Internet Identity

Getting ready for the InfoCard Identity Metasystem and CardSpace

• Caveats: I'm not an expert on this, much remains uncertain, questions/insights welcomed
• Good news: maturing of identity management - Laws of Identity
• Goal is internet identity layer. An Identity Metasystem, to leverage ways of doing identity, like Internet leveraged ways of doing networking.
• PKI is one way of dealing with identity. There are others also. How can they work together?
• Terminology: here's my pitch, inspired by Jain's blog : "Windows CardSpace" for Microsoft's branded Identity Selector implementation for the "InfoCard Identity Metasystem", and "InfoCard" as shorthand for the name of this particular identity metasystem in which users manipulate information cards. The term "card-based" or "card-centric" is also used, but that is easy to confuse with smart card approaches.
• Background
  • Problem Statement by Kim Cameron: The Internet was built without a way to know who and what you are connecting to. ... Hundreds of millions of people have been trained to accept anything any site wants to throw at them as being the "normal way" to conduct business online. They have been taught to type their names, secret passwords, and personal identifying information into almost any input form that appears on their screen. ...

    It is essential to look beyond the current situation, and understand that if the current dynamics continue unchecked, we are headed toward a deep crisis: the ad hoc nature of Internet identity cannot withstand the growing assault of professionalized attackers.

  • Remember risks of authentication via browsers - Phishing, Dartmouth work on attacking PKI auth in browsers, etc
  • Broad definition of "Digital identity": set of claims about subject. not necessarily unique, e.g. "CU Student"
  • Cardspace: a general authentication client, based on Laws of Identity, with logging, privacy statements, etc.
• CardSpace demo and tutorial - with a PHP implementation of a relying party. See also Ernst's hard-won screenshots
• Client gets "application/x-informationCard" object from Relying Party via HTML form to start the exchange
• Client uses information card selected by the user to access Information Provider. Talks via WS-Trust to STS (Security Token Services) at Identity Provider. Authenticates to it via name/password, Kerberos, client certificate or "SAML" proof of identity and gets an encrypted token back to pass along to the Relying Party
• Laws of Identity [observed, not decreed]
  1. User Control and Consent [earn user trust; want consent, even inside enterprise]
  2. Minimal Disclosure for a Constrained Use [minimize risks to subject and to service provider; e.g. age not birthday]
  3. Justifiable Parties [relying party site satisfies user it is "justified" in requesting identification]
  4. Directed Identity [choose public or private; violated by PKI, Bluetooth, x.509, RFID]
  5. Pluralism of Operators and Technologies [not a monopoly, room for future innovation]
  6. Human Integration [safe, unambiguous human-machine interaction; ceremonies]: Protection against phishing and pharming
  7. Consistent Experience Across Contexts ["thingify" digital identities]
• For relying parties, Microsoft emphasizes Extended Validation x.509 certs with logotypes, not plain old "server certs", targeting "Banks and Major Internet Businesses"
• Likely early InfoCard use cases - log in to banks
• Not an integrated open standard owned by an independent standards body, but Microsoft says they've documented things, collaborated and won't assert related patents
• Implementation examples: Windows CardSpace (for Vista and XP), Open Source Identity Selector project, Higgins, maybe Shibboleth
• Questions, issues:
  • interoperability. See Interoperability Space at the spwiki run by SocialPhysics
  • control of specs,
  • extensibility
  • integration with other systems (PKI, Kerberos, Shibboleth, SAML 2.0, OpenId)
  • mobility: using your infocards on different devices,
  • relying party still has to deal with who to trust - how?
  • standards for claim schemas? See http://identityschemas.org/
• Role for USHER? - e.g. is there a way to help relying parties assert "student" status - plan for IdP proxying: one IdP authenticating another IdP?
• Related systems: OpenID (gaining support for blogs, etc.), LID, etc.
• Where does this all leave PKI and campus identity management?
  • Pay attention to the laws of identity
  • InfoCard will compete with PKI and Shibboleth in a number of use cases, and cooperate in others.
  • But it reuses much underlying expertise, infrastructure, policies, practices, audit experience, etc.
  • It won't be here for a while, but addresses some important issues
  • PKI can be used for authentication to Identity Provider.
  • Also useful for signatures, encrypting communications, etc.
• InfoCard compared to SAML, Shibboleth - Bob Morgan/Scott Cantor
• Eric Norman - more on phishing et al.

• Identity Commons - to "support, facilitate, and promote the creation of an identity layer for the Internet..."
• other anti-phishing user-interfaces: e.g. sitekey and other security skins, or W3C's Web Security Context Working Group
• Sandbox for playing with Windows CardSpace - http://sandbox.netfx3.com/
• Federated Identity examples: http://www.washington.edu/computing/infra/shibboleth/sp.html
• Similar to SAML ECP: Enhanced Client or Proxy Profile
• http://www.onlamp.com/pub/a/onlamp/2006/06/29/the-long-view-of-identity.html
• 6th Annual PKI R&D Workshop - "Applications-Driven PKI (It's The Apps, Stupid!)" - broad approach to PKI, trust, authentication, human interface, etc.