# Presentation: 783931

## e-Authentication Initiative Where we are, how we arrived

- Steve Timchak
- eAuthentication
- Program Manager

- November 21, 2002

**Notes:**
Photo of a rusted lock in the left margin.

## President’s Management Agenda

- 1st Priority: Make Government citizen-centered
- 5 Key Government-wide Initiatives:
- 1. Strategic Management of
-     Human Capital
- 2. Improved Financial Performance
- 3. Expanded Competitive Sourcing
- 4. _Electronic Government_
- 5. Budget and Performance
-     Integration

**Notes:**
Photo of a rusted key in the left margin.  This photo will appear in all of the slides.
Photo of President Bush speaking in the right margin.

## e-Authentication Initiative Mission:

- 	Public Trust in the security of information exchanged over the internet plays a vital role in the e-Gov transformation.  The e-Authentication Initiative makes this trust possible.

**Notes:**
Strong Authentication Polices, Standards, and products exist in both the Federal Government and Industry Arena.  However, there currently are no polices or standards available for “less than strong” .  It is our mission to help develop, define, and procure these tools.

## e-Authentication InitiativeGoals:

- To build and enable mutual trust needed to support wide spread use of electronic interactions between the public and Government, and across Governments
- To minimize the burden on public when obtaining trusted electronic services from the Government, and across the governments
- To deliver common interoperable authentication solutions, ensuring they are an appropriate match for the levels of risk and business needs of each e-Government initiative

## Citizen Value – Trusted, consistent method of proving identity to the federal government, and protection of the confidentiality and sensitivity of data
Government Value – Provide advanced authentication capabilities, reducing redundant costs and cycle times for individual agencies requiring authentication solutions

- _Government Value_ – Provide advanced authentication capabilities, reducing redundant costs and cycle times for individual agencies requiring authentication solutions

- e-Authentication Initiative Value Proposition:

## The Challenge to Interoperability

- Authentication interoperability becomes much more complex as the number of credential providers and relying parties increases.

**Notes:**
Picture of seven Federal buildings (clip art) all interfacing (via arrows) with each other.
Each of the seven Federal buildings has four PCs connected.

## The Need for the Authentication Gateway

-   The Authentication Gateway simplifies interoperability:
-   Common way to determine and validate “Trusted” 	credentials
-   “Common  Rules” for Agreements among Gateway, 	Agencies and Credential Providers.

- Credential Providers

- Authentication Gateway

- Relying Parties

**Notes:**
The top row has five Federal buildings (clip art) that are labeled as Credential Providers are interfacing with the Authentication Gateway (via arrows).
The bottom row has the Authentication Gateway interfacing (via arrows) five Federal buildings (clip art) that are labeled as Relying Parties.

## Defining the Need

- Privilege Management

- e-Gov Initiatives

**Signature**
**Required**

**Identity**
**Verification**
**Required**

**Identity**
**Verification**
**Not Required**

**Low Risk**

**High Risk**

**General**
**Information**

**Change**
**Request**

**Benefits**
**Application**

**Personal**
**Information**

**Proprietary**
**Information**

**Notes:**
An arrow labeled “e-Gov Initiatives” going from left (Low Risk) to right (High Risk).

## A Vision for the Future

- eAuthentication
- Gateway

- Identity
- Verification
- Required

- Identity
- Verification
- Not Required

**Federal Agency**
**Relying Parties**

**Credential**
**Providers**

- Credential
- Validation
- Process

**Notes:**
This is our vision of the eAuthentication Gateway and how it will work with first gov.  The Credential Providers includes use of the ACES program, NFC’s PKI Infrastructure and the Federal Bridge.  This also acknowledges States that have currently set up their own Authentication Tools.

This has Citizen (men & women clip art) interfacing with:
Agent (a woman talking to a man), the FIRSTGOV logo, the Social Security Administration logo, the USDA logo, and the Department of Health & Human Services logo.
It also has Business (skyscrapers clip art) interfacing with the Agent (a woman talking to a man).
Both the Agent and the Business interface with the FIRSTGOV logo.
The FIRSTGOV logo interfaces with the eAuthentication Gateway (Gate & Guard Rails clip art).
The eAuthentication Gateway interfaces with State of Federal Government (Statue of Liberty, skyscrapers clip art), Health Care and Academia (school clip art).

