Don Thibeau, Executive Director, OpenID Foundation (OIDF) Drummond Reed, Executive Director, Information Card Foundation (ICF)

2 Background The Open Identity Framework How the OIF will drive adoption Next steps

3 Most are closed ◦Visa, MasterCard, AMEX credit card networks ◦Phone networks ◦ATM networks Some are open ◦Political, social, religious organizations Some are explicit (legal agreements) Some are implicit (social contracts)

4 In April, the U.S. government asked the OIDF and ICF to create a trust framework for OpenID and Information Cards ◦This would enable U.S. government websites to begin accepting OpenID and Information Card credentials GSA ICAM relying party requirements: ◦Open (not just US citizens) ◦Explicit (legal documentation of certification to NIST levels of assurance) ◦Internet scale

5 See the first set of deliverables at IDmanagement.gov ◦Identity Scheme Adoption Process (ISAP) ◦Trust Framework Provider Adoption Process (TFPAP) Two open identity scheme profiles completed under the ISAP process

6 OpenID LOA 1 profile is now implemented across tens of millions of OpenID accounts ◦Test/pilot infrastructure built ◦Multiple IdP implementations tested ◦Pilot customer (National Institute of Health) with test site IMI Information Cards 1.0 profile covers LOA 1, 2, and non-PKI 3

7 How to best implement the profiles How to best implement the trust framework Identity Providers (IdPs) Relying Parties (RPs) Policy interop Technical interop

8 In August, OIDF and ICF published a joint white paper saying an open, Internet-scale approach to trust frameworks must be: ◦Open to any trust framework authority ◦Open to all IdPs and RPs ◦Open to any qualified assessor/auditor ◦Open to any qualified certification process (including self- certification) ◦Open to evolution and adaptation to market forces

9 An open Internet-scale trust framework must also: ◦Offer both Levels of Assurance (LOA) for IdPs and Levels of Protection (LOP) for RPs ◦Provide a means for dealing with liability ◦Provide a simple, useful, scalable listing service ◦Be open and transparent in its dealings, use public documents written in plain language, and provide frequent reports on all activities

10 The following slide shows the basic design reflecting the OIF principles It illustrates the relationships between the four parties connected by OIF legal agreements ◦The OIF TFP itself ◦Auditors/assessors ◦Identity providers ◦Relying parties

Trust framework agreements Optional direct agreements Identity Providers (IdPs) Relying Parties (RPs) Users Trust Framework Provider (the Open Identity Framework) auditors/assessors trust framework authorities

12 The OIF design explicitly supports at two levels of interoperability ◦Technical certification listings drive adoption before the trust layer is required ◦Policy certification listings drives adoption where explicit trust is required Self-certification and third-party certification is supported at both layers Technical and policy requirements (“profiles”) can be reused at both layers

Identity Providers (IdPs) Relying Parties (RPs) Trust Framework Provider (the Open Identity Framework) auditors/assessors trust framework authorities Technical Certification Listings Technical Interop Requirements

Identity Providers (IdPs) Relying Parties (RPs) Trust Framework Provider (the Open Identity Framework) auditors/assessors trust framework authorities Technical Certification Listings Policy Certification Listings Policy Interop Requirements

Efficiency Openness/Transparency Credibility/Accountability User experience 15

The OIF makes it easy for anyone of any size to ensure technical or policy interop with their choice of profiles Eliminates the n-squared problem of multi-lateral interop testing or trust agreements ◦Quickly become unwieldy for even a small number of IdPs and RPs Grows the market for everyone ◦The “network effect for trust” 16

17 Properly implemented, the OITF provides an open, transparent process for trusted identity transactions ◦Both within and between communities Helps protect participants from collusion or anti- trust concerns Anticipates cross-border data protection issues

18 Each participant (policy authority, IdP, RP, assessor/auditor) reinforces the credibility of the entire model Mutual accountability of all participants Enhanced by government participation ◦Gov’ts serve as the initial “trust anchors”

19 Increased interoperability of Internet identity across websites More consistent ceremony leads to lower login or transaction abandonment at RPs Consistent trust mark raises user confidence

20 Cost efficiency ◦Lower legal, design, and operations costs ◦Lower overhead for assessors/auditors, IdPs, and RPs who need certification Process efficiency ◦Single entity for negotiation of MOAs with policy authorities Effectiveness ◦1+1=3

21 Please contact either foundation with questions or comments Let us know if your organization is interested