5 programs break down the elements of an identity ecosystem

The National Strategy for Trusted Identities in Cyberspace is working to develop an interoperable framework for a digital identity ecosystem to make online transactions more secure and enable more government and economic activity on the Internet.

NSTIC has awarded $9 million in grants to five pilot programs run by government agencies, industry and academia on different aspects of the ecosystem, including.

• Third-party ID verification that uses drivers' licenses and state motor vehicle departments for authentication.
• Commercial, open-source ID verification network that allows multiple relying parties to verify a user’s identity by referring to the authoritative sources.
• Multi-factor mobile authentication that uses varying levels of trust from PINs to geolocation.
• Data encryption with broker verification that enables access to personally identifyable information.
• Attributes for authentication that establish an infrastructure for preserving privacy.

Here’s a breakdown of each pilot project funded by the grant:

Third-party ID verification

Motor vehicle departments were not originally intended to be in the identity business and drivers’ licenses were not intended for use as identification. But drivers’ licenses have evolved into de facto government IDs, and DMVs have become the first line of government identity proofing. The American Association of Motor Vehicle Administrators’ Cross-Sector Digital Identity Initiative will try to leverage that expertise with a framework to enable the secure exchange and verification of identity data.

“The whole concept of electronic IDs is a paradigm shift” for DMVs, said AAMVA’s director of ID standards, Geoff Slagle. It potentially enables DMVs to become third-party sources for verifying identity for online transactions. The organization’s program could use multiple sources of data to verify online identity.

Under the federal government’s four levels of assurance for ID credentials, drivers’ licenses now are rated at a strong 2 (with 4 being the highest), Slagle said. To raise that level of assurance so that licenses could be used for more sensitive transactions, license data could be associated with other sources. Doing so would require multiple verifications, each to be bound with the license information.

DMVs could play multiple roles in the scheme, both authenticating identities online for third parties and verifying personal information presented for licensing.

The CSDII framework would require establishment of standards and policies for the parties involved, and AAMVA will build on existing technologies and standards.

“We don’t want to be re-inventing the wheel,” Slagle said. “It’s not our aim to be a standards development organization.”

The program, now in its early stages, will include two proof-of-concept deployments before launching a larger pilot program, which is expected to wrap up within two years.

Participating in the AAMVA pilot are Commonwealth of Virginia Department of Motor Vehicles; Biometric Signature ID, a provider of two-factor authentication; CA Technologies; Microsoft; and AT&T.

Commercial, open-source ID verification network

A team led by Criterion Systems, ID Dataweb and Google will launch four pilots with participants that include the Homeland Security Department, with an eye toward rolling out a commercial, open-source ID verification network in the coming year.

“Our pilot is predominately testing a business model,” said David Coxe, cofounder of Criterion and CEO of ID Dataweb. The technology already is in place; the pilot will tie it together for commercialization.

The ID Dataweb Attribute Exchange Network leverages existing online relationships between end users and organizations, providing a gateway that will allow multiple relying parties to verify a user’s identity by referring to the authoritative sources. Attributes used to verify an identity could range from a name, birthdate or phone number, to Social Security Number, biometric identifiers and digital credentials from government CAC and PIV cards.

The program began when Google hired Criterion and ID Dataweb to design open source software to support cloud-based Web services based on emerging standards including OAuth, OpenID and SAML, and to build out a network of endpoints to using the software. The result was the Attribute Exchange Network.

Relying parties will sign up to use the network, and providers of verification will register to provide services. Relying parties decide what identity attributes must be verified for authentication. Verification is returned without exposing the data it is based on.

Google’s target was to build out a system that would support 100 million users. The NSTIC grant will fund four 50,000-user pilot programs in the retail, financial services and government sectors that will use the Attribute Exchange Network to verify open ID credentials.

The pilots will be:

• A first responder ecosystem for DHS
• A consortium of broker/dealers for Broadridge Financial Solutions
• eBay
• General Electric

The first 50,000 users opting to use open ID credentials for these accounts will go into the pilot program. Authentication could include multiple factors, such as a phone number verified through billing records, so that a one-time PIN for access could be sent to that phone.

Participants in the Criterion pilots include ID Dataweb, AOL Corp., LexisNexis, Risk Solutions, Experian, Ping Identity Corp., CA Technologies, PacificEast, Wave Systems Corp., Internet2 Consortium/In-Common Federation, and Fixmo Inc.

Multi-factor mobile authentication

Daon Solutions will lead five pilot programs with partners to expand the use of the IdentityX authentication platform, which uses mobile devices to provide risk-based authentication.

