Technical Proposal

1
What does it take to Federate?
Chris Louden Chris.Louden_at_enspier.com
2
Agenda

• What does it take to build a federation?
• Common, Common, Common

3
Common Business Processes

• Business goals should drive everything
• Understand the drivers before you begin
• Everything that follows should be tailored to the
  underlying business goals of the federation

4
Common Policy Infrastructure

• Federations inherently require some level of
  trust between members
• Common Policies define trust boundaries
• Identity, security, reliability, access rights,
  etc
• Trust requires common understanding of what is
  expected of members

5
Common Technical Specifications

• Technical interoperability improbable and
  expensive without detailed specifications
• Recommend Use Case driven specifications
• Business Drivers ? Business Use Cases
• Business Use Cases ? Interface Specifications
• Shared Technical Infrastructure?
• Federation Portal, CA, etc
• Specs serve Business Drivers Policies

6
Common Agreement Infrastructure

• Legal Relationship among Federation members must
  be well defined
• MOU, Contract, etc
• Parties to the agreement
• Pair-wise? Member-member
• Centralized? Member-Federation
• Agreements include requirement to comply with
  other common elements
• Makes the common elements binding

7
Common Governance Infrastructure

• Change Management
• Business Environment, Goals, Drivers
• Specifications, Policies, Agreements
• Membership
• Communication Collaboration
• Common working groups
• Specify how decisions are made

8
Federations are like Networks

• Remember Metcalfs Law
• the value of a network is proportional to the
  square of the number of users of the system
• Each new member increases the value of the
  network for every member.
• Membership Usage drive ROI

Wikipedia.org
9
Federal E-Authentication Trust Model
1. Establish e-Authentication risk and assurance
levels for Governmentwide use (OMB M-04-04
Federal Policy Notice 12/16/03)
2. Establish standard methodology for
e-Authentication risk assessment (ERA)
3. Establish technical assurance standards for
e-credentials and credential providers (NIST
Special Pub 800-63 Authentication Technical
Guidance)
4. Establish methodology for evaluating
credentials/providers on assurance criteria
(Credential Assessment Framework)
6. Establish common business rules for use of
trusted 3rd-party credentials
5. Establish trust list of trusted credential
providers for govt-wide (and private sector) use
10
Discussion