Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 06/23/08 web stories

Liberty Alliance issues guidelines for standardized identity assurance, privacy controls

By William Jackson

The Liberty Alliance today released the first versions of two key specifications aimed at taking some of the work and doubt out of federated identity schemes.

The Identity Assurance Framework (IAF) and Identity Governance Framework (IGF) are aimed at driving identity system policy to better manage identity relationships and define how privacy is being protected in information technology enterprises. IAF is a set of technology-neutral policies to help organizations make decisions about trust in identity credentials without reinventing the wheel each time. IGF is a technical specification for defining privacy issues based on the Extensible Markup Language.

The frameworks follow on the development of the widely adopted Security Assertion Markup Language (SAML), said Roger Sullivan, Liberty Alliance president and vice president of identity management at Oracle Corp.

“The SAML 2.0 infrastructure is well established as the de-facto standard for federated relationships,” Sullivan said. “This takes us to the next level, addressing privacy and trust considerations for those relationships.”

A federated relationship allows multiple organizations to trust one another’s decisions and assertions so that each organization does not have to issue and process its own credentials. Establishing a federation typically requires some policy framework that all can agree on and an infrastructure for exchanging information in a defined format.

IAF provides policy criteria to allow organizations to link identity systems based on a uniform definition of the security and privacy risks at each of four levels of assurance. The Liberty Alliance will begin an IAF certification and accreditation program this summer.

The IGF is an auditable, open standards-based framework to help meet regulatory requirements for using, managing and protecting personally identifiable information.

“IAF will help us achieve global trust at common, known levels of assurance,” said Peter Alterman, assistant chief informtion officer of e-authentication at the National Institutes of Health and chairman of the Federal [Public-Key Infrastructure] Policy Authority. “This will enable secure, trusted electronic business transactions outside of the enterprise. We’ve recognized this need for years in the U.S. government and introduced some of the first successful interfederated business processes in early 2001.”

IAF is built on a foundation of government work. It builds on efforts originated by the Electronic Authentication Partnership, an industry organization supported by government working to establish business rules for interoperable authentication, which was merged into the Liberty Alliance last year.

More news on related topics: IT Security, Authentication / Identity Management



GCN Popup