# Presentation: 025272

## David TemoshokDirector, Identity Policy/ManagementGSA Office of  Governmentwide Policy November 21, 2002

**Authentication:  The Need for Trusted Credentials**

**David Temoshok****Director, Identity Policy/Management****GSA Office of  Governmentwide Policy ****November 21, 2002**

**E****-Authentication*****Making Trust Possible***

**Notes:**
Logo: USA flag

## Defining Identity Management

- A set of policies and supporting processes and infrastructure, for the creation, maintenance, and use of identities and their attributes, credentials, and entitlements
- Involves policy,  technology *and* process
- Must enable enterprises to create a manageable life cycle
- Must scale from internally facing systems to externally facing applications and processes
- Goal state: general-purpose infrastructure and authoritative sources, clean integration across people, process, and technology

## The Challenge for Identity Management

- Today’s identity management systems are ad hocracies, built one application or system at a time
- Apps, databases, OSes lack a scalable, holistic means of managing identity, credentials, policy across boundaries
- Fragmented identity infrastructure: Overlapping repositories, inconsistent policy frameworks, process discontinuities
- Error prone, creates security loopholes, expensive to manage
- The disappearing perimeter has put identity on the front burner
- Infrastructure requirements: extend reach and range
- Increased scalability, lower costs
- Balance of centralized and distributed management
- Infrastructure must become more general-purpose and re-usable

## Gateway Authentication Support for e-Gov Services

**Authentication:  **The process by which an entity (such as a person or a computer system)  determines whether another entity is who it claims to be.
**Authentication **is different from** *****authorization******.*****   **
- Proper authentication ensures that a person is who he or she claims to be, but it says nothing about the access rights of the individual
- Authorization grants access rights, but says nothing about who you are.
- The Gateway provides for authentication, not authorization.

## U.S. Identity Credentials -How do we know who you are?

***Personal Information***
- Address - Home, Business
- Telephone - Home, Business
- Mobile
- Genealogy - Parents, Relatives
- References - Friends, Associates
- Employment - past/present

***Out of Wallet Information***
- User ID, Passwords
- Recent Transactions

***Public ID***
- Commercial Digital Certificate
- Loyalty Cards
- Civic, Community - Library

***Government ID/Credentials***
- Birth Certificate
- Social Security Number
- Passport
- Drivers License/ID
- Taxpayer/employer ID
- Immigration Identification
- Military Service Number

***Material Relationships***
_**Financial Services**_
- Bank accounts
- Credit card accounts
- Loan accounts
- Insurance
- Investment accounts
_**Tax Authorities**_
- Federal, State, local
_**Asset Ownership**_
- Vehicles
- Real estate
_**Other**_
- Utilities
- Education, Civic groups

**Notes:**
Picture of a man.

## Identity Management Communities -Who do you Trust?

- DMV, AAMVA
- Illinois PKI
- Washington State PKI
- EBT
- Government of
- Canada and U.K.

***Higher Education***
- CREN PKI
- Higher Education
- PKI Bridge

***Healthcare***
- California Medical Association
- Med e-Pass
- WGA Health Passport

***Federal Government******  ***
- Social Security Admin.
- GSA/DOD - Common
- Access Card
- GSA - ACES
- DoD, NASA, NFC - PKI
- Transportation Security
- Administration - TWIC
- INS
- State Department
- Veterans Affairs
- Dept. Education

**Identity Management Communities -****Who do you Trust?**

***Transportation Industry***
- TWIC
- Aviation
- Maritime
- Railroad
- Trucking

- Trust Network
- (Gateway)

***Financial  Services Industry***
- Identrust/DST
- VISA/Mastercard

**Notes:**
Picture of a circle named “Trust Network (Gateway)”.

## Authentication Technologies and Credentials

_**Something you know**_** **( but a stranger is unlikely to know)
- User ID/Passwords
- Knowledge-based authentication
- Social Security Number, Password, place of birth
_**Something you possess**_
- Smart Cards - Card-Based identification
- Public Key Encryption - digital certificates
- Driver’s license, private key_** **_
_**Something you are**_
- Biometric Profiles
_**Policy-Based Credentials**_
- Public Key Encryption - digital
- 	certificates

