Doing Authorisation, Consent, and Delegation Right with UMA - Paris Identity Summit 2016
•Download as PPTX, PDF•
0 likes•242 views
Consumers are often bombarded with opt-in “requests” to share their personal data, losing trust as they assent. In this session, Eve Maler, will share insights and lessons learned from active PoCs that require a new generation of privacy and consent. Learn how UMA can be applied to authorization, consent, and delegation scenarios across a wide variety of sectors, and how the ForgeRock Identity Platform is delivering a practical UMA solution today.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (6)
Similar to Doing Authorisation, Consent, and Delegation Right with UMA - Paris Identity Summit 2016
Similar to Doing Authorisation, Consent, and Delegation Right with UMA - Paris Identity Summit 2016 (20)
More from ForgeRock
More from ForgeRock (20)
Recently uploaded
Recently uploaded (20)
Doing Authorisation, Consent, and Delegation Right with UMA - Paris Identity Summit 2016
- 1. © 2016 ForgeRock. All rights reserved. Doing Authorisation, Consent, and Delegation Right with UMA Eve Maler | VP Innovation & Emerging Technology | @xmlgrrl Paris Identity Summit 15 November 2016
- 2. © 2016 ForgeRock. All rights reserved. flickr.com/photos/vincrosbie/16301598031/ CC BY-ND 2.0 In 2Q2016, US mobile operators added connected cars faster than mobile devices – and also faster than anything else Apr 2016
- 3. © 2016 ForgeRock. All rights reserved. Digital transformation challenges End users Regulations Industry Your organization
- 4. © 2016 ForgeRock. All rights reserved. Challenge scenarios
- 5. © 2016 ForgeRock. All rights reserved. Scenario 1: Citizen attribute sharing for benefit management Basic profile data service Eligibility answer service Handicap badge issuer app Consent and delegation manager • Monitor and make changes over time • Holds no PII itself • Data lives in multiple services natively In the next stage of the project … [t]he team will be investigating and testing this to further address the thorny issues of trust and transparency when gaining citizens’ permission. … “[E]ligibility for some services can be quite dynamic, for example, as the level of an individual’s in-work benefits varies, and it may be necessary to carry out on-going eligibility checks from time to time. [A new technology would give] the individual a place to go online where they can see and manage all the consents they have given to different organisations. Until now, managing ongoing consent was tricky,” [Ian Litton] added. “Typically, you asked individuals to consent at a point in time. They tick the T&Cs, which they never see again.” UK Authority Local Digital, 3rd March 2016 Health status service
- 6. © 2016 ForgeRock. All rights reserved. Employer- run tax data service Accounting app Employer- run sharing manager • Sharing with other parties • Implemented cross- service • Buy vs. build Scenario 2: Tax data sharing with an accountant
- 7. © 2016 ForgeRock. All rights reserved. Scenario 3: Sharing health data access in an ecosystem Fitness watch with cloud service MRI machine with cloud service Physician portal Health cloud with sharing manager EHR service PHR app 3rd party smart scale with cloud service Clinical research • Selective sharing for multi-way data flows • Enabling partner ecosystems
- 8. © 2016 ForgeRock. All rights reserved. Bonus scenario 3a: Family caregiver prescription management Inconsistency across the departments [makes it hard]. It would be easier if every department followed the same process even if you had to do it for each different requirements depending on who you are dealing with. 72 year old Aroha takes a number of prescriptions she asks her son to help her manage them through her patient portal. Aroha gives her son Bailey access to view her prescriptions through her patient portal. Bailey then asks the portal to send him notifications of his mum’s blood sugar levels.
- 9. © 2016 ForgeRock. All rights reserved. Introducing User-Managed Access (UMA)
- 10. © 2016 ForgeRock. All rights reserved. Privacy is not secrecy and privacy is not encryption Context Control Choice Respect The right moment to make the decision to share The ability to share just the right amount The true ability to say no and to change one’s mind Regard for one’s wishes and preferences
- 11. © 2016 ForgeRock. All rights reserved. resource server authorization server resource owner requesting party client manage control protect delegate revoke authorize manage access negotiate deny A federated authorization architecture in action data service sharing manager
- 12. © 2016 ForgeRock. All rights reserved. An experience of selectively sharing health data with UMA Patient view Doctor view
- 13. © 2016 ForgeRock. All rights reserved. “The enterprise interprets access control as damage and routes around it.”
