A User-Centric Identity Metasystem

Introduction to A User-Centric Identity Metasystem -

This paper proposes a framework for protecting privacy and avoiding the unnecessary propagation of identity information while facilitating exchange of specific information needed by Internet systems to personalize and control access to services. It also sets out factors to be taken into consideration when deciding where the standardization of such a framework should be brought about. Information systems that co-operate to originate, control and consume identity information have been called identity systems. The evolution of the Internet requires increased interoperability of these systems. Such interoperability demands an abstract model that encompasses the characteristics of all co-operating identity systems. We call this abstract model the Identity Metasystem. Describing, designing, deploying and managing identity systems in accordance with this model will facilitate the interworking of identity components:

• from different manufacturers;
• under different managements;
• of different levels of complexity;
• based on different protocols ;
• employing different syntaxes;
• conveying different semantics; and
• of different ages.

Editor's note ...

With this paper, Kim Cameron, Chief Identity Officer, Microsoft, is seeking to extend Microsoft's Information Cards with 'minimum disclosures' (that is, claims granularly derived from Information Cards). See also Roger Dean interviews Kim Cameron, Chief Msft Identity Architect.

Windows CardSpace (aka Microsoft Information Cards), part of the .NET stack, is Microsoft's client software for the Identity Metasystem, an interoperable architecture for digital identity that enables people to have and employ a collection of digital identities based on multiple underlying technologies, implementations, and providers. When an Information Card-enabled application or website wishes to obtain information about the user, the application or website requests the publication of a particular set of claims authored by the user. The CardSpace user interface then appears, switching the display to the CardSpace service, which displays the user's registered identities. The user selects their InfoCard to verify their identity. See Identity Selector Interoperability Profile V1.0, Microsoft Corporation (April, 2007). See also US Patent 7,149,977: Virtual calling card system and method.

Microsoft's CardSpace is now officially being marketed in the context of the 'Geneva Framework', a Claims Based Access Platform. See also The United Federation of Cloud Providers.

I'm filing A User-Centric Identity Metasystem as a library reference to this blog.

DOD Orange Book

Preface

The trusted computer system evaluation criteria defined in this document classify systems into four broad hierarchical divisions of enhanced security protection. They provide a basis for the evaluation of effectiveness of security controls built into automatic data processing system products. The criteria were developed with three objectives in mind: (a) to provide users with a yardstick with which to assess the degree of trust that can be placed in computer systems for the secure processing of classified or other sensitive information; (b) to provide guidance to manufacturers as to what to build into their new, widely-available trusted commercial products in order to satisfy trust requirements for sensitive applications; and (c) to provide a basis for specifying security requirements in acquisition specifications. Two types of requirements are delineated for secure processing: (a) specific security feature requirements and (b) assurance requirements. Some of the latter requirements enable evaluation personnel to determine if the required features are present and functioning as intended. The scope of these criteria is to be applied to the set of components comprising a trusted system, and is not necessarily to be applied to each system component individually. Hence, some components of a system may be completely untrusted, while others may be individually evaluated to a lower or higher evaluation class than the trusted product considered as a whole system. In trusted products at the high end of the range, the strength of the reference monitor is such that most of the components can be completely untrusted. Though the criteria are intended to be application-independent, the specific security feature requirements may have to be interpreted when applying the criteria to specific systems with their own functional requirements, applications or special environments (e.g., communications processors, process control computers, and embedded systems in general). The underlying assurance requirements can be applied across the entire spectrum of ADP system or application processing environments without special interpretation.

I'm filing the DEPARTMENT OF DEFENSE STANDARD: DEPARTMENT OF DEFENSE TRUSTED COMPUTER SYSTEM EVALUATION CRITERIA (DECEMBER l985) as a library reference to this blog site.

Update on Tuesday, August 11, 2009 at 8:46AM by Steve Holcombe

See also the NSA Rainbow Series at http://www.fas.org/irp/nsa/rainbow.htm.

Kim Cameron: Why OpenID leads to Information Cards

From Kim Cameron's short biography:

"Kim Cameron is Chief Architect of Identity in the Connected Systems Division at Microsoft, where heworks on theevolution of Active Directory, Federation Services, Identity Lifecycle Manager, CardSpace and Microsoft’s other Identity Metasystem products. "

Why OpenID leads to Information Cards (5m 41s)

President Obama's Food Safety Working Group Website

An online food safety information site for consumers and those working in the area has been set up by the White House Food Safety Working Group.

The group's charge:

To have safe food that does not cause us harm and to enhance our food safety systems by fostering coordination throughout the government including enhancing our food safety laws for the 21st century. These laws will be designed to keep the American people safe and will be enforced.

The group's commitment:

To modernize food safety by building collaborative partnerships with consumers, industry and our regulatory partners. Through a transparent process, build a food safety system that will meet the challenges posed by a global food supply in the 21st century.

The group's website: http://www.foodsafetyworkinggroup.gov/

NY Times: Its Creator Seeks an Even Wider Web

The following is an excerpt from an article published on September 15, 2008 in the Bits section of the New York Times:

The Web may seem ubiquitous to most of us, but its creator, Sir Tim Berners-Lee, keeps seeing its limitations. And he keeps trying to do something about those limitations, and make sure the Web is as open and widely accessible as possible ....

Sir Tim is now taking another step to try to extend the Web’s reach, with the establishment of the World Wide Web Foundation. Starting with a $5 million seed grant from the Knight Foundation, the new Web philanthropy will begin operations next year, and is seeking donations and volunteers. Its goal is to develop technology, tools and expertise to help bring the Web to the 80 percent of the world’s population that is not online. Market incentives alone, Sir Tim suggests, will not do the job.

For the full article, go to Its Creator Seeks an Even Wider Web.