**Notes:**
Pictures of a Health Passport ID, an infrared photo, and a picture ID with a thumb print.

## Gateway Functional Scope  in Authentication Process

**                 ****Credentials****  **
** ****Identity Documents**
** ****Biometrics**
** ****Other Credentials**

**Gateway Functional Scope  in Authentication Process**

**Enrollment**

**Verification**

**Authorization**

**Validate**
**Credentials**

**Allow or Reject**
**Transaction**

**New Credential**

** **

**Establish Level of Authorization**

** ****Authorize**
**Transaction**

**Establish Permission to Conduct **
**the Transaction, Activity or Access**

**Request Permission to Conduct **
**the Transaction, Activity or Access**

**Establish quality of credentials **

**Gateway Functional**
**Scope**

##  Transaction Focus for the Gateway 

- What credentials/level of authentication assurance are needed for the agency application?
- What credentials are needed during the transaction process?
- Are the credentials valid?
- Can credentials be effectively verified at the transaction stage?
- Can different forms of credentials be trusted for common assurance levels?

## How Well Does It Work?

- Metrics
- False Positive:  an imposter is authenticated and/or granted access to the system;
- False Negative:  a valid user is not authenticated or is denied access to the system.
- Estimated 20% of state-issued credentials are fraudulent
- Shared secrets are a problem too
- To improve the numbers and raise the assurance:
- Improved credentials
- Multi-factor authentication
- Cost becomes a major factor.

## AuthenticationCost/Risk/Benefit Analysis  

**                                           ****High**

**                                ****High**

**                  ****Medium**

**      ****Moderate**

**Low**

**Employee Screening for a High Risk Job**

**Getting an Official**
**ID **

**Applying for a Loan Online**

**Access to Protected Website**

**Surfing the Internet **

**Authentication****Cost/Risk/Benefit Analysis**

***Increased***
***$ Cost***

***Increased Need for Authentication Assurance ***

**Notes:**
Hottest news topics today is consumer privacy 

Acxiom is quickly becoming known by the consumer as a company that knows a lot about them  

Understanding Acxiom's Fair Information Practices Policies is critical to our being trusted by the consumer as a company that brings them value.  

In other words, it's just good business for us.  

## Authentication Interoperability and Federation

- What is federated identity management?
- Agreements, standards, technologies that make identity and entitlements portable across autonomous domains
- Relying parties don’t need prior knowledge of complex system internals or pair-wise mappings between systems
- Federation standards define rules that bind autonomous domains to a common method of exchanging identity information
- Federation standards provide framework for negotiating agreements, defining interactions
- Heterogeneous systems can map to the federation standards by applying transformations at the boundaries between domains
- Relying parties can honor each other’s decisions and trust each other’s assertions, but in the context of their own local policies

## Welcome to the Real World

**Unrealistic expectations are a huge problem**
- People want immediacy and safety with personal autonomy and control
- They want personalization without surveillance
- They want security and privacy without any inconvenience, loss of immediacy
**Privacy Concerns are Real**

- Credentialing generally raises privacy concerns, better credentialing makes these concerns bigger
- When are anonymity and pseudonymity  appropriate?
- Mission creep
- Basic conflict with the policy message – people are told that the key to security is less data and more control

## Going About the Job of e-Authentication   

- Authentication is very hard to do right.
- There may not be conflicts between security and privacy, but there are definitely conflicts between security and convenience.
- It is easier to create a perception of security rather than real security, and limits on credentialing complicate the process.
- Risk management requires difficult, uncomfortable cost-benefit analysis.
- Authentication processes must recognize and reflect limitations of credentialing.
- Mission creep has to be managed
- Focus on the problem we are trying to solve -- identity and access management solutions
- One tool or even one suite won’t solve all identity and access management problems
- It’s not a system, but a pervasive infrastructure
- Plan carefully, but be flexible and ready for change

## For More Information

-        **Phone                           ****	****	****E-mail**
-     David Temoshok                		_[david.temoshok@gsa.gov](mailto:david.temoshok@gsa.gov)_
-     202-208-7655

**Websites**
*http://cio.gov/eauthentication*
*http://cio.gov/fpkisc*
*http://cio.gov/fpkipa*
*http://egov.gov *

**Notes:**
Clip Art of a man talking on his cell phone above the “Phone” contact information.
Clip Art of a man typing on his keyboard that is attached to his PC above the “E-mail” contact information.