- 14. © 2016 ForgeRock. All rights reserved. Scenario 4: Business app access sharing with partners Custom app/ service ZZ In-house IdP/AS Custom app/ service AA … Custom app/ service ZZ Custom app/ service AA … • Constrained delegated access • Central management of cloud/partner/app interactions • Automated pairing of services and entitlement provisioning
- 15. © 2016 ForgeRock. All rights reserved. Key benefits to users • Sharing, unsharing, and editing of sharing preferences allowed at any time, without external influence • Not just opt-in or opt-out when asked • A selective sharing paradigm for an IoT landscape that demands it • Possible to offer a service that centralizes sharing preference management across data services for user convenience • The central service doesn’t see any of the data • Data is fed fresh from each individual service • The user can selectively share whatever “grain” of access each data service offers • Such as read vs. write, or weight vs. fat mass
- 16. © 2016 ForgeRock. All rights reserved. Key benefits to service operators: consumer-facing • A permission model that scales for user growth • Enables living up to a promise of transparency and building trusted digital relationships • Enables addressing new regulations that demand freer choice in consent
- 17. © 2016 ForgeRock. All rights reserved. Key benefits to service operators: for the enterprise • Enables centralizing delegation and access control in loosely coupled environments for better governance • CASBs are built for SaaS vendor solutions, not internal apps • Standard security model based on existing well-understood technologies reduces complexity • OAuth, JWT, OpenID Connect... • Standard permission model encourages business ownership of entitlements • Too often, they’re still buried in procedural code
- 18. © 2016 ForgeRock. All rights reserved. Key benefits to service operators: for all use cases • Constrained delegation of resource access vs. impersonation • Now required when multiple factors – or no passwords at all – are in the mix • Also required for protecting API and streaming data
- 19. © 2016 ForgeRock. All rights reserved. Let me sum up
- 20. © 2016 ForgeRock. All rights reserved. The CMO and the CPO can and must meet in the middle “Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. … In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller…” We value personal data as an asset Our customers’ wishes have value Our customers have their own reasons to share, not share, and mash up data, which we can address as value-add Risk management perspective Business perspective
- 21. © 2016 ForgeRock. All rights reserved. Thank you!
Editor's Notes
- Latest evidence: Spotify last August: simple privacy policy change alarmed customers Complaints, threats to leave (e.g. new Apple Music) Lesson: commoditized? low switching costs, lack of sensitivity can hurt you even if the change wasn’t materially negative Mobile Ecosystem Forum IoT consumer survey: trust issues biggest concern NEW: On The Dark Web, Medical Records Are A Hot Commodity: Medical records go for US$60 each NEW: “In January of this year, Melbourne’s largest hospital network was significantly impacted when a computer virus affected the hospitals Windows XP systems disrupting meal delivery and pathology results.” (See: http://www.dw.com/en/spotify-feels-the-burn-after-privacy-policy-flub/a-18665269) (See: http://www.fastcompany.com/3061543/on-the-dark-web-medical-records-are-a-hot-commodity) (See: http://securityaffairs.co/wordpress/49472/data-breach/data-breaches-healthcare-sector.html) (See: http://www.bizreport.com/2016/04/21-globally-have-concerns-that-iot-machines-will-take-over-t.html) Image source: https://www.flickr.com/photos/vincrosbie/16301598031/ (See: http://www.pcworld.com/article/3106410/iot-is-now-growing-faster-than-smartphones.html )
- [animation] End users: Customers, consumers, citizens, patients: They are cynical about data sharing in the post-Snowden era (see: Spotify), but demand a consistent digital experience across all channels [animation] Your organization: It’s trying to reach “escape velocity” with its strategic innovations, while navigating a cloud and API strategy that makes sense and a budget that never seems to grow. [animation] The regulatory landscape: With GDPR and PSD2 (the revised Payments Services Directive) recognizing both loosely coupled services and the autonomy of individuals, consent to share data has gotten a lot more important. And security and data protection are just the start of the conversation. [animation] The industry landscape: It now includes the Internet of Things, which require newly constrained user experiences, along with other new technologies that affect user trust models such as blockchain and microservices.
