Liberty Alliance issues guidelines for standardized identity assurance, privacy controls
Connecting state and local government leaders
Identity Assurance Framework and Identity Governance Framework are aimed at driving identity system policy to better manage identity relationships and define how privacy is being protected in information technology enterprises.
The Liberty Alliance today released the first versions of two key specifications aimed at taking some of the work and doubt out of federated identity schemes.The Identity Assurance Framework (IAF) and Identity Governance Framework (IGF) are aimed at driving identity system policy to better manage identity relationships and define how privacy is being protected in information technology enterprises. IAF is a set of technology-neutral policies to help organizations make decisions about trust in identity credentials without reinventing the wheel each time. IGF is a technical specification for defining privacy issues based on the Extensible Markup Language.The frameworks follow on the development of the widely adopted Security Assertion Markup Language (SAML), said Roger Sullivan, Liberty Alliance president and vice president of identity management at Oracle Corp.'The SAML 2.0 infrastructure is well established as the de-facto standard for federated relationships,' Sullivan said. 'This takes us to the next level, addressing privacy and trust considerations for those relationships.'A federated relationship allows multiple organizations to trust one another's decisions and assertions so that each organization does not have to issue and process its own credentials. Establishing a federation typically requires some policy framework that all can agree on and an infrastructure for exchanging information in a defined format.IAF provides to allow organizations to link identity systems based on a uniform definition of the security and privacy risks at each of four levels of assurance. The Liberty Alliance will begin an IAF certification and accreditation program this summer.The IGF is an auditable, open standards-based to help meet regulatory requirements for using, managing and protecting personally identifiable information.'IAF will help us achieve global trust at common, known levels of assurance,' said Peter Alterman, assistant chief informtion officer of e-authentication at the National Institutes of Health and chairman of the Federal [Public-Key Infrastructure] Policy Authority. 'This will enable secure, trusted electronic business transactions outside of the enterprise. We've recognized this need for years in the U.S. government and introduced some of the first successful interfederated business processes in early 2001.'IAF is built on a foundation of government work. It builds on efforts originated by the Electronic Authentication Partnership, an industry organization supported by government working to establish business rules for interoperable authentication, which was merged into the Liberty Alliance last year.It also builds on the work of the National Institute of Standards and Technology in NIST , 'Electronic Authentication Guideline,' which specifies the technology to be used at each of four levels of identity assurance established by the Office of Management and Budget. OMB defined the levels of authentication assurance required for accessing systems based on the seriousness of likely consequences if there is an error.'We took the framework that NIST had created in SP 800-63, and we put some flesh on the bones' with specific business needs and processes, Sullivan said.As in the OMB model, IAF specifies assurance levels ascending from 1 through 4. Level 1 requires essentially no assurance that a person is who he claims to be. Level 2 requires a moderate level of ID proofing. Level 3 is a more stringent level, probably requiring multifactor authentication, and Level 4 is the most stringent, requiring strong multifactor authentication.IAF gives organizations in a federated relationship a common set of policies and practices so they can trust credentials issued or authenticated by one another at a given level of assurance.The alliance has released the first two components of IGF for establishing auditable privacy policies and policies for managing and protecting personally identifiable information.Sullivan said that additional specifications under IGF now are in early stages of development by Liberty Alliance.
policy criteria
framework
Special Publication 800-63
policy criteria
framework
Special Publication 800-63
- Client Attribute Requirements Markup Language (CARML) is a policy format used to characterize required identity data along with privacy constraints governing its use. It lets auditors understand what identity information an application needs so that privacy-aware services can be deployed among multiple identity protocols, such as Lightweight Directory Access Protocol, Liberty SAML 2.0 Federation, WS-Trust and Liberty Web Services.
- The privacy constraints specification is a way of expressing commitments and obligations about identity data using a small set of privacy terms concerned with the purpose, propagation, storage and display of the data.