A DESCRIPTION OF CONCEPTS AND PLANS MAY 14, 2014 A. HUGHES FOR TFTM The Identity Ecosystem DISCUSSION DRAFT 1

DRIVERS, CORE STRUCTURE, REQUIREMENTS Ecosystem From The Inside DISCUSSION DRAFT

A Note on Role Names Role names are used to keep the entities and their functions separate Any entity or organization could play one or more Role in the ID Ecosystem  Online Services Supplier  The Relying Party, Service Provider  Online Services Client  The consumer or customer or recipient of the Supplier’s services  Online Trust Provider  All roles associated with establishing facts, provisioning credentials/tokens, verifying conformance, testing, audit  Common names IdP, TM, CM, CSP, TFP, CA, RA DISCUSSION DRAFT 3

The Online Interaction The goal of NSTIC is to improve the state of online interactions The interaction or transaction between online service supplier and their client is the primary source of requirements for security, privacy and ease of use Describing a coherent ID Ecosystem is possible by extending the ‘Interaction-centric’ concept DISCUSSION DRAFT 4

The Central Pattern Central tenet: Supplier and Client engage in an online interaction only if certain Conditions are presented, potentially negotiated and fulfilled. (Arrows should probably be bi-directional) DISCUSSION DRAFT 5

The Central Pattern: ‘Conditions’ ‘Conditions’ might be:  Provide the username and password associated with your account  Provide payment information  Produce a validated electronic authentication token issued by a trusted Credential Service Provider  Accept these Terms of Service  Possess these Trustmarks DISCUSSION DRAFT 6

The Central Pattern: Suppliers The Online Service Supplier wishes to control access to the service and provide the right service to the correct Client ‘Conditions’ are used to gather the information needed to make the service access decision DISCUSSION DRAFT 7

The Central Pattern: ID Risk The Online Service Supplier must guard against misidentification, fraud, impersonation, inability to distinguish one client from another The stringency and number of Conditions increase with greater transaction risks DISCUSSION DRAFT 8

The Central Pattern: Requirements The Interaction, Conditions and Fulfillment drive all requirements  System, transaction, technical, policy, interoperability, trust, assurance, operations, data formats, security, privacy, user experience DISCUSSION DRAFT 9

Trust Infrastructure: Trust Providers Online Trust Provider box  Intended to represent any security, trust or privacy service available to the Supplier-Client  Entirely determined by the Transaction requirements  Might be standard & shared  Might be custom & secret  Might deliver high certainty or low certainty  Might be reliable or not DISCUSSION DRAFT 10

‘Trust’ Infrastructure The Trust Infrastructure is secondary to the transactions and exists to support the supplier- client interaction  Credentials, tokens, certificates, secrets  Identity information, relationship/membership  Federations, Trust Frameworks, Assurance Frameworks DISCUSSION DRAFT 11

Trust Infrastructure: Community NSTIC ‘Online Community’  NSTIC defines ‘online communities’ which have shared risks, a stable set of transactions, common rules, common trust requirements Community Governance  Indicates the operator and manager of the community rules, their implementation and enforcement  Sometimes named the Federation Operator or Trust Framework Provider DISCUSSION DRAFT 12

Rationale for Transaction-Centric Why focus on the transaction instead of the normal focus on Trust Infrastructure?  Clarifies the value of the ID Ecosystem  The Transaction drives all requirements, not the Trust Providers  Each element can be broken down and mapped to real and future implementations DISCUSSION DRAFT 13

The ID Ecosystem Online communities using this pattern are candidate participants in the NSTIC-envisioned ID Ecosystem NSTIC requires certain things of the Community Rules and other community features DISCUSSION DRAFT 14

Compare to the NSTIC Definition A Trust Framework  Is developed by a community  Defines the rights and responsibilities of that community’s participants  Specifies the policies and standards specific to the community  Defines the community-specific processes and procedures that provide assurance  Considers the level of risk associated with the transaction types of its participants - NSTIC Strategy Document DISCUSSION DRAFT 15

THE ID ECOSYSTEM FROM ABOVE Ecosystem From 30k DISCUSSION DRAFT

The Central Concern DISCUSSION DRAFT 17 The Interaction is central  Trust Providers exist to express and satisfy ‘conditions’  All activity must fall within the rules of the Community

Many Transactions in a Community DISCUSSION DRAFT 18 Within the Community context many transaction types are possible The picture shows a single trust infrastructure supporting all community transaction types All activity must fall within the rules of the Community

Many Trust Providers in Community DISCUSSION DRAFT 19 The picture shows two trust infrastructures within the same community The trust infrastructures are federated All activity must fall within the rules of the Community

ID Ecosystem Perspective A Many ‘communities’ exist today  Some are verified by 3rd party assessors  Some are closed/walled gardens  Some are Enterprise-Enterprise federations  Some involve Trust Framework Providers and Trust Frameworks  Some are multi-party federations Some happen to follow the NSTIC Guiding Principles Next slide is a sketch of this state DISCUSSION DRAFT 20

ID Ecosystem Perspective A DISCUSSION DRAFT 21

ID Ecosystem Perspective A One perspective of the path forward is to increase the number and type of Ecosystem Communities that follow the NSTIC Guiding Principles  And, as a consequence, end-users will begin to experience NSTIC-oriented services This might be characterized as the path to building a Compliance/Conformance Program DISCUSSION DRAFT 22

ID Ecosystem Perspective A DISCUSSION DRAFT 23

ID Ecosystem Perspective B One perspective of the path forward is to build on the GTRI Trustmark ideas  Define Trust Interoperability Profiles (TIP) for participating Stakeholder Communities  Establishing Trustmark Defining Organizations (TDO)  Trustmark Definitions and Trustmarks: statement of conformance to identity trust/interoperability requirements plus its formal assessment process DISCUSSION DRAFT 24

The GTRI Trustmark Concept Map DISCUSSION DRAFT 25

ID Ecosystem Perspective B DISCUSSION DRAFT 26

ID Ecosystem Perspective C Suggestions for other alternative views are welcome DISCUSSION DRAFT 27