Released Today, Liberty Alliance’s Identity Assurance Framework Sets Global Process and Policy Standard for Identity Federation Assurance Levels
Liberty Alliance, the global identity consortium working to build a more trusted Internet for consumers, governments and businesses worldwide, today announced the public release of the Liberty Identity Assurance Framework (IAF). The IAF has been developed by Liberty’s Identity Assurance Expert Group (IAEG) to simplify and speed the deployment of identity federations by standardizing identity assurance levels and the certification process for all identity assurance service providers participating in federated relationships. Liberty Alliance will hold a public webcast to review the Identity Assurance Framework on Thursday, November 29, at 8 am US PT.
Developed by IAEG members representing the financial services, government, healthcare, IT and telecommunications sectors, the IAF fills cross-industry requirements for baseline identity assurance policy standards for all public and private sector federations. The IAF has been designed to remove the unnecessary costs and complexities organizations face when making trust decisions for acceptance of credential-based assertions of identity information within federations. The Identity Assurance Framework is available for public input and review.
“The Identity Assurance Framework provides answers to the tough questions organizations in every sector have about how to best address today’s complex digital identity landscape in order to drive new and valuable federated services into global markets,” said Jane Hennessy, Senior Vice President, Wells Fargo Bank, N.A. and co-chair of the Liberty Alliance Identity Assurance Expert Group. “With the release of the initial public draft of the Identity Assurance Framework, organizations now have an industry standard for quickly moving wide scale interoperable federations ahead based on identity assurance which enables a foundation of trust.”
Delivering Trust Across Industries with Certified Identity Assurance Levels
Because varying levels of risk are associated with different electronic transactions, the IAF defines four identity assurance levels based on a comprehensive set of process and policy criteria required to meet each level of assurance. Federation operators and their respective relying party members will leverage IAF assessments performed by Liberty accredited assessors to determine the credential-based identity services they are willing to trust. Ranging from one to four with corresponding identity confidence levels scaling from low to very high, the Identity Assurance Framework details authentication requirements to allow federation operators and federating organizations to address cross-industry business, policy and privacy issues related to each identity assurance level.
With common business rules and policies for determining the reliability of asserted identity in place, the Identity Assurance Framework goes on to define the standard assessment criteria, accreditation and certification rules for federating organizations to meet each of the four levels of assurance. This will allow identity related transactions to occur within and across multiple federations with uniform understanding of the underlying due diligence applied to the issuance and use of identity credentials being asserted in any given federated transaction. Liberty Alliance expects to launch the identity assurance accreditation and certification program during mid-2008.
Consortium Forms Public Forum to Further the Collaborative Development of Standardized Identity Assurance
Liberty Alliance has also formed a global special interest group (SIG) to provide an open public forum for industry discussion and collaborative input into the development of the next phases of the IAF and associated accreditation and certification program. Public discussions within the group will play an important role in gathering trust requirements, feedback on proposals and overall guidance to drive the output of the IAEG. All individuals interested in advancing online identity assurance process and policy interoperability are encouraged to join the Identity Assurance Special Interest Group (formal membership in Liberty Alliance is not required). Information about how to become a member of the group is available.
“The release of the Identity Assurance Framework represents a significant milestone in eliminating the many business and policy barriers organizations face when moving to deploy wide-scale federated identity solutions,” said Brett McDowell, executive director of the Liberty Alliance. “Today’s news is about providing federation operators and their members with a comprehensive process and policy standard they can immediately leverage to more easily build, manage and scale their trusted identity federations.”
About the November 29 Liberty Identity Assurance Webcast
Hosted by Jim Gross, Senior Vice President, Wells Fargo, and Brett McDowell, Executive Director of the Liberty Alliance with participation from Jane Hennessy, Senior Vice president, Wells Fargo, and Roger Sullivan, President of the Liberty Alliance Management Board and vice president Oracle Identity Management, the initial webcast will review why the Identity Assurance Framework is critical to advancing trusted federations, the current state of federation policy and processes, immediate next steps and the roadmap for 2008. A Q and A will follow the online presentation. Registration and more information about the Liberty Identity Assurance Webcast is available.
About the Liberty Alliance Identity Assurance Expert Group
Liberty’s IAEG is co-chaired by Jane Hennessy, senior vice president, Wells Fargo Bank, N.A. and Michael Sessa, executive director, Postsecondary Electronic Standards Council (PESC), with other founding representatives from such organizations as Adobe, BT, the Federal Reserve Bank of Cleveland, Fidelity Investments, HP, SanDisk, Sun Microsystems, Symlabs, the US GSA, tScheme and TSCP. The IAEG is Liberty’s fourth expert group, joining the Business Marketing Expert Group (BMEG), Technology Expert Group (TEG), and Public Policy Expert Group (PPEG). The development of the Liberty Identity Assurance Framework within the IAEG is based on the Liberty model of creating open, secure and interoperable identity standards, business and policy deployment guidelines and best practices for managing privacy in a collaborative environment where all organizations and individual members are invited to participate. More information about Liberty’s IAEG is available here.