Towards an Economic Valuation of Telco-based Valuation of Telco - PowerPoint PPT Presentation

…… …… Towards an Economic Valuation of Telco-based Valuation of Telco based Identity Management Enablers Enablers PrimeLife/IFIP Summer School 2010 Helsingborg, 2010-08-04 Kai Rannenberg, S ascha Koschinat, Andreas Albers, Gökhan Bal, Marvin Hegen, Christian Weber T-Mobile Chair of Mobile Business & Multilateral S ecurity Institute of Business Informatics ... ... Goethe University Frankfurt www.m-chair.net

…… …… Agenda … 1 1. Identity Management in IS Id tit M t i IS O/ IEC O/ IEC S tandardisation 2. Multilateral S 2 M ltil t l S ecurity it 3. The Identity Management Enabler Concept 4. Motivating the Provision of IdM Enablers by Telecoms 5. Evaluation Approach for IdM Enablers 6. Economic Evaluation of exemplary IdM Enabler “ Age Verification” 7. Conclusion and questions for discussion ... ... 2

…… …… Agenda … 1 1. Identity Management in IS Id tit M t i IS O/ IEC JTC 1 O/ IEC JTC 1 S tandardisation 2. Multilateral S 2 M ltil t l S ecurity it 3. The Identity Management Enabler Concept 4. Motivating the Provision of IdM Enablers by Telecoms 5. Evaluation Approach for IdM Enablers 6. Economic Evaluation of exemplary IdM Enabler “ Age Verification” 7. Conclusion and questions for discussion ... ... 3

WGs within ISO/IEC JTC 1/SC 27 – IT Security Techniques IT Security Techniques ISO/IEC JTC 1/SC 27/WG 5 Identity Management & Privacy Technologies WG 3 WG 3 WG 1 WG 1 Assessment Security Evaluation ISMS WG 4 WG 4 Guidelines Security Controls & Services WG 5 WG 2 Identity Management Cryptography & & Privacy Technologies Techniques Security Mechanisms Process Environment Product System 4

WG 5 Identity Management & Privacy Technologies History y ISO/IEC JTC 1/SC 27/WG 5 Identity Management & Privacy Technologies October 2003 JTC 1 Plenary established  JTC 1 Study Group on Privacy Technologies (SGPT) JTC 1 St d G P i T h l i (SGPT)  for one year period of time (until October 2004) to identify standardization needs October 2004 JTC 1 Pl JTC 1 Plenary resolved to l d t  disband SGPT  assign to SC 27 further activities in the Privacy Technologies area such as  a further inventory  a report back to the November 2006 JTC 1 Plenary 5

WG 5 Identity Management & Privacy Technologies History y ISO/IEC JTC 1/SC 27/WG 5 Identity Management & Privacy Technologies SC 27 SC 27 activities (in response to JTC 1‘s request ti iti (i t JTC 1‘ t from October 2004)  October 2004  Study Period on Identity Management established  May 2005  Study Period on Privacy established  Study Period on Privacy established  New Work Item Proposal: A framework for identity management (ISO/IEC 24760)  May 2006 M 2006  New Working Group 5 on Identity Management and Privacy Technologies established  Two new Work Item Proposals T W k I P l  A privacy framework (ISO/IEC 29100)  A privacy reference architecture (ISO/IEC 29101) 6

Identity Management (IdM) An early approach ISO/IEC JTC 1/SC 27/WG 5 Identity Management & Privacy Technologies  „Fear not, for I have redeemed you; Fear not for I have redeemed you; I have called you by name: you are mine.” [Isaiah 43:1]  „ Μη φοβου· διοτι εγω σε ελυτρωσα , σε εκαλεσα με το ονομα σου· εμου εισαι “ [ Ησαιαν 43:1] [ Ησαιαν 43:1]  „No temas, porque yo te he redimido, te he llamado por tu nombre; mío eres tú.“ t h ll d t b í tú “ [Isaías 43 1 ]  „Fürchte dich nicht, denn ich habe dich erlöst; ich habe dich bei deinem Namen gerufen; du bist mein!“ [Jesaja 43,1] 7

