Information Card

I-cards shown in Windows CardSpace Identity Selector

Information Cards are personal digital identities that people can use online, and the key component of Identity Metasystem. Visually, each i-card has a card-shaped picture and a card name associated with it that enable people to organize their digital identities and to easily select one they want to use for any given interaction. The Information Card metaphor is implemented by Identity Selectors like Windows CardSpace, DigitalMe or Higgins Identity Selector.

The Identity Metasystem is an interoperable architecture for digital identity that enables people to have and employ a collection of digital identities based on multiple underlying technologies, implementations, and providers. Using this approach, customers can continue to use their existing identity infrastructure investments, choose the identity technology that works best for them, and more easily migrate from old technologies to new technologies without sacrificing interoperability with others. The Identity Metasystem is based upon the principles in The Laws of Identity.

Overview

Information Cards shown in DigitalMe Identity Selector

There are three participants in digital identity interactions using Information Cards:

Selectors

Microsoft's Windows CardSpace implementation of an Identity Selector

An Identity Selector is used to store, manage, and use their digital identities. Examples of Identity Selectors are Microsoft's Windows CardSpace, the Bandit Project's DigitalMe, and several kinds of Identity Selectors from the Eclipse Foundation's Higgins project.

An Identity Selector performs the following user-centric identity management tasks:

An Identity Selector may also allow the user to manage (e.g. create, review, update, and delete cards within) their portfolio of i-cards.

Identity Metasystem

There are five key components to the Identity Metasystem:

Generic qualities

Sign-in capabilities

The graphic used to indicate Information Card support

Using i-cards, users can authenticate without needing a username and password for every web site; instead, at sites accepting them, they can log in with an i-card, which may be used at multiple sites.

Each Information Card utilizes a distinct pair-wise digital key for every realm where a key is requested. A realm may be a single site or a set of related sites all sharing the same target scope information when requesting an Information Card. The use of distinct pair-wise keys per realm means that even if a person is tricked into logging into an imposter site with an i-card, a different key would be used at that site than the site that the imposter was trying to impersonate; no shared secret is released.

Furthermore, many Identity Selectors provide a means of Phishing detection, where the HTTPS certificate of the Relying Party site is checked and compared against a list of the sites at which the user has previously used an Information Card. When a new site is visited, the user is informed that they have not previously used a card there.

Types of i-cards

The Identity Selector Interoperability Profile v 1.5 (or OASIS IMI v1.0 Committee Draft) specifies two types of Information Cards that an Identity Selector must support.

The Higgins project is defining two new kinds of i-cards as well:

However the Information Card format allows for custom types; The Bandit project demonstrated prototype managed cards backed by OpenIDs at the BrainShare conference in March 2007.

Personal cards

The first kind of personal Information cards were also introduced as part of Microsoft’s Windows CardSpace software in November 2006. Their behavior is also defined by the same documents covering the Microsoft-defined managed cards (see above).

Summary of characteristics:

Managed information cards

The first kind of managed card was introduced as part of Microsoft’s Windows CardSpace software in November 2006. The behavior, file format and interoperability characteristics of these kinds of managed cards are defined by Microsoft documents such as the Identity Selector Interoperability Profile v 1.5 (or OASIS IMI v1.0 Committee Draft; see here for a more complete list), in combination with open standards including WS-Trust and others.

Summary of characteristics:

I-cards issued by third parties can employ any of four methods for the user to authenticate himself as the card owner:

Additional methods could also be implemented by future Identity Selectors and Identity Providers.

Managed i-cards can be auditing, non-auditing, or auditing-optional:

Relationship cards

Relationship cards are under development by the Higgins project (see the report by Paul Trevithick).

Summary of characteristics:

Reliance on the Higgins Data Model

Conceptually a managed card is essentially a human-friendly "pointer" to a Token Service—a web service (e.g. a STS) from which security tokens can be requested. A security token is a set of attribute assertions (aka claims) about some party that is cryptographically signed by the issuer (the token service acting as the authority). An r-card, contains a second "pointer" that points to a data entity whose attribute's values (i) shared by all parties to the r-card and (ii) form the underlying attributes that are consumed by the r-card issuer's STS and provide the values of the claims that this STS makes. By including this second "pointer" on the r-card, r-card holders have the potential to access and update some subset of these underlying attributes. The card issuer maintains an access control policy to control who has what level of access.

