# Presentation: 439250

## eXtensible Name ServiceHow XNS provides Web Identity

- A briefing from OneName Corporation
- December, 2001

## Topics

- The XNS protocol for Web identity services
- Extending enterprise identity to Web identity
- The fit between XNS and enterprise SSO
- The fit between XNS and enterprise PKI

## Slide 3

## eXtensible Name Service (XNS)

- An open protocol for Web Identity Services based on XML and web agent linking (publication in Feb 2002)
- Protocol to be managed by XNSORG (non-profit)
- 12 web services specified in WSDL 1.1 and XML Schemas 1.0
- XNS marries the emerging XML trust standards (XML Signatures, XML Encryption, SAML, XKMS) with the power of Web identity architecture
- Describes the metastructure of identity agent documents, links, contracts, and messages
- Fully distributed and federated just like DNS
- Includes both name and ID services for lifetime persistence of identities and links

## XNS in the Internet protocol stack

- Internet Standards(IETF)

- Web Standards( W3C, IETF)

**Names and addresses for**
**real world identity**

- DNS Governance(ICANN)

**XNS Governance****(XNSORG)**

**The Web Services Layer**

**Web Services **
**Standards**
**(ebXML, W3C)**

**IP**

**TCP**

**Caching**

**HTML / HTTP**

**XML / XMLP**

**DNS**

**XNS**

- IP Governance(IANA)

***XNS is to Web Services what DNS is to the Web***

## The evolution of Web identity (step 1)

- Millions of files were available on Internet-connected enterprise file servers but there was no common way to view, access, or link them.

- The force that drove the Web was the elevation of content to a logical level of representation (HTML) and access (HTTP). Now it could be linked (using URIs) across web servers regardless of the physical system on which it was stored. The rest is history.

*Content*

## The evolution of Web identity (step 2)

- Today enterprise identity is in the same predicament as enterprise content was ten years ago. It is constrained by the organizational, access, and adminis-trative requirements of enterprise directory servers. Sharing identity across domains is as difficult as sharing files across domains was in 1990.

*Relationships*

*Content*

## The evolution of Web identity (step 3)

*Relationships*

- By abstracting identity to the logical level, web identity agents and identity servers solve the identity sharing problem the same way the Web solved the problem of content sharing. In addition, web identity can leverage the logical viewing layer provided by the Web.

*Content*

## A Web of identity

**A Web of identity**

- Customer

**Primary****Personal Agent**

**Extended Personal ****Agent**

**Identity Server****(i.e. Bank)**

**Identity Server****(i.e. HMO)**

**Identity Server****(Merchant)**

**Extended Personal Agent**

- Web identity agents represent either people or businesses.  Links are formed automatically as transactions take place. Any agent can form a link with any other agent – web identity makes the agent document’s physical location as trans-parent as the physical location of a document on the Web.

- A single logical identity can be represented by linking multiple agent documents in different domains. These are called *extended agents*.

## Web agent linking

**Identity Server**

**Agent Document**

**Identity Data**

**Link**

**Contract**

**Permissions**

**Contract**

**Permissions**

**Identity Server**

**Agent Document**

**Identity Data**

**Link**

**Contract**

**Permissions**

**Contract**

**Permissions**

**Trusted ****“Pipe”**

- Identity servers host XML documents representing data associated with an identity. These documents can be “virtual”, i.e., the phys-ical data can be stored in lower-layer systems.

- Each link with another agent is defined by a subdocument inside the agent document.

- A link can contain any number of contracts, each defining a set of data shared with the other agent and the applicable security, privacy, and synchro-nization permissions.

- Links create trusted, bidirectional data “pipes” between any two systems or web services.

## XNS Contract Negotiation

- In XNS any agent (Business or Personal) can exchange a contract with any other agent
- Version 1
- Only Business Agent owners can can serve contracts
- Future Versions
- Either Agent owner can serve the contract

## XNS Base Services

**Negotiation**

**Reputation**

**Certification**

**Session**

**Authentication**

**Introduction**

**Folder**

**Naming**

**ID**

**Registration Services**

**Assertion Services**

**Transaction Services**

- Create, update, or delete a contract

- Link to a reputation agent

- Link to a certifying agent

- Persist an authentication assertion

- Assert an identity

- Propose a contract between two other agents

- Manage folders

- Register a name (human-readable address)

- Register an ID (immutable address)

**Location**

- Resolve an ID to a network location

**Management Services**

**Service**

**Category**

**Action in the Agent Document**

**Hosting**

- Create, delete, move agents

**Data**

- Get/set schema definitions and instances

**Notification**

- Event triggers and notifications

**Discovery**

**Core**

**Introspection Services**

- Introspection of XNS service & schema defs

- Defines XNS base schemas

**Directory**

- Listing and searching of XNS agents

**1.0**

**Future**

**1.0**

**1.0**

**1.0**

**Future**

**1.0**

**1.0**

**1.0**

**1.0**

**Spec**

**1.0**

**1.0**

**Future**

**1.0**

**1.0**

**Future**

## Web identity: beyond enterprise identity management

## Identity Today

- Identity is usually established through an enterprise directory, security, or application domain
- The root of enterprise identity is most commonly a directory entry in an X.500 tree
- Enterprise identity is extended by:
- Adding attributes (instances of directory schemas)
- Adding references to other directory entries (groups or roles)