Identity Management (IdM) 2 sides of a medal with enormous economic potential ISO/IEC JTC 1/SC 27/WG 5 Identity Management & Privacy Technologies  Organisations aim to sort out  People live their life  User Accounts in different IT  in different roles (professional, systems private, volunteer)  Authentication  using different identities (pseudonyms): email accounts,  Rights management g s a age e SIM cards, eBay trade names, SIM d B d  Access control chat names, 2ndLife names, …)  Differentiated identities  Unified identities  Unified identities help to help to  protect  ease administration  privacy, especially anonymity  manage customer relations  personal security/safety p y y  enable reputation building at the same time  Identity management  Identity management systems systems systems  support users using role based  support users using role based  ease single-sign-on by unify identities accounts  help to present the “right” identity  solve the problems of multiple in the right context passwords passwords 8

Identity Management (IdM) 2 sides of a medal with enormous economic potential ISO/IEC JTC 1/SC 27/WG 5 Identity Management & Privacy Technologies  People live their life  Organisations aim to sort out  in different roles (professional,  User Accounts in different IT private, volunteer) systems  using different identities  Authentication (pseudonyms): email  Rights management g s a age e accounts, SIM cards, eBay SIM d B  Access control trade names, chat names, 2ndLife names, …)  Unified identities  Unified identities  Differentiated identities Diff ti t d id titi help to help to  ease administration  protect  manage customer relations  privacy, especially anonymity p y p y y y  personal security/safety  enable reputation building at the same time  Identity management  Identity management Identity management Identity management systems systems  support users using role based  ease single-sign-on by unify identities accounts  help to present the “right”  help to present the right  solve the problems of multiple  solve the problems of multiple identity in the right context passwords 9

WG 5 Identity Management & Privacy Technologies Scope p ISO/IEC JTC 1/SC 27/WG 5 Identity Management & Privacy Technologies  Development and maintenance of D l t d i t f standards and guidelines addressing security aspects of  Identity management Identity management  Biometrics and  Privacy P i 10

WG 5 Identity Management & Privacy Technologies Programme of Work ISO/IEC JTC 1/SC 27/WG 5 Identity Management & Privacy Technologies Frameworks & Architectures  A Framework for Identity Management (ISO/IEC 24760, CD)  Privacy Framework (ISO/IEC 29100, CD)  Privacy Reference Architecture (ISO/IEC 29101, CD) P i R f A hit t (ISO/IEC 29101 CD)  Entity Authentication Assurance Framework (ISO/IEC 29115 / ITU-T X.eaa, CD)  A Framework for Access Management (ISO/IEC 29146 WD)  A Framework for Access Management (ISO/IEC 29146, WD) Protection Concepts  Biometric information protection (ISO/IEC 24745 FCD)  Biometric information protection (ISO/IEC 24745, FCD)  Requirements on relative anonymity with identity escrow – model for authentication and authorization using group signatures (ISO/IEC 29191, WD) Guidance on Context and Assessment  Authentication Context for Biometrics (ISO/IEC 24761, IS)  Privacy Capability Assessment Model (ISO/IEC 29190, WD) 11

WG 5 Identity Management & Privacy Technologies Roadmap ISO/IEC JTC 1/SC 27/WG 5 Identity Management & Privacy Technologies 12

…… …… Agenda … 1 1. Identity Management in IS Id tit M t i IS O/ IEC O/ IEC S tandardisation 2. Multilateral S 2 M ltil t l S ecurity it 3. The Identity Management Enabler Concept 4. Motivating the Provision of IdM Enablers by Telecoms 5. Evaluation Approach for IdM Enablers 6. Economic Evaluation of exemplary IdM Enabler “ Age Verification” 7. Conclusion and questions for discussion ... ... 13

…… …… Different parties with different … interests in communication networks interests in communication networks Service Service Provider Subscriber Network Operator Other examples  Customers/ Merchants Subscriber  Communication partners  Citizens/ ... Administration ... ... 14

…… …… … in E/ M-commerce … in a world of consortia in a world of consortia …  more partners  more complex more complex Service Service Provider relations Subscriber Network Operator Subscriber Content Content Provider ... ... 15

…… …… Multilateral S Mult late al S ecurity ecu ty … R Respecting ti Supporting Interests Sovereignty Protection of different parties and their interests Considering Conflicts ... ... 16

…… …… Multilateral S ecurity … considers conflicts considers conflicts Supporting Sovereignty Respecting Interests  Requiring each party to  Parties can define their only minimally trust in only minimally trust in own interests . own interests the honesty of others  Conflicts can be  Requiring only minimal or q g y recognised and recognised and no trust in technology of negotiated . others  Negotiated results can be g reliably enforced . ... ... Protection of different parties and their interests 17

…… …… A simplified model … for this presentation for this presentation Service Service Provider Subscriber Network Operator Subscriber ... ... ... 18