Building Standards for "Trustable" ID Providers
Issue/Topic: Building Standards for “Trustable” ID Providers (T3D)
Session: Day – Number - Space Location Thu 9/9 - 3 - D
Convener: Jay Unger
Notes-taker(s): Jay Unger
Attendees: Name Affiliation Ty Stahl Oracle Barb Flanagan Trufina Jay Unger Independent Consultant
Tags for the session - technology discussed/ideas considered:
OpenID, Identity Provider, Trust, Limited Authority Stroage, Trusted Computing
Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:
There being only 3 attendees including the facilitator this session was more of discussion about various “trust” issues associated with identity.
The session was opened with a discussion by the facilitator of his desire to find a technical means for building an ID Provider that could be trusted by users with their identity attributes because the mechanisms used to store, maintain and present those attributes fundamentally protected the attribute data from disclosure to anyone (even the IdP) without expressed permission from the user.
The facilitator asserted that mechanism like “least authority” storage systems and “trusted computing” could be used to create an implementation where stored attributes could only be accessed by a relying party that the user designated and only then with appropriate decryption keys supplied by the user.
The representative from Trufina described that systems role as both an attribute provider and attribute proofing service that uses third party data and means to verify and vet attributes originally asserted by the user. We also briefly discussed the “liability” model associated with an attribute provider and proofing service attesting that attributes “vetted” using third party data carried.