“Phones are not considered high security hardware tokens,” said Catherine Tilton, Daon’s NSTIC program manager. But using mobile devices such as phones and tablets to deliver multi-factor authentication could raise the level of assurance and enable transactions requiring higher levels of trust.

At the lowest levels of trust, a software certificate loaded on a mobile device could be used with a password or PIN to authenticate the user. When higher levels are required, additional challenges could be added such as voice or facial biometrics, geo-location data gathered from the device, and the use of the device to deliver a one-time password. “It is the relying party that maps the transaction to the authentication factors,” Tilton explained.

Because the phone is an untrusted platform, it is used only for collection and delivery of data, and authentication takes place on the IdentityX server, hosted by the relying party. When the user initiates a transaction the application sends the authentication request to the server, which sends the appropriate challenge to the mobile device over a secure channel using the Transport Layer Security protocol. The device sends the requested information to the server, and if it is verified the user is authenticated for the application.

The technology is being used now in small, single-user pilots, Tilton said. The NSTIC grant will allow its expansion to larger programs, the first of which is expected to begin in May.

Participating in the pilots as relying parties are the American Association of Retired Persons, PayPal, Purdue University, the American Association of Airport Executives, and a major bank. Purdue will play a dual role – as a relying party in a pilot and providing research for the project on usability, accessibility, privacy, performance, and user acceptance, in laboratory and real-world environments.

Data encryption with broker verification

Resilient Network Systems will work with 17 partners to conduct two pilot programs enabling remote access to health care information and educational resources. Authentication for access will be over a Trust Network that uses cryptography to hide personally identifiable information and neutral brokers to access and verify it.

“We assume there is a lack of trust,” said Pat Reilly, Resilient’s executive vice president for business development. “We are working with ID providers,” he added, such as the American Medical Association and local school systems, to verify attributes of users.

The relying party will set and enforce policies for access requirements, and a trust broker using those policies will verify attributes with multiple identity providers. Encryption and other schemes will hide the personally identifiable information used by the trust broker as well as the context of the access being requested, providing privacy for the end users.

The two pilots will be:

• Patient-Centric Coordination of Care, which will provide multi-factor authentication of patients, physicians and staff at two information health exchange organizations, the San Diego Beacon eHealth Community in California and Gorge Health Connect in Oregon.
• Zero-Knowledge Identity and Privacy Protection Service, which will provide authentication for students, parents and teachers in compliance with the Family Education Rights and Privacy Act and the Children’s Online Privacy Protection Act.

The Trust Network already is in use by customers using it with trusted partners, Reilly said. “This is a significant leap for us. This truly brings it into the wild.”

The pilots are expected to be in operation by next summer and be wrapped up in October.
Participating in the healthcare pilot are the AMA, Aetna, the American College of Cardiology, ActiveHealth Management, Medicity, LexisNexis, NaviNet, the San Diego Beacon eHealth Community, Gorge Health Connect, the Kantara Initiative and the National eHealth Collaborative.

Participating in the educational pilot are the National Laboratory for Education Transformation, LexisNexis, Neustar, Knowledge Factor, Authentify Inc., Riverside Unified School District, Santa Cruz County Office of Education, and the Kantara Initiative.

Attributes for authentication

This consortium of education and research institutions known as Internet2 will work with five member universities to help develop and deploy a set of tools to enable attribute-centric authentication.

“Our work is a little different” from other NSTIC pilot programs, said Ken Klingenstein, Internet2’s senior director of middleware and security. It is not establishing the viability of a business model or scheme, but of an infrastructure for preserving privacy during authentication.

Attributes are characteristics associated with people that can be verified to allow access to online resources. These can include things such as age or age range (Over 18? Under 13?), location or residence, eligibility for services, or medical conditions. Often only one or a few of these attributes need to be authenticated, and do not need to be coupled with identifying information to allow access. The goal of attribute-centric authentication is “releasing the minimum amount of information, and giving the user control over what is released,” Klingenstein said.

The components for the pilot are:

• Privacy Manager: User friendly software to allow users to control what attributes are released for authentication.
• Anonymous Credentials: Attributes are encrypted so that not even the identity provider used to verify them has access to them. “This is a mixed bag” because it can be used to mask information that might be needed, Klingenstein said. “Anonymous credentials are very much a disruptive technology.”
• Citizen-centric Schema: Groupings of attributes commonly used for interaction with government at all levels, bundled to simplify the use of only necessary information.
• Application Categorization: A system for verifying that an application requesting authentication is verifying only those attributes that it needs. The goal is to have commercial services that could provide a seal of approval to online applications that are known to behave appropriately.

Participating in the Internet2 pilot are Carnegie Mellon University, Brown University, the University of Texas, the Massachusetts Institute of Technology and the University of Utah.