security

Seattle WA – September 27, 2010 – Last month, at the Privacy Identity Innovation 2010 conference in Seattle, Microsoft Senior Program Manager Christian Paquin hosted a session on the U-Prove minimal disclosure technology. ICF Executive Director Drummond Reed interviewed Christian for the following in-depth Q&A about U-Prove.

Q: First, can you tell me what is U-Prove?

A: U-Prove is an innovative privacy-enhancing security technology that can help people protect their identity-related information. U-Prove combines the security of PKI (public key infrastructure) with the flexibility of federation technologies that allow people to link identities across domains. And it does all this while providing privacy-by-design. That makes the U-Prove technology ideally suited to protect claims (attributes) in user-centric identity systems.

Q: Microsoft made a major announcement about U-Prove at RSA in March. What was the essence of that announcement?

A: The initial release of the U-Prove technology we announced at RSA consisted of two parts. First, we released the U-Prove specifications, published under the Open Specification Promise (OSP), so anyone can implement and use them freely and for any purpose. The first specification describes the core cryptographic protocols, and the second is a WS-Trust / OASIS IMI profile (the protocol used for Information Cards). We also released two open-source Software Development Kits (SDK) – one in C#, one in Java – implementing the core cryptographic specification.

ICF Steering Member Equifax Inc. announced this week that it has chosen Anakam, Inc. to provide the electronic authenticator for the Equifax I-Card. Anakam will implement its Anakam.TFA® Two Factor Authentication service, making the Equifax I-Card the first to have the maximum ease of use as well as the highest level of authentication security (Level 3) in the marketplace.

According to ICF board member Ron Carpinella, Equifax's Vice President of Identity Management, "This speaks to our efforts to provide strong authentication for the U.S. federal government via i-cards and the ICAM trust framework." The Information Card Foundation, together with the OpenID Foundation, has been instrumental in working with the U.S. GSA Identity, Credential, and Access Management (ICAM) Subcommittee to create a trust framework that enables U.S. citizens to use open identity credentials to access U.S. government websites.

The Anakam platform will be incorporated into the Equifax I-Card offering to provide on-going two-factor authentication without the need for distribution of smart cards and hard tokens to end users while still complying with the standards established around these devices. With Level 3 authentication, there is high confidence in the validity of the user's asserted identity as determined by U.S. Office of Management and Budget (OMB) guidelines and the technical recommendations of the National Institutes of Standards and Technologies (NIST).