Project Presentation to: The Electronic Access Partnership July 13, 2006 Presented by: Tim Cameron, Meteor Project Manager The

What is the Meteor Project?

3 The Meteor Project The Meteor Software The Meteor Software The Meteor Network The Meteor Network The Meteor Federation The Meteor Federation

The Meteor Software

5 Meteor Software Features Information from multiple data providers is aggregated in real-time to assist the end user with the financial aid process, repayment and default aversion. Information from multiple data providers is aggregated in real-time to assist the end user with the financial aid process, repayment and default aversion. A one-stop, common, online customer service resource A one-stop, common, online customer service resource Meteor is a collaborative effort utilizing leading-edge technology and access is provided at no charge. Meteor is a collaborative effort utilizing leading-edge technology and access is provided at no charge.

6 Types of Data Available FFELP FFELP Alternative/Private Loans Alternative/Private Loans State Grants & Scholarships (Summer 2006) State Grants & Scholarships (Summer 2006) Perkins (In development) Perkins (In development) Direct Loans (Planned) Direct Loans (Planned) Pell Grants (Planned) Pell Grants (Planned)

7 Who Can Access the Meteor Network? Meteor Meteor –Federated Model: Transitive Trust –Multiple points of access User Roles User Roles –School –Student/Borrower –Customer Service Representatives –Lenders

8 Reliability and Security Data is sent directly from the data provider’s system and is not altered in any way within the Meteor software Data is sent directly from the data provider’s system and is not altered in any way within the Meteor software All data is electronically transmitted securely using SSL encryption All data is electronically transmitted securely using SSL encryption Independent audit showed no serious vulnerabilities with the software Independent audit showed no serious vulnerabilities with the software

9 Building Trust and Integrity The Meteor Advisory Team sought input and expertise regarding privacy and security from the sponsoring organizations and the NCHELP Legal Committee. The Meteor Advisory Team sought input and expertise regarding privacy and security from the sponsoring organizations and the NCHELP Legal Committee. Analysis was provided in relation to GLB and individual state privacy laws. Analysis was provided in relation to GLB and individual state privacy laws. The analysis revealed that Meteor complied with GLB, FERPA, and known state privacy provisions. The analysis revealed that Meteor complied with GLB, FERPA, and known state privacy provisions.

The Meteor Network

11 The Meteor Process One Two Access Providers Data Providers Financial Aid Professional or Student/Borrower or Access Provider Representative or Lender Three Index Providers Users

12 Clearinghouse as Meteor Index 100% of FFELP guarantee volume 100% of FFELP guarantee volume Over 5.6 million Direct Loan Program accounts Over 5.6 million Direct Loan Program accounts Over 13.2 million FFELP servicer accounts Over 13.2 million FFELP servicer accounts Over 1.6 million Perkins/Private/Alternative Loan servicer accounts (including some managed by schools themselves) Over 1.6 million Perkins/Private/Alternative Loan servicer accounts (including some managed by schools themselves)

13 Meteor Customization Meteor screens can be customized to blend with the service providers current web services Meteor screens can be customized to blend with the service providers current web services Meteor allows a service provider to customize the use of the data provided in the Meteor Network Meteor allows a service provider to customize the use of the data provided in the Meteor Network –i.e. MYF Exit Counseling application  Not a standard Meteor implementation  Customized screens  Further integration is possible! Meteor software can be used in other internal applications with approval from the MAT Meteor software can be used in other internal applications with approval from the MAT

14 Meteor Usage Meteor Usage Meteor Usage –FAA Statistics  Usage has been increasing since FSA announcement about use of real time data –Borrower Statistics –Meteor…not just an inquiry network  In addition to providing access to and aggregation of financial aid award information, the Meteor software can also be used by organizations to enhance their current services. –MYF integration –Internal usage of the software at member organizations

The Meteor Federation

16 Meteor Authentication Model Utilizes transitive trust model Utilizes transitive trust model No central authentication process No central authentication process Each Access Provider uses their existing authentication model (single sign-on) Each Access Provider uses their existing authentication model (single sign-on) Level of trust assigned at registration Level of trust assigned at registration Authentication vs. Authorization Authentication vs. Authorization –Authentication is the process of determining the identity of a user that is attempting to access a system. –Authorization is the process of determining what types of activities are permitted.

17 Authentication and Authorization Once you have authenticated a user, they may be authorized different types of access or activity. Once you have authenticated a user, they may be authorized different types of access or activity. –Meteor Roles  Financial Aid Professional  Student/Borrower  Customer Service  Lender

18 Creating the Federation – Challenges and Opportunities Policy Policy –Provider eligibility –Security and privacy –Removal from the network Consensus Building Consensus Building –Over 40 providers (challenge!) Collaboration Collaboration –Over 40 providers (opportunity!)

19 Meteor Authentication Meteor model developed in conjunction with Shibboleth Meteor model developed in conjunction with Shibboleth –a project of Internet2/Mace, –developing architectures, policy structures, practical technologies, and an open source implementation –supports inter-institutional sharing of web resources subject to access controls by developing a policy framework that allows inter-operation within the higher education community. Project participants include Brown University, Ohio State, Penn State and many other colleges and universities. Project participants include Brown University, Ohio State, Penn State and many other colleges and universities.

20 Levels of Authentication Meteor Levels of Assurance Meteor Levels of Assurance –Level 0: Single piece of public information –Level 1: ID and one piece of public information –Level 2: ID and two pieces of public information –Level 3: User ID and Password All providers are supporting Level 3 Authentication All providers are supporting Level 3 Authentication National Institute of Standards and Technology (NIST) National Institute of Standards and Technology (NIST) –Meteor Level 3 = NIST Level 2

21 Authentication Process: Student logs into Access Provider site (i.e. school, lender, servicer or guarantor) Student logs into Access Provider site (i.e. school, lender, servicer or guarantor) –Access Provider follows their local authentication procedures, assigns a role and retrieves the appropriate assurance level from the Meteor Registry –Access Provider builds the security assertion  AP Unique ID  User Role  End User Identifier  Authentication Process ID  Assurance Level

22 Authentication Process: –Access Provider digitally signs the request and queries the Index Provider –Index Provider validates the provider (digital certificate) against the Registry; –Index Provider builds a response message and digitally signs and sends the request to the Access Provider –Access Provider receives the response and validates the provider against the Registry; validates the digital signature; validates assurance levels for Data Provider requirements; builds, signs, and sends the request message

23 Authentication Process: –The same validation process continues for the Data Provider’s receipt and response and the Access Provider’s receipt and display of the Meteor messages.

24 Current Production Participants AES/PHEAA National Student Clearinghouse Connecticut Student Loan Foundation National Student Loan Program Finance Authority of Maine NELA Florida Department of Education—OSFA New Hampshire Higher Education Assistance Foundation Georgia Higher Education Assistance Corp. New York Higher Education Services Corporation Great Lakes Educational Loan Services, Inc Oklahoma State Regents for Higher Education Illinois Student Assistance Commission Rhode Island Higher Education Assistance Authority Kentucky Higher Education Assistance Authority Sallie Mae Louisiana Office of Student Financial Assistance Student Loan Guarantee Foundation of Arkansas Mapping Your Future Student Loans of North Dakota Michigan Higher Education Assistance Authority Texas Guaranteed Student Loan Corporation Montana Guaranteed Student Loan Program USA Funds

25 Next Steps Inter-Federation Authentication Inter-Federation Authentication Multi Factor Authentication Multi Factor Authentication State Security Breach Reporting Legislation State Security Breach Reporting Legislation

26 Contacts Tim Cameron Meteor Project Manager NCHELP or