Scaling Interoperable Trust through a Trustmark Marketplace

1. Scaling InteroperableTrust through aTrustmark Marketplace Georgia Tech Research Institute **Slides extracted from various Presentations – With Permission** This work was performed under the following financial assistance award 70NANB13H189 from the U.S. Department of Commerce, National Institute of Standards and Technology

2. Our Approach: Componentization If the frameworks were modular… ID Trust Framework B ID Trust Framework C ID Trust Framework A FICAM SAML SSO NIST 800-63 LOA 3 FIPS 200 FIPPs OAuth OpenID …then we get: Greater ease of comparability between frameworks Greater potential for reusability of framework components Greater transparency of trust framework requirements And, most importantly: Greater potential for participation in multiple trust frameworks by ID Ecosystem members with incremental effort and cost These modular components are called Trustmarks.

3. A Trustmark-Based ID Ecosystem Trust Interoperability Profile B Trust Interoperability Profile C Trust Interoperability Profile A IDP IDP IDP AP IDP AP AP IDP IDP ID Trust Framework A ID Trust Framework B ID Trust Framework C Existing Trust Frameworks could be expressed as a set of components called a TIP. RP RP RP RP RP RP RP RP RP

4. A Trustmark-Based ID Ecosystem TIP B TIP C TIP A IDP IDP IDP AP IDP AP AP IDP IDP Trustmark Provider Trustmark Provider Trustmark Provider Trustmark Provider Then each member of the community can acquire the necessary Trustmarks based on the TIP. Trustmarks can be acquired through a Trustmark Provider. There can be many Trustmark Providers in the ID Ecosystem. Trustmark Provider Trustmark Provider Trustmark Provider RP RP RP RP RP RP RP RP RP

5. A Trustmark-Based ID Ecosystem TIP B TIP C TIP A IDP IDP IDP AP IDP AP AP IDP IDP Trustmarks can be stored in a searchable Trustmark Registries or shared directly with partners. Trustmark Registry Trustmark Registry Trustmark Registry IDP X: IDP X: IDP X: RP Y: RP Y: RP Y: Etc. Etc. Etc. RP RP RP RP RP RP RP RP RP

6. Scope of the NSTIC Trustmark Pilot Concept Maturation Trustmark Framework Sample TDs, TIPs, and Trustmarks Sample Tools 2 1 3 4 Trustmark Concept Presentation Comm. Protocol TDs & Trustmarks Normative Trustmark Spec Trustmark Assessment Tool for Trustmark Providers Trustmark Pilot Concept Website Identity LOA TDs & Trustmarks Normative TD Spec Normative TIP Spec Outreach to IDESG End-User Privacy TDs & Trustmarks Trustmark Generating & Publishing Tool for Trustmark Providers Outreach to NIEF Membership Trustmark Policy Template Security Policy TDs & Trustmarks Trustmark Agreement Template Outreach to SICAM Stakeholders Other TDs & Trustmarks Outreach to Other Stakeholders Trustmark Registry Query Tool Sample TIPs for NIEF Community NIEF Pilot Expanded Pilot via NASCIO/SICAM 5 6 Issue Trustmarks to Current NIEF Members Identify SICAM Use Cases Issue Trustmarks to More IDPs, APs, and RPs via a New Trustmark Provider Modify Tech Framework, Specs, TDs, TIPs, Policies, Agreements, and Tools as Needed Demonstrate SICAM Use Cases in a Multiple-Trustmark-Provider Marketplace

7. Trustmarks ? TDO Trustmark

8. The Trustmark Framework Trustmark Provider Stakeholder Community Issues Is Used By Is Represented By Trust Interop Profile Trustmark Recipient Trustmark A Trustmark Defining Organization Trustmark B Trustmark C Is Trusted By Is Required By Defines Trustmark Relying Parties Trustmark Definition Org. 1 End User Is Required By Org. 2

9. Sources of Components

10. Creating Modular Common Components Step 1: Gather trust and interop requirements from many frameworks InCommon AAMVA Others GFIPM FICAM NIEF Step 2: Break down and reassemble requirements into modular, reusable components Transformation Process Step 3: Express modularized requirements in a standard format to encourage broad reuse Trustmark Definition Trustmark Definition Trustmark Definition

11. GTRI NSTIC Pilot Trustmark Analysis 122 distinct trustmarks identified (so far) Covers FICAM, GFIPM, & NIEF communities Also covers FIPPs (privacy) topics

12. Trustmarks By Category Identity Assurance Policy (10 Total, 10 Essential to Pilot) Security Policy (18 Total, 18 Essential to Pilot) Privacy Policy (23 Total, 15 Essential to Pilot) Attribute Assurance Policy (2 Total, 2 Essential to Pilot) Technical Interoperability (57 Total, 8 Essential to Pilot) Organizational Integrity / Bona Fides (6 Total, 3 Essential to Pilot) Technical Trust (4 Total, 3 Essential to Pilot) Usability (2 Total, 0 Essential to Pilot)

13. Requirements = Trustmark Component Definitions (TCDs) TCD Spec Defines a common structure and syntax for all TCDs • Ensures consistency and machine readability for all TCDs • Allows for greater ease of understanding a TCD • Makes TCDs more likely to be considered for reuse • (TCD reuse leads to trustmark reuse) • Allows for standards-based TCD tools to proliferate Ensures that all TCDs contain the minimal info required to promote legitimacy and encourage reuse • Name of TDO / Publisher • Canonical Published Location (URL/URI) • Name of TCD • Description and Intended Purpose • Target Stakeholder Audience of TCD • Date of Publication • Version Number • Visual Icon or Image XML HTML

14. Trustmark Assessment Tool Process Flow Trustmark Provider Trustmark Definitions & Profiles Trustmark Recipient Trustmark Assessment Tool 2. Receive request for trustmark from Trustmark Recipient candidate 1. Load TCDs into Assessment Tool 3. Perform assessment of Trustmark Recipient candidate 4. Store assessment artifacts / evidence in database Trustmark Assessment Tool Database 5. Issue trustmark to Trustmark Recipient