Kantara Initiative Privacy Framework Overview and Value Proposition

1. Kantara Initiative Privacy Framework Overview and Value Proposition March 7, 2011

2. Kantara Initiative – scope of activity • Digital Identity Trust Frameworks • Assurance • Privacy • Trust • Get Involved Kantara Initiative builds bridges...

3. Kantara Initiative: Assurance and Interoperability Program Work Groups KANTARA INITIATIVE PROGRAMS WORK & DISCUSSION GROUP ACRONYMS: NON-CERTIFICATION CERTIFICATION • (BCTFDG) Business Cases for Trusted Federation • (eGOV) eGovernment • (EUMDG) European Use Case and Market • (FIWG) Federation Interoperability • (IOP) Interoperability INTEROPERABILITY ASSURANCE HARMONIZATION InterOp Review Board (IRB) • Certification • Demos Assurance Review Board (ARB) • Certification • Accreditation User-Centric, Jurisdiction and Vertical Based • (HIAWG) Heath Identity Assurance • (IAWG) Identity Assurance • (Info Sharing WG) Information Sharing • (P3WG) Privacy and Public Policy Consumer ID BCTF DG HIA WG eGOV IA WG Japan • (Consumer ID) Consumer Identity • (JapanWG) Japan • (Telco ID) Telecommunication Identification • (ULX) User Login Experience • (UMA) User Managed Access EUM DG InfoShare Telco ID FI WG P3 WG ULX IOP UMA

4. Kantara - a base for Privacy capability Kantara has experience developing components of a trust framework e.g. its Identity Assurance Framework (IAF) - FICAM Trust Framework Components Kantara considers Privacy as a Core Requirement and opportunity when designing identity interoperability. Privacy and Public Policy Work Group (P3WG) is a dedicated work group liaising with existing privacy standards efforts & other Kantara WG’s • P3WG Sponsors the Privacy Framework sub-work group(PF-SG) that is developing a phased approach to developing a Privacy Framework for trust.

5. Plug-in Components The Privacy Framework sub-work group at Kantara is developing ‘baseline’ privacy guidelines for each deployment. The Privacy Framework enhances credential management when used in profiles across federations and jurisdictions. The Privacy Framework can be used as a baseline to assess/audit privacy capability. Authentication, authorization, access control: consider separately for each deployment of a federated identity system.

6. Privacy Guidelines impact on IAF certification as applied to: US ICAM TRUST FRAMEWORK PROVIDER REQ’S BIO-PHARMACEUTICALFEDERATION CORE CSP REQUIREMENTS FINANCIAL SERVICES NETWORK CORE REQUIREMENT SET HIGHER EDUCATIONFEDERATION CORE REQUIREMENT SET Identity Assurance Framework SAC for AL(n) – {n:1-4} IAF ADOPTION IAF PROFILES

7. Privacy Framework development and operations: Basic Flow Phase 1: Privacy Framework-SG develops privacy guidelines and assessment criteria for privacy certification of industry or organizational ‘profiles of the Kantara IAF in federated identity assurance deployments. Phase 2: Privacy Framework-SG develops a set of recommendations for broad-based privacy framework certification based on emerging privacy standards. Phase 3: Privacy Framework-SG continues support and development of Privacy Framework implementations.

8. Roadmap Enter roadmap TBD timeline

9. What We Ask? • Volunteer time and effort to the P3WG to help complete the work. • Identity service organizations adopt the IAF and eventually Privacy Framework as their standard for Identity Assurance • Financial sponsorship (through membership and/or directed contributions) be made to support the development of a Privacy Framework and Certification Program

10. Get Involved: Join our Community Website: http://kantarainitiative.org Community Mail List: http://kantarainitiative.org/listinfo/community Identity Assurance Accreditation and Certification Program: http://kantarainitiative.org/confluence/display/Identity+Assurance+Certification Membership Documents: http://kantarainitiative.org/wordpress/membership/

11. More Information: Accepting applications now! Visit our Assurance Certification Centerhttp://kantarainitiative.org/confluence/x/EYCYAQ Connect with Executive DirectorJoni@ieee-isto.org