www.oasis-open.org Building "One Size Fits All" Identity Systems Possible or Fantasy? Ronny Bjones Security Architect Microsoft Corporate

Is it realistic? Different requirements between businesses, consumers, governments, corporate users, etc Different risk profiles implying different measures to prove (mutual) identities Different cultural sensitivities when it comes to identities (e.g. eID) Yet another IDA system to which we have to adapt our applications! And what about all these different platforms?

Haven't we heard this before? Passwords Ease of use(?) Silos, Security, Management Microsoft Passport SSO experience Non Federated, Still passwords, Silo, Privacy PKI Federated (but with hierarchy issues) Privacy, Complex + - + - + -

A new approach should… be based on a federated model providing an SSO experience have privacy protection build into the heart of the system increase the overall security on the Internet, scalable according to risk model be very easy to use by businesses and consumers easily be integrated into services and applications

Identity Providers Relying Parties Identity Metasystem User D.O.L. Bank Gov. Employer Relying Parties Members Only Pet Site Store Sites Other Sites Club Site User Medical Card Store Card Insurance Card Employee Bank Card DOL Card Personal E-mail Card JunkCard Identity Selector Token Name Account Status WS* WEB*

Strong Identity and Access is Complicated For developers For users

What is Windows CardSpace? Identity Selector for Windows Digital identities represented by cards When user selects a card Get security token from Identity Provider Give it to the Relying Party after user consent User is in control Security Token Service User Experience

Wallet Metaphor A set of claims someone makes about me Claims are packaged as security tokens Many identities for many uses

Framework for Interoperability TCP/IP of Identities Defined on open standards – WS* Extended by CardSpace’s definition of CLAIMS http://download.microsoft.com/download/2/7/c/27c16ebb-bf83-4abd-8002-21fa111ba7ac/infocard-profile-v1-techref.pdf CardSpace is security token agnostic SAML, Kerberos, X.509, custom Identity Providers can bridge different identity technologies Multiprotocol Federation Interoperability Demonstration Burton Group – Gerry Gebel - November 1th 2005

Resources http://www.identityblog.com/ Laws of Identity Identity Metasytem Zermatt https://connect.microsoft.com/Downloads/DownloadDetails.aspx?SiteID=642&DownloadID=12937 Netfx3 http://cardspace.netfx3.com

Conclusions Identity layer on the Internet should: Incorporate privacy, security, usability by design Interoperability, interoperability, interoperability, … Make live easy for developers and not raise the bar