Identity Management
What is it?
Why?
Responsibilities?
Bill Weems
Academic Computing
University of Texas Health Science Center at
Houston
Increasingly, people must easily
and securely exchange
information in cyberspace among
"known" individuals and to
securely access restricted
resources they “know” can be
trusted without having to struggle
with numerous and onerous
security processes.
• How do you prove you are who you say you are?
• How do you know that someone is legitimate in his or
her dealings with you, and how do you get redress if
things go wrong?
• If your identity is stolen and used fraudulently, or
personal records are altered without your knowledge or
permission, how do you prove that it was not you?
• It is difficult enough to verify someone's identity in the
tangible world where forgery, impersonation and credit
card fraud are everyday problems related to
authentication.
• Such problems take on a new dimension with the
movement from face-to-face interaction, to the faceless
interaction of cyberspace.
Identity and Authentication by Simon Rogerson
Ideally, individuals would each
like a single digital credential that
can be securely used to
authenticate his or her identity
anytime authentication of identity
is required to secure any
transaction.
UTHSC-H: An Identity Provider
(IdP)
It is critical to recognize that the university
functions as an identity provider (IdP) in
that UTHSC-H provides individuals with
digital credentials that consist of an
identifier and an authenticator. As an
IdP, the university assumes specific
responsibilities and liabilities.
Ideally, a digital credential must
• positively identify a person,
• positively identify the certifying authority i.e. the identity provider (IdP),
• be presentable only by the person it
authenticates,
• be tamper proof, and
• be accepted by all systems.
Issuing a Digital Credential
• Individual appears before an Identity Provider
(IdP) which accepts the responsibility to
– positively determine and catalog a person's uniquely
identifying physical characteristics (e.g. picture, two
fingerprints, DNA sample),
– assign a unique, everlasting digital identifier to each
person identified,
– issue each identified person a digital credential that
can only be used by that person to authenticate his
or her identity,
– maintain a defined affiliation with each individual
whereby the validity of the digital credential is
renewed at specified intervals.
Identity Vetting & Credentialing
Permanent
Identity
Database
Identity Provider
(IdP)
uth.tmc.edu
Assigns
Everlasting
Identifier
Identifier
Permanently
Bound
IdP Obtains
Physical
Characteristics
Person
Issues
Digital
Credential
Person Only
Activation
Digital Credential
Identity Vetting & Credentialing
PKI Digital ID & Strong Two Factor Authentication
Permanent
Identity
Database
Identity Provider
(IdP)
uth.tmc.edu
Assigns
Everlasting
Identifier
Identifier
Permanently
Bound
IdP Obtains
Physical
Characteristics
Person
Issues
Digital
Credential
Person Only
Activation
Digital Credential
Identity Vetting & Credentialing
UTHSC-H Two Factor Authentication
Permanent
Identity
Database
Identity Provider
(IdP)
uth.tmc.edu
Assigns
Everlasting
Identifier
IdP Obtains
Physical
Characteristics
Issues
Digital
Credential
?
?
Identifier
Permanently
Bound
Person
Person Only
Activation
Digital Credential
Identity Vetting & Credentialing
UTHSC-H Username/Password Authentication
Permanent
Identity
Database
Identity Provider
(IdP)
uth.tmc.edu
Assigns
Everlasting
Identifier
IdP Obtains
Physical
Characteristics
?
Issues
Digital
Credential
???????
Identifier
Permanently
Bound
Person
Person Only
Digital Credential
Activation
Using Network
Username
Password
Two Categories of Identity
• Physical Identity – Body Identity - Authentication
– Facial picture,
– Fingerprints
– DNA sample
• Identity Attributes – Authorization Attributes
–
–
–
–
–
–
–
Common name,
Address,
Institutional affiliations - e.g. faculty, student, staff, contractor.
Specific group memberships
Birth date
City of Birth
Etc.
Critical Identity Issues
• Is a person positively identified?
• Is person’s digital credential valid?
• Is person currently affiliated with the
university?
– i.e. does UTHSC-H accept responsibility for this
person’s Identity?
• Is person’s authorization attributes valid – i.e.
can they be “trusted”?
– Are a person’s authorizations for specific
applications appropriate?
Identity Provider Liability
Internal & External Services
• Institution provides IdP services only for
internal uses.
– UTHSC-H personnel (LRAAs) responsible for
identity vetting & credentialing – subject to audit.
– Contracts with external organizations to provide
vetting for their personnel having affiliations with
UTHSC-H – defined as UTHSC-H Guests
• Contract likely not auditable.
• Institution provides IdP services to relying
parties – e.g. U.T. System Federation members.
– IdP services to relying parties should not be
provided for “Guests”.
Identity & Authentication Attributes
• Identity Vetting
– Basic Trust Level
– Medium Trust Level
– High Trust Level
• Credential Strength
– Two-factor PKI Biometric Token
– Two-factor PKI Password Token
– One-factor Network Username/Password
UTHSC-H Strategic
Authentication Goals
• Two authentication mechanisms.
– Single university ID (UID) and password.
– Digital ID (DID)
• Digital ID can be used to set password for
UTHSC-H user ID
– No one but “owner” ever knows UID password.
– When password of UID is “aged” say every 90
days, user can use DID to reset the password. User
never has to contact help desk; thus, freeing help
desk to do other tasks!
Policy and procedures associated with
identifying, credentialing and
authenticating employees, students and
residents are reasonably appropriate at the
university. However, another group of
individuals such as contractors, research
collaborators and others having legitimate,
professional affiliations with the university
do not have digital credentials issued by
identity providers having relying partying
agreements with UTHSC-H.
Currently, the university accepts the legal
responsibility of identifying these
individuals, designated as guests, and
issuing them digital credentials which they
can use to authenticate their university
certified identity to others. Individuals in
this group are designated as “guests”.
Because of the extremely varied
circumstances associated with how “guest”
affiliations arise and terminate, it is difficult
to determine the current status of “guest”
affiliations and associated levels of “trust”.
To ensure that appropriate assurance levels
can be asserted by UTHSC-H as an identity
provider, special policies exist for identity
proofing and credentialing of persons
sponsored by individual university
personnel.
One such policy is the requirement
that individuals being considered for
an extension of their guest status for
an additional year must have their
identity formally re-vetted by the
university, and their sole control of
their digital credentials re-affirmed. It
has been requested that this policy be
reviewed.
UTHSC-H requires individuals requesting
an extension of their “Guest” status have
their physically identity annually revetted and sign a statement attesting they:
• are affiliated with the university as described
by their sponsor,
• have maintained and will maintain sole control
of their digital credentials,
• will immediately notify UTHSC-H if such
control is comprised or if they are no longer
affiliated with the university, and
• their contact information, as presented, is
correct.
Individuals wanting to extend their
“Guest” status and having a UTHSC-H
digital ID/token can digitally sign a
reaffirmation stating they
• are affiliated with the university as described
by their sponsor,
• have maintained and will maintain sole control
of their digital credentials,
• will immediately notify UTHSC-H if such
control is comprised or if they are no longer
affiliated with the university, and
• assert their contact information, as presented,
is correct.
Inter-institutional Identity
Reconciliation
• Problem:
– Multiple identity providers (IdPs) in a Federation.
– Individuals with multiple digital credentials issued
by different IdPs.
• Example:
– Jane Doe is provisioned into Application A with
UTMDACC credentials.
– Moves to BCM & obtains new credentials.
– How does application A handle this change of
identity?