- In this familiar scenario, citizens interact with online data services to consent (authorize or permission) the transfer of some attributes about them elsewhere so that a decision can be made about whether they can be issued a handicap badge. Since in this UK scenario the citizen is currently responsible for re-applying for eligibility every three years, and eligibility can actually come and go fairly dynamically, it’s desirable for a citizen instead to monitor and control access to their attributes in more empowered way, so they can just shut off consent whenever they don’t need the badge anymore and don’t want others getting access to that data. To do this you can add a [animation] service that contains no PII itself but specializes in handling consent and delegation on the citizen’s behalf can make this monitoring and management over time possible, no matter how many data services are deployed. [summary animation]
- It’s not unusual these days to want to build person-to-person data-sharing capabilities into applications. We’re used to it in productivity suites, so why not [animation] when doing our taxes? The problem is that it’s not a core competency for any one company to run authorization services (same as the tax data service), and they’re likely to want to [animation] buy this functionality or even outsource it. Also, sharing with outsiders means that they and their applications, by definition, [animation] may be outside our own domain. It’s useful to address these challenges with an architecture that recognizes these boundaries. (In the UK, the equivalent to the US’s “W-2 form” would be the “P60 form”.) [summary animation]
- If you’re in the business of delivering a Health Cloud, and offer cloud services related to smart devices that you make, then it’s probably clear now why offering a sharing manager independently of your various data services for allowing patients to share data with physicians, caregivers, and others could be attractive for both compliance and your own company’s trustworthiness. But it’s also possible to allow [animation] two-way data flow, so that when providers generate data, patients can store it back in their PHRs in a permissioned fashion. And because authorized sharing is managed separately from data services, you can forge [animation] relationships with partners that make IoT devices and related cloud services. And patients could finally have a clear way to [animation] authorize the donation of their sensitive health data for use in clinical research. [summary animation]
- If you’re in the business of delivering a Health Cloud, and offer cloud services related to smart devices that you make, then it’s probably clear now why offering a sharing manager independently of your various data services for allowing patients to share data with physicians, caregivers, and others could be attractive for both compliance and your own company’s trustworthiness. But it’s also possible to allow [animation] two-way data flow, so that when providers generate data, patients can store it back in their PHRs in a permissioned fashion. And because authorized sharing is managed separately from data services, you can forge [animation] relationships with partners that make IoT devices and related cloud services. And patients could finally have a clear way to [animation] authorize the donation of their sensitive health data for use in clinical research. [summary animation]
- With apologies to John Gilmore’s famous saying about the ‘net and censorship IT manages hundreds of API-fronted apps in the enterprise (and some outside). Alice is an employee who needs to delegate constrained access to app features/functions to fellow employees and partners within the ecosystem, giving IT – and herself – centralized visibility into the access granted. Image source: "John Gilmore Portrait" by Neurosynthetic - Own work. Licensed under CC BY-SA 4.0 via Wikimedia Commons - http://commons.wikimedia.org/wiki/File:John_Gilmore_Portrait.jpg#/media/File:John_Gilmore_Portrait.jpg
- Inside the enterprise, the [animation] Share button in Google Apps gives us a good way for avoiding less-secure patterns like password-sharing. But even though enterprises may have hundreds of API-fronted services and apps, they probably don’t have Google’s resources to develop a nice delegated access model for them. Some services are [animation] owned by SaaS vendors, some are internal, some are legacy with an API shim. And sometimes employees need to share access with partners. …expand… [summary animation]
- New regulations are not just codifying current data protection practice Many are giving user consent a much greater role in the privacy picture At the same time, more organizations are recognizing that personal data has got to be a shared asset You need to provide custodianship but also a relationship (See: https://iapp.org/media/pdf/resource_center/GDPR-final.pdf)