1. A DESCRIPTION OF CONCEPTS AND PLANS MAY 14, 2014 A. HUGHES FOR TFTM 01-02 The Identity Ecosystem 2014-05-14 DISCUSSION DRAFT 1

2. DRIVERS, CORE STRUCTURE, REQUIREMENTS Ecosystem From The Inside 2014-05-14 DISCUSSION DRAFT

3. A Note on Role Names Role names are used to keep the entities and their functions separate Any entity or organization could play one or more Role in the ID Ecosystem  Online Services Supplier  The Relying Party, Service Provider  Online Services Client  The consumer or customer or recipient of the Supplier’s services  Online Trust Provider  All roles associated with establishing facts, provisioning credentials/tokens, verifying conformance, testing, audit  Common names IdP, TM, CM, CSP, TFP, CA, RA 2014-05-14 DISCUSSION DRAFT 3

4. The Online Interaction The goal of NSTIC is to improve the state of online interactions The interaction or transaction between online service supplier and their client is the primary source of requirements for security, privacy and ease of use Describing a coherent ID Ecosystem is possible by extending the ‘Interaction-centric’ concept 2014-05-14 DISCUSSION DRAFT 4

5. The Central Pattern Central tenet: Supplier and Client engage in an online interaction only if certain Conditions are presented, potentially negotiated and fulfilled. (Arrows should probably be bi-directional) 2014-05-14 DISCUSSION DRAFT 5

6. The Central Pattern: ‘Conditions’ ‘Conditions’ might be:  Provide the username and password associated with your account  Provide payment information  Produce a validated electronic authentication token issued by a trusted Credential Service Provider  Accept these Terms of Service  Possess these Trustmarks 2014-05-14 DISCUSSION DRAFT 6

7. The Central Pattern: Suppliers The Online Service Supplier wishes to control access to the service and provide the right service to the correct Client ‘Conditions’ are used to gather the information needed to make the service access decision 2014-05-14 DISCUSSION DRAFT 7

8. The Central Pattern: ID Risk The Online Service Supplier must guard against misidentification, fraud, impersonation, inability to distinguish one client from another The stringency and number of Conditions increase with greater transaction risks 2014-05-14 DISCUSSION DRAFT 8

9. The Central Pattern: Requirements The Interaction, Conditions and Fulfillment drive all requirements  System, transaction, technical, policy, interoperability, trust, assurance, operations, data formats, security, privacy, user experience 2014-05-14 DISCUSSION DRAFT 9

10. Trust Infrastructure: Trust Providers Online Trust Provider box  Intended to represent any security, trust or privacy service available to the Supplier-Client  Entirely determined by the Transaction requirements  Might be standard & shared  Might be custom & secret  Might deliver high certainty or low certainty  Might be reliable or not 2014-05-14 DISCUSSION DRAFT 10

11. ‘Trust’ Infrastructure The Trust Infrastructure is secondary to the transactions and exists to support the supplier- client interaction  Credentials, tokens, certificates, secrets  Identity information, relationship/membership  Federations, Trust Frameworks, Assurance Frameworks 2014-05-14 DISCUSSION DRAFT 11

12. Trust Infrastructure: Community NSTIC ‘Online Community’  NSTIC defines ‘online communities’ which have shared risks, a stable set of transactions, common rules, common trust requirements Community Governance  Indicates the operator and manager of the community rules, their implementation and enforcement  Sometimes named the Federation Operator or Trust Framework Provider 2014-05-14 DISCUSSION DRAFT 12

13. Rationale for Transaction-Centric Why focus on the transaction instead of the normal focus on Trust Infrastructure?  Clarifies the value of the ID Ecosystem  The Transaction drives all requirements, not the Trust Providers  Each element can be broken down and mapped to real and future implementations 2014-05-14 DISCUSSION DRAFT 13

14. The ID Ecosystem Online communities using this pattern are candidate participants in the NSTIC-envisioned ID Ecosystem NSTIC requires certain things of the Community Rules and other community features 2014-05-14 DISCUSSION DRAFT 14

15. Compare to the NSTIC Definition A Trust Framework  Is developed by a community  Defines the rights and responsibilities of that community’s participants  Specifies the policies and standards specific to the community  Defines the community-specific processes and procedures that provide assurance  Considers the level of risk associated with the transaction types of its participants - NSTIC Strategy Document 2014-05-14 DISCUSSION DRAFT 15

16. THE ID ECOSYSTEM FROM ABOVE Ecosystem From 30k 2014-05-14 DISCUSSION DRAFT

17. The Central Concern 2014-05-14 DISCUSSION DRAFT 17 The Interaction is central  Trust Providers exist to express and satisfy ‘conditions’  All activity must fall within the rules of the Community

18. Many Transactions in a Community 2014-05-14 DISCUSSION DRAFT 18 Within the Community context many transaction types are possible The picture shows a single trust infrastructure supporting all community transaction types All activity must fall within the rules of the Community

19. Many Trust Providers in Community 2014-05-14 DISCUSSION DRAFT 19 The picture shows two trust infrastructures within the same community The trust infrastructures are federated All activity must fall within the rules of the Community

20. ID Ecosystem Perspective A Many ‘communities’ exist today  Some are verified by 3rd party assessors  Some are closed/walled gardens  Some are Enterprise-Enterprise federations  Some involve Trust Framework Providers and Trust Frameworks  Some are multi-party federations Some happen to follow the NSTIC Guiding Principles Next slide is a sketch of this state 2014-05-14 DISCUSSION DRAFT 20

21. ID Ecosystem Perspective A 2014-05-14 DISCUSSION DRAFT 21

22. ID Ecosystem Perspective A One perspective of the path forward is to increase the number and type of Ecosystem Communities that follow the NSTIC Guiding Principles  And, as a consequence, end-users will begin to experience NSTIC-oriented services This might be characterized as the path to building a Compliance/Conformance Program 2014-05-14 DISCUSSION DRAFT 22

23. ID Ecosystem Perspective A 2014-05-14 DISCUSSION DRAFT 23

24. ID Ecosystem Perspective B One perspective of the path forward is to build on the GTRI Trustmark ideas  Define Trust Interoperability Profiles (TIP) for participating Stakeholder Communities  Establishing Trustmark Defining Organizations (TDO)  Trustmark Definitions and Trustmarks: statement of conformance to identity trust/interoperability requirements plus its formal assessment process 2014-05-14 DISCUSSION DRAFT 24

25. The GTRI Trustmark Concept Map 2014-05-14 DISCUSSION DRAFT 25

26. ID Ecosystem Perspective B 2014-05-14 DISCUSSION DRAFT 26

27. ID Ecosystem Perspective C Suggestions for other alternative views are welcome 2014-05-14 DISCUSSION DRAFT 27