Mobile phones and the identity utility Identity management for the 21st century 2 nd Workshop on Next Generation Electronic Identity The Hague, June 2008 Dave Birch Director, Consult Hyperion. In the world of post-modernism, it is no longer clear that any one identity is “ r eal ” — Charles Raab, Professor at the AHRB Research Centre in Intellectual Property and Technology, School of Law, University of Edinburgh, speaking at The Life of Mobile Data, University of Surrey (Guildford: 2004).

Mobile phones and the identity utility Identity management for the 21st century

2 nd Workshop on Next Generation Electronic Identity The Hague, June 2008

Dave Birch Director, Consult Hyperion.

Introduction Five minute problem definition Five minute requirement specification The big picture Five minute solution design Mobiles, yes… But how, exactly… Identity is the new money Sir James Crosby in Challenges and opportunities in identity assurance , H.M. Treasury (Mar. 2008).

Five minute problem definition

Five minute requirement specification

The big picture

Five minute solution design

Mobiles, yes…

But how, exactly…

Author: Experience Director of Consult Hyperion www.chyp.com Experience from around the world Organiser of the annual Digital Identity Forum www.digitalidforum.com Driver of the Digital Identity blog www.digitalidforum.com/blog Associated podcasts (iTunes “Consult Hyperion”) Detailed background www.dgwbirch.com

Director of Consult Hyperion www.chyp.com

Experience from around the world

Organiser of the annual Digital Identity Forum www.digitalidforum.com

Driver of the Digital Identity blog www.digitalidforum.com/blog

Associated podcasts (iTunes “Consult Hyperion”)

Detailed background www.dgwbirch.com

Author: Opinions Identity & Passport Service Forum Parliamentary Committee witness House of Lords Constitution Committee (2006) House of Commons Select Committee (2007) Royal Academy of Engineering Working Group (2006-7) Newspapers and magazines The Guardian , Prospect Columnist for SPEED and Financial World Editorial board of E-Finance & Payments Law & Policy Television, radio and podcasts

Identity & Passport Service Forum

Parliamentary Committee witness

House of Lords Constitution Committee (2006) House of Commons Select Committee (2007)

Royal Academy of Engineering Working Group (2006-7)

Newspapers and magazines

The Guardian , Prospect Columnist for SPEED and Financial World

Editorial board of E-Finance & Payments Law & Policy

Television, radio and podcasts

Author: Books Editor Digital Identity Management (May 2007) Editor Digital Money Reader (March 2008) Co-Editor Digital Identity Reader (Nov. 2007)

Editor Digital Identity Management (May 2007)

Editor Digital Money Reader (March 2008)

Co-Editor Digital Identity Reader (Nov. 2007)

A Five Minute Problem Definition Governments and goals E-borders and eBay Banks and legacies Bringing down the system from within Chat rooms and disclosure Don’t do as I do, do as I say Whistleblowers and credentials I must know what you are, not who you are Passports in-country Meg Hillier, Minister for ID Cards, describing them to the Home Affairs Committee (March 2008).

Governments and goals

E-borders and eBay

Banks and legacies

Bringing down the system from within

Chat rooms and disclosure

Don’t do as I do, do as I say

Whistleblowers and credentials

I must know what you are, not who you are

A Five Minute Solution Markitecture Meaningless but unique number MBUN Biometric register To ensure MBUN unique Sectoral identities One-way mapping from MBUN Multiple virtual identities Of different kinds But what would you do with a computer that’s not connected to the Internet? 12-year old daughter of a colleague, querying his decision to take a laptop on a camping holiday.

Meaningless but unique number

MBUN

Biometric register

To ensure MBUN unique

Sectoral identities

One-way mapping from MBUN

Multiple virtual identities

Of different kinds

Utility: Universal What if identity isn’t a particular product or service but a (regulated) utility that works in both “first life” and in “second life” and that any individual, business or public body can use? The implementation would vary by circumstance, sometimes biometric or PINs, sometimes phones, sometimes cards, stickers, watches, hats, badges or T-shirts

What if identity isn’t a particular product or service but a (regulated) utility that works in both “first life” and in “second life” and that any individual, business or public body can use?

Utility: Convenience Speed is of the essence, and now we have contactless and NFC we can deliver it to make identity work properly without getting in the way The weakest link in security is the fact that passwords are used… the Internet needs to move away from passwords and into the use of smart cards Bill Gates, speaking at Interop 2000 (ie, eight years ago)

Speed is of the essence, and now we have contactless and NFC we can deliver it to make identity work properly without getting in the way

Utility: No Special Gadgets! Everyone knows how to use a chip & PIN card without understanding PKI, tamper-resistant chips and secure personalisation strategies

Everyone knows how to use a chip & PIN card without understanding PKI, tamper-resistant chips and secure personalisation strategies

Utility: Extensibilty People should be able to build new businesses using the identity utility without special permissions or licences, it should be like broadband or electricity

People should be able to build new businesses using the identity utility without special permissions or licences, it should be like broadband or electricity

Utility: Symmetry It’s reasonable for a policeman to ask who you are, but it’s equally reasonable for you ask a policeman who he is, and it has to work so that my mum can check the gas man T he true identity of a counterparty may be the least interesting fact about them in a commercial transaction — John Browning in Wired . 5(11): p.65(6) (November 1997).

It’s reasonable for a policeman to ask who you are, but it’s equally reasonable for you ask a policeman who he is, and it has to work so that my mum can check the gas man

The Mobile Solution Connection Nexus between local and remote environments Processing More than enough processing power already Disconnection One, two and three-factor authentication Utility implementation that does not require new technology If I need to buy something quickly, I just grab my cell phone and run out the door Mihoko Iguchi, 43, Tokyo dress shop owner, Washington Post (19th December 2005).

Connection

Nexus between local and remote environments

Processing

More than enough processing power already

Disconnection

One, two and three-factor authentication

Utility implementation that does not require new technology

The Mobile Roadmap Frameworks Standard “gateways” Authentication Interoperability Federation

Frameworks

Standard “gateways”

Authentication

Interoperability

Federation

Conclusions We have the technology… Smart cards Mobile phones Public key infrastructure Biometrics We don’t have the vision Cardboard age concepts and Computer age systems in Communication age contexts It is the business of the future to be dangerous… the major advances in civilization are processes that all but wreck the societies in which they occur Alfred North Whitehead (1861-1947)

We have the technology…

Smart cards

Mobile phones

Public key infrastructure

Biometrics

We don’t have the vision

Cardboard age concepts and

Computer age systems in

Communication age contexts

For further information For more thought leadership… www.digitalmoneyforum.com/blog www.digitalidforum.com/blog www.apple.com/itunes/store/ search for podcast “consult hyperion” or visit www.chyp.com/podcasts.php

For more thought leadership…