Governments face a dilemma. As more and more services move online, identifying and authenticating citizens in cyber-space are becoming more difficult. Citizens want one-stop service but they also want assurances their personal information is kept private. Sharing information across jurisdictions can create seamless service delivery, but government entities must ensure they are dealing with the same person.
Online initiatives will only continue to expand in the future, so governments will need to settle on a common authentication method for their citizens.
Securely sharing identity information while remaining within the confines of privacy legislation, therefore, is a challenge the public sector is working to overcome.
"I don't want to simplify too much, but governments have two basic choices for this: a national ID or federated identity management system," says David Temoshok, director for identity policy and management at the U.S. General Services Administration (GSA) which works with the Department of Homeland Security.
Many organizations have internal identity management systems which provide strong, automated mechanisms to enrol and identify authorized users and control their user rights to information resources. To obtain a health card, citizens must present a passport or other physical credential to prove their identity, and then obtain log-on credentials to gain access to health care Web sites. "So when the authentication credentials are used in the future, they can be correlated back to an identity," says James Quin, senior analyst at the London, Ont.-based Info-Tech Research Group.
Federated identity management is a new approach that takes this process one step further by establishing trusted relationships between organizations to allow them to share information, he says. Organizations and their users are linked to partnering organizations within circles of trust that are established in federation agreements that specify user rights. Attributes of an individual's ID can then be shared within a common technology and policy framework that protects that identity.
Two models
There are two fundamental models for federated identity management based on where the authoritative source or repository for identity information resides, he says. "In the meta-directory approach, all that identity information is obtained from trusted partners and piled into a new and consolidated core directory. In a virtual directory, I have my information and you have yours, but we agree to create linkages between them, so it's not one core directory."
Which model is more secure is a philosophical question, as there are pros and cons to both, he says. "In the meta-directory approach, you have only one repository to protect with a security infrastructure. In the virtual directory, if you link one directory to another, then it's only as strong as the weaker of the two infrastructures."
In Quin's view, the meta-directory approach may provide more opportunities to build one super-strong security infrastructure to protect a single point of failure. But the stumbling blocks involved in building it trump its advantages, particularly in a government context. "It's expensive and a huge pain to build these central repositories from scratch - think about the gun registry - and there would be a backlash from citizens."
But the virtual directory approach means personal information about citizens resides in many government systems and servers in redundant and potentially inaccurate forms. "They tend to be less secure, but virtual directories are easier to create and manage so they tend to be (more common) than meta-directories."
An emerging standard in federated identity management systems is Security Assertion Markup Language (SAML), a protocol developed by international standards body OASIS that allows the exchange of authentication and authorization data between security domains. Although there are other competing standards and variants, the Liberty Alliance, a global identity organization comprised of 150 major vendor, client and government organizations, has been active in driving the development of open and interoperable SAML-based security standards.
"There are many data exchange mechanisms and standards. The key thing when dealing with multiple vendors in government is to ensure they all speak open standards, or you will burn money," warns Ross Chevalier, CTO of Novell Canada, adding that many vendors add proprietary interfaces and extensions to their supposedly open systems.
Continued:Technology challenges of a federated identity approach
Related content:
Understanding federated identity
Province of B.C. readies federated identity model
icon.