This second pointer is an Entity UDI—a reference to an Entity object in the Higgins Context Data Model. Entity UDIs may be dereferenced and the underlying Entity's attributes accessed by using the Higgins project's Identity Attribute Service.[1] Once resolved, consumers of this service can inspect, and potentially modify the attributes of the entity as well as get its schema as described in Web Ontology Language (OWL).

In addition to basic identity attribute values like strings and numbers, the data entity referred to by an r-card can have complex attribute values consisting of aggregates of basic attribute types as well as UDI links to other entities.

Claims

Beyond being used to log in to sites, Information Cards can also facilitate other kinds of interactions. The Information Card model provides great flexibility because cards can be used to convey any information from an Identity Provider to a Relying Party that makes sense to both of them and that the person is willing to release. The data elements carried in i-cards are called Claims.

One possible use of claims is online age verification, with Identity Providers providing proof-of-age cards, and RPs accepting them for purposes such as online wine sales; other attributes could be verified as well. Another is online payment, where merchants could accept online payment cards from payment issuers, containing only the minimal information needed to facilitate payment. Role statements carried by claims can be used for access control decisions by Relying Parties.

Interoperability and licensing

The protocols needed to build Identity Metasystem components can be used by anyone for any purpose with no licensing cost and interoperable implementations can be built using only publicly available documentation. Patent promises have been issued by Microsoft, IBM, and others ensuring that the protocols underlying the Identity Metasystem can be freely used by all.

The Information Cards defined by the Identity Selector Interoperability Profile v 1.5 (or OASIS IMI v1.0 Committee Draft) are based on open, interoperable communication standards. Interoperable i-card components have been built by dozens of companies and projects for platforms including Windows, Mac OS, and Linux, plus a prototype implementation for phones. Together, these components implement an interoperable Identity Metasystem. Information Cards can be used to provide identities both for Web sites and Web Services applications.

Several interoperability testing events for i-cards have been sponsored by OSIS and the Burton Group, one was at the Interop at the October 2007 European Catalyst Conference in Barcelona and the most recent was at RSA 2008. These events are helping to ensure that the different Information Card software components being built by the numerous participants in the Identity Metasystem work well together.

The protocols needed to build Information Card implementations based on the Identity Selector Interoperability Profile v 1.5 (or OASIS IMI v1.0 Committee Draft) can be used by anyone for any purpose at no cost and interoperable implementations can be built using only publicly available documentation. Patent promises have been issued by Microsoft, IBM, and others, ensuring that this Information Card technology is freely available to all.

In June 2008, industry leaders including Equifax, Google, Microsoft, Novell, Oracle, PayPal and others created the Information Card Foundation in order to advance the use of the Information Card metaphor as a key component of an open, interoperable, royalty-free, user-centric identity layer spanning both the enterprise and the Internet.

In his report on the Interop at the June 2007 Catalyst Conference in San Francisco, analyst Bob Blakley wrote:

The interop event was a milestone in the maturation of user-centric identity technology. Prior to the event, there were some specifications, one commercial product, and a number of open-source projects. After the event, it can accurately be said that there is a running Identity Metasystem.

History of the terminology

The term "information card" was introduced by Microsoft in May 2005 as a name for the visual information card metaphor to be introduced in its forthcoming Windows CardSpace software. Until early 2006, information cards were also sometimes referred to by the code-name “InfoCard”, which was not a name that was freely available for all to use. The name information card was specifically chosen as one that would be freely available for all to use, independent of any product or implementation. The name “information card” is not trademarked and is so generic as to not be trademarkable.

The term i-card was introduced at the June 21, 2006, Berkman/MIT Identity Mashup conference.[2][3] The intent was to define a term that was not associated with any industry TM or other IP or artifact. At the time, Microsoft had not yet finished applying the Open Specification Promise to the protocols underlying Windows CardSpace and there was also a misunderstanding that the term information card was not freely available for use by all, so to be conservative, the term i-card was introduced.

Mike Jones, of Microsoft, explained to participants of a session at IIW 2007b that Microsoft always intended the term information card to be used generically to describe all kinds of information cards and to be freely usable by all, and tried to correct the earlier misunderstanding that the term might apply only to the kinds of information cards originally defined by Microsoft. He made the case that the industry would be better served by having everyone use the common term information card, than having two terms in use with the same meaning, since there remains no legal or technical reason for different terms. In this case the term i-card would become just the short form of information card, just like e-mail has become the short form of electronic mail.

Software implementations

See also

References

  1. ↑ IdAS
  2. ↑ MIT Identity Mashup conference meeting notes
  3. ↑ Drummond Reed's blog post

Additional resources

External links

This article is issued from Wikipedia - version of the 9/10/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.