The Identity Metasystem is an interoperable architecture for digital identity that enables people to have and employ a collection of digital identities based on multiple underlying technologies, implementations, and providers. Using this approach, customers can continue to use their existing identity infrastructure investments, choose the identity technology that works best for them, and more easily migrate from old technologies to new technologies without sacrificing interoperability with others. The Identity Metasystem is based upon the principles in The Laws of Identity.

Identity Metasystem Architecture

Roles within the Identity Metasystem

Different parties participate in the metasystem in different ways. The three roles within the metasystem are:

• Identity Providers, which issue digital identities. For example, credit card providers might issue identities enabling payment, businesses might issue identities to their customers, governments might issue identities to citizens, and individuals might use self-issued identities in contexts like signing on to web sites.
• Relying Parties, which require identities. For example, a web site or online service that utilizes identities offered by other parties.
• Subjects, which are the individuals and other entities about whom claims are made. Examples of subjects include end users, companies, and organizations.

In many cases, the participants in the metasystem play more than one role, and often all three.

Components of the Identity Metasystem

There are five key components to the Identity Metasystem:

• A way to represent identities using claims. Claims are carried in security tokens, as per WS-Security.
• A means for identity providers, relying parties, and subjects to negotiate. Dynamically negotiating the claims to be delivered and the security token format used enables the Identity Metasystem to carry any format of token and any kinds of claims needed for a digital identity interaction. Negotiation occurs using WS-SecurityPolicy statements exchanged using WS-MetadataExchange.
• An encapsulating protocol to obtain claims and requirements. The WS-Trust and WS-Federation protocols are used to carry requests for security tokens and responses containing those tokens.
• A means to bridge technology and organizational boundaries using claims transformation. Security Token Services (STSs) as defined in WS-Trust are used to transform claim contents and formats.
• A consistent user experience across multiple contexts, technologies, and operators. This is achieved via Identity Selector client software such as Windows CardSpace representing digital identities owned by users as visual Information Cards.

WS-Security (Web Services Security) is a communications protocol providing a means for applying security to Web Services. ... WS-SecurityPolicy is a Web Services specification, created by IBM and 12 co-authors, which deals with defining policy assertions which are utilized by the WS-Security, WS-Trust and WS-SecureConversation specifications. ... One of many Web Service specifications, WS-MetadataExchange deals with the exchange of information about a Web Service. ... WS-Trust is a WS-* specification and OASIS standard that provides extensions to WS-Security, specifically dealing with the issuing, renewing, and validating of security tokens, as well as with ways to establish, assess the presence of, and broker trust relationships between participants in a secure message exchange. ... WS-Federation is an Identity Federation specification, developed by BEA Systems, BMC Software, CA, Inc. ... WS-Trust is a WS-* specification and OASIS standard that provides extensions to WS-Security, specifically dealing with the issuing, renewing, and validating of security tokens, as well as with ways to establish, assess the presence of, and broker trust relationships between participants in a secure message exchange. ... This subsystem is a part of . ... Information Cards shown in an Identity Selector Information Cards (sometimes known as “InfoCards”) are visual representations of personal digital identities that people can use online. ...

Interoperability and Licensing

The protocols needed to build Identity Metasystem components can be used by anyone for any purpose at no cost and interoperable implementations can be built using only publicly-available documentation. Patent promises have been issued by Microsoft, IBM, and others ensuring that the protocols underlying the Identity Metasystem can be freely used by all.

Several interoperability testing events for Identity Metasystem components have been sponsored by OSIS and the Burton Group, the most recent of which was the Interop at the October 2007 European Catalyst Conference in Barcelona. These events are helping to insure that the different software components being built by the numerous Identity Metasystem participants work well together.

In his report on the Interop at the June 2007 Catalyst Conference in San Francisco, analyst Bob Blakley wrote:

The interop event was a milestone in the maturation of user-centric identity technology. Prior to the event, there were some specifications, one commercial product, and a number of open-source projects. After the event, it can accurately be said that there is a running identity metasystem.

See Also

• Information Card
• Identity Selector
• WS-Security
• WS-Trust
• WS-MetadataExchange
• WS-SecurityPolicy
• WS-Federation
• Windows CardSpace
• Higgins trust framework

Information Cards shown in an Identity Selector Information Cards (sometimes known as “InfoCards”) are visual representations of personal digital identities that people can use online. ... WS-Security (Web Services Security) is a communications protocol providing a means for applying security to Web Services. ... WS-Trust is a WS-* specification and OASIS standard that provides extensions to WS-Security, specifically dealing with the issuing, renewing, and validating of security tokens, as well as with ways to establish, assess the presence of, and broker trust relationships between participants in a secure message exchange. ... One of many Web Service specifications, WS-MetadataExchange deals with the exchange of information about a Web Service. ... WS-SecurityPolicy is a Web Services specification, created by IBM and 12 co-authors, which deals with defining policy assertions which are utilized by the WS-Security, WS-Trust and WS-SecureConversation specifications. ... WS-Federation is an Identity Federation specification, developed by BEA Systems, BMC Software, CA, Inc. ... This subsystem is a part of . ... Higgins trust framework is a set of protocols and software applications that allow people to store their digital identities on their personal computers and share the stored information with companies and other parties in a controlled fashion. ...

References

• Microsoft's Vision for an Identity Metasystem, Michael B. Jones, May 2005.
• The Laws of Identity, Kim Cameron, May 2005.
• Design Rationale behind the Identity Metasystem Architecture, Kim Cameron and Michael B. Jones, January 2006.
• 7 Laws of Identity: The Case for Privacy-Embedded Laws of Identity in the Digital Age, Ann Cavoukian, Information and Privacy Commissioner of Ontario, October 2006.

External Links

• Burton Group report on OSIS June 2007 User-Centric Identity Interop at Catalyst in San Francisco, August 2007.
• Burton Group report on OSIS October 2007 User-Centric Identity Interop at Catalyst in Barcelona, October 2007.
• DigitalMe Identity Selector
• Microsoft Open Specification Promise, May 2007.
• IBM Interoperability Specifications Pledge, July 2007.