Digital Identity

Digital Identity

by Phillip J. Windley
Released August 2005
Publisher(s): O'Reilly Media, Inc.
ISBN: 9780596553944

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

The rise of network-based, automated services in the past decade has definitely changed the way businesses operate, but not always for the better. Offering services, conducting transactions and moving data on the Web opens new opportunities, but many CTOs and CIOs are more concerned with the risks. Like the rulers of medieval cities, they've adopted a siege mentality, building walls to keep the bad guys out. It makes for a secure perimeter, but hampers the flow of commerce.

Fortunately, some corporations are beginning to rethink how they provide security, so that interactions with customers, employees, partners, and suppliers will be richer and more flexible. Digital Identity explains how to go about it. This book details an important concept known as "identity management architecture" (IMA): a method to provide ample protection while giving good guys access to vital information and systems. In today's service-oriented economy, digital identity is everything. IMA is a coherent, enterprise-wide set of standards, policies, certifications and management activities that enable companies like yours to manage digital identity effectively--not just as a security check, but as a way to extend services and pinpoint the needs of customers.

Author Phil Windley likens IMA to good city planning. Cities define uses and design standards to ensure that buildings and city services are consistent and workable. Within that context, individual buildings--or system architectures--function as part of the overall plan. With Windley's experience as VP of product development for Excite@Home.com and CIO of Governor Michael Leavitt's administration in Utah, he provides a rich, real-world view of the concepts, issues, and technologies behind identity management architecture.

How does digital identity increase business opportunity? Windley's favorite example is the ATM machine. With ATMs, banks can now offer around-the-clock service, serve more customers simultaneously, and do it in a variety of new locations. This fascinating book shows CIOs, other IT professionals, product managers, and programmers how security planning can support business goals and opportunities, rather than holding them at bay.

