NextGen Access Control Platform Programme 14 Interoperability presented by Anthony Wilson, Product Manager – Identity & Access Services

Connected Services Applications Connected Devices Digital Identity Interoperability Platform Next Generation Health Identity Platform PKI Authentication Authorisation Federation Registration Management User Self Service Role Management Digital Signing Digital Identity is not just about security it is a mechanism by which to link Devices, Services and their capabilities to individuals (e.g. Location of an individual via a mobile device) and utilise this relationship and the capabilities of the device seamlessly in applications and cloud services. Also preferences, sites visited, contact mechanisms, and when combined with IOT – biological information (heart rate, blood sugar levels etc.) It allows continuous profiling but also provides control to the user by requesting consent (This is built into the security). Analytics Attribute Exchange IOT Consent Dashboard

Based on Standards As part of the ethos of interop we look to provide capabilities for the 2020 Domains with associated industry standards OpenID Connect used and progressed by Microsoft & Google

NHS Identity Logical Services 3 New national services will be built: National Care Worker IDP – Will provide logon services at various levels depending on the organisation scenarios requirements. Initially Smartcard, OTP and Push Notification on service go live followed by FIDO based biometric support. Platform agnostic (e.g. ChromeOS) National Access Gateway – Will protect national API’s and services referencing a granular rules and policies set National Federation Service – Will allow the national signon to be used to access 3rd party national services such as NHSMail, O365 and ESR.

Authentication Alternatives Framework? Phone Phones RFID Card Band 2 Wearable USB Phone Built in Capability Phone Biometric Peripheral Access to PC’s can be accomplished either through a 2nd device or by inbuilt hardware capabilities as long as standards are followed the decision can be local.

What’s Secure Enough? Aligned to Cabinet Office - GPG44 + GPG45 Also taken NIST 800-63 into account NEEDS Ratifying!

Quick Demo

Developer Adoption Benefits ‘Boilerplate’ client code Abstract ‘loose’ coupling of sign on methods Language Agnostic e.g. Java, C#, Python …… Platform Agnostic e.g. OS and Browser choice Logon ‘As a Service’ from anywhere No need for N3 Access to test No lock-in to the NHS Digital Service (It’s just a URL)

What Does The Service Give Me? Identity Verification – acr + amr Identity Information (Scopes + Claims) Standard OIDC ‘openid’,‘profile’, ‘mail’, ‘roles’ etc supported Spine Scopes also supported: accessreason, spineroles, associatedorgs etc. Session Information & Events - OpenID Connect lets the relying party track whether the end user is logged in at the provider, and also initiate end user logout at the provider.

How To Try It and Adopt it? Go look at the Developer Health Network Request a sandpit environment. We are aiming to get this in place post May initial go live. https://developer.nhs.uk/apis/national-authentication/

Q&A

Current to Medium Term Roadmap

Long Term Roadmap Themes Simplifies Process Increases Security Benefits Saves Time Simplifies Process Increases Security Benefits Long Term Roadmap Themes Increases Security Single trusted digital identity signature Saves time Increases Security Saves Money Benefits Benefits Saves time Simplifies Process Increases Security Benefits IOT Management Single trusted digital identity Saves time Simplify Logon Increases Security Enables Mobility Benefits AI Continual Risk Analytics User & Role Management Remote Signature Simple Registration Next Gen Access Control 2017/2018 The overall programme will seek to evolve the national identity service over the next few years. *Subject to cost benefit analysis and business case acceptance Simplifying and remoting the registration and assurance process Possibly linking a digital signature to the identity – providing a eIDAS level electronic signature to transactions and forms Updating and ReImagine the RBAC & ABAC management AI Analytics to proactively seek out suspicious activity Look at the need for IOT support 2019/2020