## The overarching problem with today’s identity solutions

- It is always relative to one directory context
- Extending enterprise identity requires mapping it to other directory contexts
- Two common approaches to this problem:
- Metadirectory – a higher-level directory
- Affiliates –hard-wired connections between trusted domains
- Neither solves the “n-wise” problem – the number of mappings grows exponentially as you scale

## Additional problems with identity

- Besides one directory context, enterprise identity is also limited to:
- One security context
- One privacy context
- One administrative context
- Thus enterprise identity cannot provide for:
- Persistence outside these contexts
- Transactions outside these contexts
- Administration outside these contexts

## The challenge

- Web Services requires:
- Persistent, unified identity independent of location, network, or device
- Seamless transactions across trust domains
- Strong protection of security and privacy
- Enterprise identity solutions cannot provide this because they are context-dependent
- In short, Web Services requires a Web identity architecture

## Web identity

- Web identity has one context: global
- Web identity solves the n-wise mapping problem by abstracting identity to a logical level
- Web identity agents map logical Web identity to physical enterprise identity
- Maintaining this mapping automatically is the magic of web agent linking technology
- Web agent linking also manages the hard security, privacy, and administration problems

## Benefits of the XNS standard for Web Identity Services

**Lifetime Synchronized Connections**

**Smart Personalized Transactions **

**Strong Privacy**

**Strong Security**

**Unified****Identity**

- Identity Owner

**Unified, lifetime Web identity**

**Permissions, negotiations, enforceable contracts**

**Automatically negotiated**  **transactions, e.g., e-payment**

**Persistent relationships, automated updates**

**Authentication, authorization, SSO, Web PKI, reputation**** **

## Web PKI

- Web Identity for SSO is only the first step towards rich Web identity services
- Web PKI is the second step
- XNS web identity agents and web agent linking provides the infrastructure for both
- XNS marries the emerging XML trust standards (XML Signatures, XML Encryption, SAML, XKMS) with the power of Web identity architecture and agent linking

## The XNS Security Services Layer

- Enterprise SSO solutions offer:
- SSO within one trust domain or directly affiliated trust domains
- Policy-based authorization
- Delegated authorization management
- XNS Offers:
- Web SSO (SSO across all domains)
- Web PKI (automated key and signature management across all domains)

- Lifetime Connections

- Smart Transactions

- Privacy

- Security

- Identity

**Authentication**

**Session**

**Certification**

**Reputation**

- EnterpriseSSOProducts

## XNS overcomes the three major barriers to Web PKI

- Interoperability
- XNS establishes a globally interoperable, fully distributed, open web service for PKI
- XNS provides a common protocol for RA and CA services
- Identity Management
- PKI requires identity assertions
- PKI has never had a directory-independent web identity service for a foundation
- Key Management
- XNS negotiation automates key and certificate management
- XNS negotiation automates applying & verifying digital sig’s
- XNS agent linking solves the CRL problem

## XNS key management

- Certifying Authority (CA)

- Customer

- Merchant

- Key Generation & Certification
- Key Exchange
- Key Verification
- Key Revocation

***XNS is the only globally interoperable solution to automated key management:***

**XNS key management**

## Web identity service components

**Web Portal**

**Enterprise Security Server****(e.g., Netegrity)**

**Enterprise Directory Server ****(e.g., iPlanet)**

**LDAP Adapter**

**Connector**

**Other XNS Server**

- AgentDocument(XML)

**Custom Service**

- AgentDocument(XML)

- AgentDocument(XML)

- AgentDocument(XML)

**Custom Service**

**Custom Service**

**XNS****Identity Server**

**SAML Adapter**

**Connector**

**HTML Exposure**

**Firewall**

**XNS Base Services**

**Wireless Portal**

**Connector**

**Connector**

**WML Exposure**

**Other Application**

**Connector**

**Connector**

**SOAP Exposure**

**Connector**

**Connector**

## Summary

- Web identity is global; it will do for people and businesses what the Web did for documents
- The key to Web identity is a common protocol for Web identity agents and web agent linking XNS is a protocol that will do for Web Services what DNS did for the Web
- Web identity layers over enterprise identity the way web servers layered over file servers
- XNS marries the emerging XML trust standards (XML Signatures, XML Encryption, SAML, XKMS) with the power of Web identity architecture

## Further Reading

- XNS Public Trust Organization
- www.xns.org
- OneName Corporation
- www.onename.com