Publisher resources

View/Submit Errata

Table of contents

  1. Digital Identity
    1. SPECIAL OFFER: Upgrade this ebook with O’Reilly
    2. Foreword
    3. Preface
      1. Who Should Read This Book
      2. Conventions Used in This Book
      3. Comments and Questions
      4. Safari Enabled
      5. Acknowledgments
    4. 1. Introduction
      1. 1.1. Business Opportunity
      2. 1.2. Digital Identity Matters
      3. 1.3. Using Digital Identity
      4. 1.4. The Business Context of Identity
      5. 1.5. Foundational Technologies for Digital Identity
      6. 1.6. Identity Management Architectures
    5. 2. Defining Digital Identity
      1. 2.1. The Language of Digital Identity
      2. 2.2. Identity Scenarios in the Physical World
      3. 2.3. Identity, Security, and Privacy
      4. 2.4. Digital Identity Perspectives
      5. 2.5. Identity Powershifts
      6. 2.6. Conclusion
    6. 3. Trust
      1. 3.1. What Is Trust?
      2. 3.2. Trust and Evidence
      3. 3.3. Trust and Risk
      4. 3.4. Reputation and Trust Communities
      5. 3.5. Conclusion
    7. 4. Privacy and Identity
      1. 4.1. Who's Afraid of RFID?
      2. 4.2. Privacy Pragmatism
      3. 4.3. Privacy Drivers
      4. 4.4. Privacy Audits
      5. 4.5. Privacy Policy Capitalism
      6. 4.6. Anonymity and Pseudonymity
      7. 4.7. Privacy Principles
      8. 4.8. Prerequisites
      9. 4.9. Conclusion
    8. 5. The Digital Identity Lifecycle
      1. 5.1. Provisioning
      2. 5.2. Propagating
      3. 5.3. Using
      4. 5.4. Maintaining
      5. 5.5. Deprovisioning
      6. 5.6. Conclusion
    9. 6. Integrity, Non-Repudiation, and Confidentiality
      1. 6.1. Integrity
      2. 6.2. Non-Repudiation
      3. 6.3. Confidentiality
        1. 6.3.1. Cryptography
          1. 6.3.1.1. Secret keys
          2. 6.3.1.2. Public key cryptography
          3. 6.3.1.3. Hybrid key systems
          4. 6.3.1.4. Public key cryptosystem algorithms
        2. 6.3.2. Message Digests and Hashes
        3. 6.3.3. Digital Signatures
        4. 6.3.4. Digital Certificates
        5. 6.3.5. Certificate Authorities
        6. 6.3.6. Certificate Revocations Lists
        7. 6.3.7. Public-Key Infrastructures
        8. 6.3.8. Going Further
      4. 6.4. Conclusion
    10. 7. Authentication
      1. 7.1. Authentication and Trust
      2. 7.2. Authentication Systems
        1. 7.2.1. Cookies
        2. 7.2.2. ID and Password
          1. 7.2.2.1. Password management
          2. 7.2.2.2. Password reset
        3. 7.2.3. Challenge-Response Systems
        4. 7.2.4. Digital Certificates
        5. 7.2.5. Biometric Devices
        6. 7.2.6. Smart Cards
      3. 7.3. Authentication System Properties
        1. 7.3.1. Practicality
        2. 7.3.2. Appropriate Level of Security
        3. 7.3.3. Locational Transparency
        4. 7.3.4. Protocol Insensitivity
        5. 7.3.5. Appropriate Level of Privacy
        6. 7.3.6. Reliability
        7. 7.3.7. Auditability
        8. 7.3.8. Manageability
        9. 7.3.9. Federation Support
      4. 7.4. Conclusion
    11. 8. Access Control
      1. 8.1. Policy First
        1. 8.1.1. Responsibility
        2. 8.1.2. Principle of Least Privilege
        3. 8.1.3. Accountability Scales Better than Enforcement
      2. 8.2. Authorization Patterns
        1. 8.2.1. Mandatory and Discretionary Access Control
        2. 8.2.2. User-Based Permission Systems
        3. 8.2.3. Access-Control Lists
        4. 8.2.4. Role-Based Access Control
      3. 8.3. Abstract Authorization Architectures
      4. 8.4. Digital Certificates and Access Control
      5. 8.5. Conclusion
    12. 9. Names and Directories
      1. 9.1. Utah.gov: Naming and Directories
      2. 9.2. Naming
        1. 9.2.1. Namespaces
        2. 9.2.2. Uniform Resource Indicators: A Universal Namespace
        3. 9.2.3. Cool URIs Don't Change
      3. 9.3. Directories
        1. 9.3.1. Directories Are Not Databases
        2. 9.3.2. An Example Directory
        3. 9.3.3. Enterprise Directory Services
          1. 9.3.3.1. Domain Name System
          2. 9.3.3.2. RMIRegistry
          3. 9.3.3.3. X.500: heavyweight directory services
          4. 9.3.3.4. LDAP
      4. 9.4. Aggregating Directory Information
        1. 9.4.1. Metadirectories
        2. 9.4.2. Virtual Directories
      5. 9.5. Conclusion
    13. 10. Digital Rights Management
      1. 10.1. Digital Leakage
      2. 10.2. The DRM Battle
      3. 10.3. Apple iTunes: A Case Study in DRM
      4. 10.4. Features of DRM
      5. 10.5. DRM Reference Architecture
      6. 10.6. Trusted Computing Platforms
      7. 10.7. Specifying Rights
        1. 10.7.1. XrML
      8. 10.8. Conclusion
    14. 11. Interoperability Standards
      1. 11.1. Standards and the Digital Identity Lifecycle
      2. 11.2. Integrity and Non-Repudiation: XML Signature
      3. 11.3. Confidentiality: XML Encryption
      4. 11.4. Authentication and Authorization Assertions
      5. 11.5. Example SAML Use Cases
      6. 11.6. Identity Provisioning
        1. 11.6.1. SPML Requests and Responses
      7. 11.7. Representing and Managing Authorization Policies
      8. 11.8. Conclusion
    15. 12. Federating Identity
      1. 12.1. Centralized Versus Federated Identity
