1. Trust Elevation through Contextual Authentication Regional Arab Forum on Cybersecurity Giza (Smart Village)-Egypt, December 2011
Abbie Barbir, PhD
ITU-T SG 17 Identity Management Rapporteur
Co-chair OASIS Trust Elevation TC
Elected Member of OASIS Board of Directors

2. ITU-T Study groups (2009-2012) ITU-T Objectives
Established 17 May 1865
Decisions by consensus
Participation through national Government
Telecom does not mean that focus is only on Telecom
Develop and publish standards for global ICT interoperability
Identify areas for future standardization
Provide an effective forum for the development of international standards
Truly global public/private partnership
95% of work is done by private sector
Continuously adapting to market needs
SG 2
Service provisioning and Telecom management
SG 3
Tariff , accounting telecom economic & policy issues
SG 9
Television, sound and integrated broadband cable networks
SG 5
Environment and climate change
SG 11
Signalling requirements, protocols and test specifications
SG 13
Future networks including mobile and NGN
SG 16
Multimedia coding, systems and applications
SG 17
security, identity management (IdM) and languages

3. SG 17 Q10/17 Identity management
Interoperability of identity management
X.giim, Generic IdM interoperability mechanisms
X.1250, Baseline capabilities for enhanced global identity management trust and interoperability
X Baseline capabilities for enhanced global identity management trust and interoperability
X A framework for user control of digital identity  
X Baseline identity management terms and definitions  
X.1253 (X.idmsg), Security guidelines for identity management systems
Trust of identity management
X.EVcert, Extended validation certificate
X.eaa, Information technology – Security techniques – Entity authentication assurance
X.atag, Attribute aggregation framework
X.idmcc, Requirement of IdM in cloud computing
X.mob-id, Baseline capabilities and mechanisms of identity management for mobile applications and environment
X.oitf, Open identity trust framework
Discovery of of identity management information
X.discovery, Discovery of identity management information
Protection of personally identifiable information
X.1275, Guidelines on protection of personally identifiable information in the application of RFID technology
X.priva, Criteria for assessing the level of protection for personally identifiable information in identity management
Working with OASIS SAML 2.0 and XACML and their equivalent ITU-T recommendations

4. Q10/17 Coordination and collaboration
ITU-T Joint coordination activity in IdM JCA-IdM

5. OASIS Trust Elevation TC
OASIS Electronic Identity Credential Trust Elevation Methods (Trust Elevation) TC
Works to define a set of standardized protocols that service providers may use to elevate the trust in an electronic identity credential presented to them for authentication
Respond to suggestions from the public sector, including the U.S. National Strategy for Trusted Identities in Cyberspace (NSTIC).
Promotes interoperability among multiple identity providers--and among multiple identity federations and frameworks--by facilitating clear communication about common and comparable operations to present, evaluate and apply identity [data/assertions] to sets of declared authorization levels

6. National Strategy for Trusted Identities in Cyberspace (NSTIC)
Called for in President’s Cyberspace Policy Review (May2009)
Promotes the development of an online environment where individuals and organizations will be able to trust each other because they follow agreed upon standards to obtain and authenticate their digital identities
Usernames and passwords are broken
People have many different passwords
Password reused
Strong passwords vulnerable
Identity Theft on the rise
Large increase in financial institution Suspicious Activities
$17.3 billion estimated cost to economy over 2 years (BJS,2008)
Cybercrime is on the rise
Phishing is increasing with more sophisticated attacks
Guiding Principles
Privacy Enhancing and Voluntary
Secure and Resilient
Interoperable
Cost Effective
Easy To Use
Main issue
How to verify the Carbon entity on the other end of an online transactions
Identities are difficult to verify over the internet
Problem is more complicated in North America due to the lack of a government based national identity system

7. Entity Authentication Assurance
Entity Authentication Assurance Framework*
Joint work of ISO JTC1/SC 27/WG5 and ITU-T SG 17/Q.10
Expected to reach Committee Draft status this year
Standardizes Levels of Assurance (LoAs) to promote trust, improve interoperability, and facilitate identity federation across organizations
ISO/IEC | ITU-T X.1254 provides a framework for managing entity authentication assurance in a given context. In particular, it:
specifies four levels of entity authentication assurance;
specifies criteria and guidelines for each of the four levels of entity authentication assurance;
provides guidance concerning controls that should be used to mitigate authentication threats;
provides guidance for mapping the four levels of assurance to other authentication assurance schemes;
provides guidance for exchanging the results of authentication that are based on the four levels of assurance.
Level
Description 1
Little confidence the asserted identity 2
Some confidence in the asserted identity 3
High confidence in asserted identity 4
Very High confidence in asserted identity

