deploying assured identity services. …”
Hopefully this initiative will help to define comprehensive requirements and criteria for “Identity Assurance” in Federated Identity Management contexts.
A few colleagues of mine and I recently wrote an HP Labs Technical report on a related topic, called “On Identity Assurance in the Presence of Federated Identity Management Systems”.
In our view Identity Assurance must be concerned with the proper management of risks associated with identity management. In an enterprise context, “processes” define how identity information has to be managed; identity management technologies ease the burden of dealing with them, by automating some of the related operational aspects. However, it is of paramount importance to ensure that these processes are well controlled and therefore risk is controlled – hence the need for identity assurance. Prior to defining an identity assurance framework, a risk analysis needs to be carried out identifying the identity assets (e.g. user accounts, user profiles, user rights, etc.) and the impact if there is a loss of confidentiality, availability or integrity along with threats that could lead to such losses. From an understanding of risks an enterprise can make decisions about the control objectives (strategies for mitigating risks) they need and ultimately design the controls that need to operate to achieve these objectives. Typically controls will be additional stages in management processes designed to mitigate risks (e.g. an approval step) although they may be technological mechanisms.
The interesting challenge is how to enable Identity Assurance in a federated identity management context, where multiple organisations need to collaborate and share information to achieve this. In our paper we suggested a potential approach to move forward …
--- NOTE: my original HP blog can be found here ---
Liberty Alliance Advanced Client Specs - Draft Release 2 (Identity Capable Platforms, Provisioning Services, …)
As already stated by Conor Cahill, in a recent post, the Draft Release 2 of the Liberty Alliance Advance Client Specs is available online, here.
In February 2007, Intel, BT and HP successfully built a first proof-of-concept (PoCv1) based on the Draft Release 1 and demonstrated the feasibility of these specs (in terms of Identity Capable Platforms and related Provisioning Services) during a related Liberty Alliance Workshop at RSA 2007.
--- NOTE: my original HP blog can be found here ---
In February 2007, Intel, BT and HP successfully built a first proof-of-concept (PoCv1) based on the Draft Release 1 and demonstrated the feasibility of these specs (in terms of Identity Capable Platforms and related Provisioning Services) during a related Liberty Alliance Workshop at RSA 2007.
--- NOTE: my original HP blog can be found here ---
Subscribe to:
Posts (Atom)