      2. 12.2. The Mirage of Centralized Efficiency
      3. 12.3. Network Effects and Digital Identity Management
      4. 12.4. Federation in the Credit Card Industry
      5. 12.5. Benefits of Federated Identity
      6. 12.6. Digital Identity Standards
        1. 12.6.1. Microsoft, IBM, and the WS-* Roadmap
        2. 12.6.2. OASIS
        3. 12.6.3. Liberty Alliance
        4. 12.6.4. Internet2 and Shibboleth
        5. 12.6.5. The Future of Federation Standards
      7. 12.7. Three Federation Patterns
        1. 12.7.1. Pattern 1: Ad Hoc Federation
        2. 12.7.2. Pattern 2: Hub-and-Spoke Federation
          1. 12.7.2.1. Bank of America: a cautionary tale
        3. 12.7.3. Scenario 3: Identity Network
        4. 12.7.4. Addressing the Problem of Trust
        5. 12.7.5. A Secure, Protected Environment
        6. 12.7.6. The Future of Federated Identity Networks
      8. 12.8. Conclusion
    16. 13. An Architecture for Digital Identity
      1. 13.1. Identity Management Architecture
      2. 13.2. The Benefits of an Identity Management Architecture
      3. 13.3. Success Factors
      4. 13.4. Roadblocks
      5. 13.5. Identity Management Architecture Components
      6. 13.6. Conclusion
    17. 14. Governance and Business Modeling
      1. 14.1. IMA Lifecycle
      2. 14.2. IMA Governance Model
      3. 14.3. Initial Steps
      4. 14.4. Creating a Vision
      5. 14.5. IMA Governing Roles
        1. 14.5.1. Primary Roles
        2. 14.5.2. Supporting Roles
      6. 14.6. Resources
      7. 14.7. What to Outsource
      8. 14.8. Understanding the Business Context
      9. 14.9. Business Function Matrix
        1. 14.9.1. Creating the Business Function Matrix
      10. 14.10. IMA Principles
      11. 14.11. Conclusion
    18. 15. Identity Maturity Models and Process Architectures
      1. 15.1. Maturity Levels
      2. 15.2. The Maturity Model
        1. 15.2.1. Level 1: Ad Hoc
        2. 15.2.2. Level 2: Focused
        3. 15.2.3. Level 3: Standardized
        4. 15.2.4. Level 4: Integrated
      3. 15.3. The Rights Steps at the Right Time
      4. 15.4. Finding Identity Processes
      5. 15.5. Evaluating Processes
      6. 15.6. A Practical Action Plan
      7. 15.7. Filling the Gaps with Best Practices
      8. 15.8. Conclusion
    19. 16. Identity Data Architectures
      1. 16.1. Build a Data Architecture
        1. 16.1.1. Processes Trump Data
      2. 16.2. Processes Link Identities
        1. 16.2.1. Employee Provisioning
        2. 16.2.2. The Identity Data Inventory
      3. 16.3. Data Categorization
        1. 16.3.1. Identity Data Audit
        2. 16.3.2. Identity Mapping
        3. 16.3.3. Process-to-Identity Matrix
      4. 16.4. Identity Data Structure and Metadata
      5. 16.5. Exchanging Identity Data
      6. 16.6. Principles for Identity Data
      7. 16.7. Conclusion
    20. 17. Interoperability Frameworks for Identity
      1. 17.1. Principles of a Good IF
      2. 17.2. Contents of an Identity IF
        1. 17.2.1. Standard Status
        2. 17.2.2. Listing Standards
      3. 17.3. Example Interoperability Framework
      4. 17.4. A Word of Warning
      5. 17.5. Conclusion
    21. 18. Identity Policies
      1. 18.1. The Policy Stack
      2. 18.2. Attributes of a Good Identity Policy
      3. 18.3. Determining Policy Needs
        1. 18.3.1. Business Inspired Projects and Processes
        2. 18.3.2. Security Considerations
        3. 18.3.3. Meeting External Requirements
        4. 18.3.4. Feedback on Existing Policies
      4. 18.4. Writing Identity Policies
        1. 18.4.1. Policy Outline
      5. 18.5. An Identity Policy Suite
        1. 18.5.1. Naming and Certificates
        2. 18.5.2. Passwords
        3. 18.5.3. Encryption and Digital Signatures
        4. 18.5.4. Directories
        5. 18.5.5. Privacy
        6. 18.5.6. Authentication
        7. 18.5.7. Access Control
        8. 18.5.8. Provisioning
        9. 18.5.9. Federation
        10. 18.5.10. The Policy Review Framework
      6. 18.6. Assessing Identity Policies
      7. 18.7. Enforcement
      8. 18.8. Procedures
      9. 18.9. Conclusion
    22. 19. Identity Management Reference Architectures
      1. 19.1. Reference Architectures
      2. 19.2. Benefits and Pitfalls
      3. 19.3. Reference Architecture Best Practices
      4. 19.4. Using a Reference Architecture
      5. 19.5. Components of a Reference Architecture
      6. 19.6. Technical Position Statements
        1. 19.6.1. Making Decisions About Technical Positions
      7. 19.7. Consolidated Infrastructure Blueprint
        1. 19.7.1. Goal State CIBs
      8. 19.8. System Reference Architectures
      9. 19.9. Conclusion
    23. 20. Building an Identity Management Architecture
      1. 20.1. Scoping the Process
      2. 20.2. Which Projects Are Enterprise Projects?
      3. 20.3. Sequencing the IMA Effort
      4. 20.4. A Piece at a Time
      5. 20.5. Conclusion: Dispelling IMA Myths
    24. Index
    25. About the Author
    26. Colophon
    27. SPECIAL OFFER: Upgrade this ebook with O’Reilly

Product information

  • Title: Digital Identity
  • Author(s): Phillip J. Windley
  • Release date: August 2005
  • Publisher(s): O'Reilly Media, Inc.
  • ISBN: 9780596553944