8. Entity Authentication Assurance
Why so the work?
Provides a consistent basis for trust
Promotes identity federation
Helps organizations make informed decisions
Enables credential re-use in different contexts
Promotes efficiency and reduces costs
Enables cross-organization and cross-border services
Provides framework for further standardization
Federal Financial Institutions Examination Council (FFIEC)

9. Entity Authentication Assurance
Structure and Contents
Four Levels of Assurance
Entity Authentication Assurance Framework
Management and Organizational Considerations
Threats Based on Framework Components
Required Controls for Each LoA
Privacy and Protection of PII
Operational Service Assurance Criteria

10. scope boundary of this standard Rights, Access Controls, etc.
EAA Framework
scope boundary of this standard
Proofing
Rights, Access Controls, etc.
Authorization
Risk Assessment
LoA Selection
Application / Initiation
Verification
Registration
Enrollment
Usage
Record- Keeping
Authentication
Credential Management
Binding
Revocation
Issuance 10 10

11. Authentication Towards Digital Trust
FFIEC Supplement to Authentication in an Internet Banking Environment
Layered Security to eliminate Customer Authentication for High-Risk Transactions
Retail/Consumer and Business/Commercial Banking
Detect and Respond to Suspicious Activity
Device Identification
Challenge Questions (KBA)
False Sense of Security
Need to move away from it
Federal Financial Institutions Examination Council (FFIEC)

12. More on Authentication
How to define Authentication Strength ?
Simply counting authentication factors
Something
you know
you have
you are (or inherit )
does not inform us about the strength of a given authentication method
Authentication methods can be based on a single authentication attribute or on any two or more attributes of different kinds
Many vendors and enterprises do not implement true two-factor authentication and do not have a consistent definition of the term.
Consider measuring a method strength to attacks, for example:
Masquerade attacks and man-in-the browser attack
Evaluate the strength of an authentication method to confirm that it meets the needs for assurance or authorizations request.
Based on Gardner paper G

13. Device Identifications
From Smart Device perspectives
Cookies are increasingly becoming obsolete for device and user identification
IP address is not reliable
Different Approaches are used
Identification in Browser based technologies (SAML, OpenID) is different from Native Application (Aouth2.0 and OpenID connect)
Standards are needed
Need to move towards interoperable cookie-less device independent identification methods in order to prevent fraud in financial transactions
Support for cloud based interactions
Support for interoperable token based services
“one-time” cookies
Eventually  every device needs an immutable, provision-able, isolated  NVM to store its identity
Programmable RD/WR/OTP/ERASE capable
Scalable cross devices (power, form factor, standard)
Ultimately needs to have appropriate crypto support

14. Current Basic “Trust Triangle”
User has direct trust relationship with IDSP and RP
How can the IDSP and RP trust each other?
* Source OIX

15. Should we have Trust in Trust Frameworks
Key question how much do we trust the identity enrolment stage
Do we Trust Breeder Documents and verification process?
The Elephant in the room; The rise of Synthetic ID
So what are Synthetic ID?
Synthetic identity happens when a criminal steals bits and pieces of info from different people and creates a new identity with No Carbon Copy.
A social security number is used with a different name and date of birth.
Difficult to detect because of all the mismatched pieces of information.
Criminals are getting bold
Trend to claim ID Theft as opposed to account busting
Need better means of validating breeder documents
Not all breeder documents are Trustable

16. Directions Some Pain Points
Internet transactions are anonymous (low trust)
Value transactions are identity based
Anonymous to identity enabled
Need strong authentication and contextual identification of identities
Enable Identity based systems
while protecting privacy (PII)
Isolation of Issuer and target Identity
Enable the right to forget
Identity dashboard for user to keep control identity and related data (Data Ownership)
Consumer Protection and Identity Service Provider Liabilities
Audit, compliance and policy enforcement
And yes…..Simple to use system

17. Current Trends
OIDF WG on Street Identity (see )
OAuth2 and OpenID Connect
Focus on Eliminating password reuse (one password)
Identity verification
Use of Relationship Manager or Attribute provider to share legal identity (name/address) with a requesting party
Toward Strong authentication
Secure the "one password" with additional protection
Potentially the use of Secure Vault technology in devices an immutable, provision-able, isolated  NVM to store its identity
Programmable RD/WR/OTP/ERASE capable
Scalable cross devices (power, form factor, standard)
Ultimately needs to have appropriate crypto support

18. Q&A