1.
Building "One Size Fits All" Identity Systems Possible or Fantasy? Ronny Bjones Security Architect Microsoft Corporate

2. Is it realistic?
Different requirements between businesses, consumers, governments, corporate users, etc
Different risk profiles implying different measures to prove (mutual) identities
Different cultural sensitivities when it comes to identities (e.g. eID)
Yet another IDA system to which we have to adapt our applications!
And what about all these different platforms?

3. Haven't we heard this before?
Passwords
Ease of use(?)
Silos, Security, Management
Microsoft Passport
SSO experience
Non Federated, Still passwords, Silo, Privacy
PKI
Federated (but with hierarchy issues)
Privacy, Complex + - + - + -

4. A new approach should…
be based on a federated model providing an SSO experience
have privacy protection build into the heart of the system
increase the overall security on the Internet, scalable according to risk model
be very easy to use by businesses and consumers
easily be integrated into services and applications

5. Identity Providers Relying Parties Identity Metasystem User
D.O.L.
Bank
Gov.
Employer
Relying Parties
Members
Only
Pet Site
Store Sites
Other Sites
Club Site
User
Medical
Card
Store Card
Insurance Card
Employee
Bank Card
DOL Card
Personal
Card
JunkCard
Identity Selector
Token Name Account Status
WS*
WEB*

6. Strong Identity and Access is Complicated
For developers
For users

7. What is Windows CardSpace?
Identity Selector for Windows
Digital identities represented by cards
When user selects a card
Get security token from Identity Provider
Give it to the Relying Party after user consent
User is in control
Security
Token
Service
User
Experience

8. Wallet Metaphor A set of claims someone makes about me
Claims are packaged as security tokens
Many identities for many uses

9. Framework for Interoperability
TCP/IP of Identities
Defined on open standards – WS*
Extended by CardSpace’s definition of CLAIMS
CardSpace is security token agnostic
SAML, Kerberos, X.509, custom
Identity Providers can bridge different identity technologies
Multiprotocol Federation Interoperability Demonstration
Burton Group – Gerry Gebel - November 1th 2005

10. Resources http://www.identityblog.com/
Laws of Identity
Identity Metasytem
Zermatt
Netfx3

11. Conclusions Identity layer on the Internet should:
Incorporate privacy, security, usability by design
Interoperability, interoperability, interoperability, …
Make live easy for developers and not raise the bar