1. Law Enforcement Information Sharing Program (LEISP) Federated Identity Management Pilot
February 27, 2006

2. Federated Identity Management Pilot

3. Benefits of Federated Identity Management
More information (relevant information, critical information) becomes available to more users
Enabled single sign-on (authenticate once – authorize many)
Faster response time in critical situations
Enhanced user experience
Personalization (based on attributes, streamline information dissemination)
Policy Control (separation of authentication and authorization)
Auditing
Improved alliances across government entities
Streamline vetting
Cost avoidance
Cost Reduction
Reduced Time to Net
Improved interoperability
Dynamic provisioning and de-provisioning
Faster response time
Greater security

4. Expected Results of the Pilot
Provide value to users (e.g. access to applications that they did not have)
Establish a model for joint interoperability with federal, state and regional efforts to improve information sharing to combat crime and terrorism in the context of a tangible project involving multiple organizations (DOJ, DHS, RISS, FBI)
Confirm the applicability of Federated Identity management as a tool for enhancing information sharing
Confirm the viability of the trusted broker architecture
Evaluate the quality of user experience and use this feedback to tune the next phase and implementation
Better understand challenges in implementation (organizational, contractual, technical and legal)
Narrow technical and strategic options for full scale implementation and estimate implementation costs
Identify aspects of the pilot suitable to be leveraged to other domains
Provide a platform where best practices in identity management can be shared and tested

5. One user accessing one application
Steps in provisioning access:
Vetting (who are you?)
Permissioning (what can you access?)
Credentialing (how do I know it’s you? – passwords, smart cards, etc.)
Access requires authentication of credentials
User
Application

6. One user accessing many applications
Steps in provisioning access:
Vetting
Permissioning
Credentialing
RESULT:
Each application must perform all steps above
User must keep track of N sets of credentials 1
× N 2 N

7. Many users accessing many applications1
Steps in provisioning access:
Vetting
Permissioning
Credentialing
RESULTS:
Multifactor credentials & vetting become too expensive
Vetting & credentialing not done well.
Vetting too far from user to be kept up to date effectively
High barrier to access 1
Expensive!!
× M × N 2 2 N M

8. Federated Identity Management
Access Provisioning
Provisioning identity (vetting and credentialing) with the organization (×M)
Provisioning accounts (permissioning) with applications (×M×N)
RESULTS
Huge savings in vetting and credentialing M<<M×N
Vetting is better – closer to the user since own organization does vetting
Credentialing is better – can afford multifactor
Lower barriers to access – more access
Each users only needs one credential (Single sign-on)
Faster account provisioning
Faster and easier account de-provisioning 1 1 2 2
Trusted
Broker N K
K Organizations
M Users
N Applications

9. Trusted Broker Mechanism
Identity Providers
Certified, trusted identity providers verify users’ credentials and assert identity to the broker (SAML, PKI, WS-F)
Trusted Broker
Asserts identity to the applications (SAML)
Protocol translation if required (different versions of technology)
Applications
Accept assertions of identity from the trusted broker
Make access decisions (authorization) 1
Identity
Provider 1
Assert
Identity
Identity
Provider 2 2
Trusted
Broker
Assert
Identity
Identity
Provider N K
K Organizations
M Users
N Applications

10. Alignment of LEISP Vision for Identity Management with e-auth
GSA e-Auth has been briefed
GSA e-auth leadership is supportive of LEISP vision
Conceptually aligned (but LEISP focus is LE & CT)
Broker based architecture is more flexible
Not everyone needs to use identical technology
Physical connectivity requirements are simplified
Additional flexibility in user access controls
Additional capabilities for provisioning/de-provisioning
Re-authentication and global logout capabilities
Other sub-federations (e.g. health) may eventually forge inter-federation trust and interoperability