Identity by Presence – The Death of Single Sigh On and Federated Identity

Session Topic: Identity by Presence - The Death of Single Sign On and Federated Identity

Thursday 3J

Convener: Kevin Cox

Notes-taker(s): Kevin Cox

Tags for the session - technology discussed/ideas considered:

Single Signon, Federated Identity, Identity by behaviour,

Discussion notes, key understandings, outstanding questions, observations, and, if appropriate to this discussion: action items, next steps:

This talk was a preceded in Session 1 Room I on day 3 titled “Can Identity Proofing Replace Authentication” which spoke of the need to build systems that made sense to the user. This means permissions and the underlying structure of the authentication system was apparent to the user.

This lead naturally to Welcomer which is one way such a system might be built. Also Welcomer is a method to build the backend to FIDO (IIW7 Day 2 ) and integrate the strong authentication of the person to the device. It is believed that FIDO deployment will be accelerated with a Welcomer (or similar) backend system as it solves the problem identified in the session of an easy way for a device to be the tool for multiple personas.

The Welcomer product enables the history of a user’s interactions with websites to be built up incrementally and “automatically” classified and remembered as the user interacts with different websites. This happens because each Welcomer enabled website has its own memory of user interactions. This occurs through by creating a CloudOS pico for each user/device/website interactions. User inputs at each website is put into this CloudOS pico.

In the Cloud each of these pico’s are connected through the user. That is, the links between picos is the user rather than the device and the website. This creates a network of picos for the user. It is this network of picos with pieces of memory that is the identity of the person. This approach is in contrast to the normal approach with personal clouds where most of the information is aggregated in the user’s own personal data store.

While it was not described in the talk the website can establish links between each pico on its website and with other websites it controls.

The advantages of this approach are the simplicity of implementation because there is no need to move large amounts of data around the network, to set up complicated authorization and permissioning, because everything that can be shared is stored in the pico and the user and the website have joint control over how that information is shared and each has to give permissions for transfer to occur.

The discussions were mainly around the practicalities of this approach and the difficulties of the user understanding what was happening plus the reasons on why a website would implement such a system on their website. In particular these were around different personas on the same device. However, this particular problem will be removed by the integration of FIDO with Welcomer. This was not emphasized in the talk.

In writing up these notes I realize that it is the memories of interactions with the website stored in the picos and the links between the picos that is important - not the mechanism for interaction. That is the system works if the system uses Single Signon, Respect Connect, or Federated Identity. What was being illustrated is that these other mechanisms are not needed to move data between websites under the control of the user.

In practice a website will offer the different methods for a person to announce who they are. However, it is believed that most websites will move towards FIDO plus Welcomer style backend because it is simpler for the end user and the underlying structure maps directly to the user’s experience.

The user will interact with a website and have available the previous memories of visiting the website. The permissions granted will only refer to the memories available to the person and can be fine grained. There will be no permissions granted that are not obvious to the person.

The important lessons for the presenter and was to concentrate on the “automatic” permissioning by the behavior of the person. That is, as a person moves from website to website they allow information stored on previously recently visited websites to follow them around and hence automatically grant permissions. By keeping this principle in mind the systems will be easier to understand and hence easier to use.

A blog post that expands on this issue can be found here.