URGENT! The requirement of Identity management is to standardise communication between two or more end-points, to identify and verify the true identity with validated confidence prior to exchanging digital information.
In the United States various standards that organizations dealing with the US government must meet FIPS 201, that specifies Personal Identity Verification (PIV) requirements for Federal employees and contractors.
Identity Management requires that there are processes and procedures in place to ensure the integrity of the end-to-end process of identifying and verifying claimed identities. The integrity of the processes and staff around this process is essential and if any part of the process is subverted or contains exploitable vulnerabilities then the whole process of establishing and verifying an identity can be compromised.
The main question in identity management that must be asked is:
“Can I prove to another party, beyond reasonable doubt and to their satisfaction, that I am who I claim to be, and am acting in the delegated role I claim for some organization?“
This solution is intrinsically flawed as identity theft is so simple with any physical credential that can be carried such as a Passport, ID card or similar – even if supported by a biometric confirmation. Holding all this information in a centralized location. These sources allows a whole identity to be stolen with all necessary supporting evidence to support the claimed identity. Plus, much of the database that can be accessed may also be subject to subversion and maybe unnoticed or undetected till damage is done.
These flawed systems include all current database centric identity management systems.
- link the implementation to the existing infrastructure;
- implement the relevant roles on the relevant PDI;
- connect the WSPs, or commission a new WSP for the organisation;
- integrate the infrastructure into existing processes and procedures;
- test end to end processes;
- provide training;
- go live.
SIRM propose a revolutionary approach that does not use a centralised database but a peer-to-peer model where the individual is in charge of their own identity, which we have called a Personal Digital Identity (PDI). This is used to provide references from a known legal starting point (e.g. registration of birth, entries on the relevant company business register etc) and is built up over time as more digital interactions are undertaken allowing more references to assert that you are who you claim to be. This reverts to the pre-internet days where identity management was based on introductions and references. As time goes by and more references become available, the identity becomes more difficult to forge as the references can be individually checked by the reference receiver directly with the reference giver to ensure that they are both current and valid. The reference requester can request references from the other party that meet their requirements and come from someone they trust – either on a personal basis or because they are ‘reputable’. Once the identity has been established to the satisfaction of all interacting parties, the digital interaction can take place. The owner of the PDI, can agree with the other interacting parties things like:
- encryption strength to be used;
- jurisdiction in case of dispute;
- signing requirements;
- supporting biometrics to be used;
The whole process is business policy driven modelling real world processes and is not technology driven, but relies on technology to communicate securely between the parties. Whilst acting in a delegated role for some organisation, the owner of a PDI can:
- accept a delegated role from any organisation (e.g. Salesman, CFO, etc);
- be accountable for actions taken with their PDI whilst acting in that delegated role;
Additionally, in this model, each interacting party can choose their own independent witness service provider (WSP) who will hold an audit trail of all digital interactions in case of later dispute. In that case; there is always at least one independent witness that holds an encrypted and hashed copy of the detail of the digital interaction that is time stamped from a known and reputable time source and this is held in accordance with the relevant legislation where the WSP resides. If required, an organisation can set up their own WSP so they can maintain control over their own audit trails. This infrastructure has been working satisfactorily in a number of locations and first went live in 2003. A number of solutions have been developed using this infrastructure.
SIRM has developed a standardised approach to implementing identity management projects:
- defining the scope of the project;
- understanding your business;
- understand the accountabilities, authorities and responsibilities of all delegate roles in your organisation;
- define the requirements for implementation;
- link the implementation to the existing infrastructure
The use of a PDI with a WSP:
- agrees, in advance, the dispute resolution process;
- allows trust to be built over time between interacting parties;
- complies with relevant legislation and regulation;
- eliminates the ‘attack point’ of a centralised database containing multiple sets of identity credentials;
- ensures that references are appropriate and can be verified;
- has been favourably benchmarked against a range of legislation, regulation and international standards;
- meets the requirements stated in Kim Cameron’s ‘Laws of Identity’;
- places control of the identity back in the owner of that identity;
- provides a simpler process for managing access within your organisation, including termination and job change situations;
- provides independent verification of the content of an interaction;
- provides total traceability and transparency;
- reduced the chance of identity theft;
- uses robust and provable technology that has been successfully running for over 5 years;