## The e-Authentication Gateway

**Is not:**
- An issuer of ID credentials
- A collector of personal information
- A repository of information** **
- The Federal Bridge Certification Authority
- e-Security
**Is: **
- A provider of validation services for multiple forms of ID credentials
- A source of risk/assurance levels for multiple forms of ID credentials
- Available for all e-Gov initiatives

## Accomplishments in FY02:

-  Obtained e-Gov Funding
-  President’s Management Council oversight
-  e-RA process developed & implemented
-  Policy and Privacy groundwork laid
-  Communications strategy developed
-  Gateway Development Team created
-  Target applications identified(ongoing)
-  Prototype R&D lab setup
-  Industry RFI released
-  Gateway Prototype IATO received

## e-Authentication in FY03:

-  Complete e-RAs for remaining e-Gov initiatives
-  O&M on prototype Gateway
-  Obtain authority to operate in “live environment”
-  Obtain Acquisition Plan approval
-  Select Government-wide Agency Contract (GWAC)
-  Design, build, test, C&A, cutover production GW
-  Integrate e-Gov applications
-  Establish requirements for ECPs to interface to GW
-  Consummate agreements with ECPs
** ****Plan for common authentication service ****	****across government**

## How We Got Here:  Requirements Development Process

- How We Got Here:  Requirements Development Process

- May          Present

- May          June

- August

- June          Present

- E-Authentication Gateway Requirements

- Proof of Concept

- Technical

- Policy

- Acquisition

**Notes:**
The top row has a green box labeled “E-Authentication Initial Gateway Concepts Briefings and Papers” with a green arrow pointing downward.
The middle row has five tan boxes and five tan arrows pointing downward labeled:
“Vendor Technical Meetings, Technical Exchange/Industry Day, Policy Guidance Meeting, Partner Briefings, and Request for Information”.
The bottom row has three pink boxes and three pink arrows pointing downward labeled:
“Technical Proof of Concept, Policy, and Acquisition”.

## Status of E-Authentication Program

- R&D has shown that the E-Auth industry is currently:
- Enterprise-based rather than inter-enterprise
- Centrally managed rather than distributed
- Proprietary solutions rather than open
- Priced for the enterprise rather than multi-enterprise
- The RFI responses and other research has shown that the E-Auth industry is:
- Adopting federated solutions
- Evolving to distributed management
- Utilizing open standards
- Adapting pricing to multi-enterprise solutions
- Agency E-Gov systems are becoming ready to utilize a common open, standards-based e-Auth infrastructure

## e-Authentication in FY03 –Message to Industry

- _Research and development will continue through MTS to evaluate open, standards based cross domain solutions_
- Proprietary solutions will be evaluated _only_ if an agency application needs that particular solution
- Procurement planned for completion: this may include use of performance based contracting, share in savings concepts, public/private partnership and other forward looking contracting methods
- Government has applied to join the Liberty Alliance and seeks to drive open solutions

## e-AuthenticationMessage to Government:

- Prototype Gateway is operational in a test environment as of 9/30/02
- It will undergo a delta certification and accreditation (C&A) for live transactions by 01/06/03
- Gateway will provide authentication and verification services to the 24 e-Gov initiatives
- Gateway will provide authentication services across Government lines of business
- E-Authentication team is ready to discuss your authentication needs _**NOW!!!!**_

## e-Authentication - Early Adopters

- _Agency_		_Application_ 		_Credential_
- USDA NFC		WebStar		PKI & P/P
- GSA			ACMIS			OPM E/E
- FEMA 			DMI			PKI
- Treasury		SSA			Pay.Gov
- GSA			3GS			TBD
- SSA			Secure File Xfer	PKI ACES
- NDGRO		Seed/Agriculture	WebCAAF
- 	THANKS!

## e-Authentication - Summary

- Authentication Gateway capability exists in FY03
- Acquisition of production Gateway services will be conducted early in 2Q03
- Draft Statement of Objectives may be released in December 	02
- Industry is proprietary, enterprise solutions
- e-Authentication is a very large enterprise
- Industry is moving towards open solutions
- No FY03 funding has been received
- E-Gov applications and others can be interfaced to the Gateway at this time

## e-Authentication Points of Contact:

-  Steve Timchak, Program Manager
- 703-872-8604; stephen.timchak@gsa.gov
-  Adrian Fish, Deputy PM
- 703-872-8632; adrian.fish@gsa.gov
-  Terri Hobson, Applications Manager
- 703-872-8605; terri.hobson@gsa.gov
-  Mark Liegey, Risk Assessment Team Lead
- 	 703-872-8614; mark.liegey@gsa.gov
-  Tice DeYoung, Architecture Team Lead
- 703-872-8615; tice.deyoung@gsa.gov