The E-Authentication Initiative: A Status Report

The E-Authentication Initiative: A Status Report

Presented at Educause MeetingJune 16, 2004

The E-Authentication Initiative

2


E-Authentication provides a blueprint for online identity validation that will enable the American public to access government services in a secure, trusted environment with credentials of their choosing

What is the E-Authentication Initiative?

E-Authentication Enables E-Government

3


What are the Goals of the Initiative?

Build and enable mutual trust needed to support wide-spread use of electronic interactions between the public and Government

Minimize the burden on the public when obtaining trusted electronic services from the Government

Deliver common interoperable authentication solutions, appropriately matching the levels of risk and business needs

The Result: Businesses & individuals will be empowered to conduct business with Government at all levels using e-identity credentials provided by trusted institutions

4


The Concept of E-Authentication

Credential Service Provider

Agency ApplicationAccess

Point

Application User

Step 3Step 2Step 1

Step 1:

At access point (portal, agency Web site or credential service provider) user selects agency application and credential provider

Step 2:

•User is redirected to selected credential service provider

•If user already possesses credential, user authenticates

•If not, user acquires credential and then authenticates

Step 3:

Credential service hands off authenticated user to the agency application selected at the access point

5


Government to Citizen

Government to Government Internal Effectiveness & Efficiency

1. USA Service 2. IRS Free File 3. E-Loans 4. Recreation One Stop5. GovBenefits

1. E-Vital 2. Grants.gov3. Disaster Mgmt4. Geospatial One Stop 5. SAFECOM

1. E-Training 2. Recruitment One Stop3. Enterprise HR Integration4. E-Clearance 5. E-Travel 6. Integrated Acquisition7. E-Records Management8. Payroll/HR

E-Government Strategy: Improving Service for Citizens

Managing PartnerOPMOPMOPMOPMGSAGSANARAOPM

Managing PartnerSSAHHSFEMADOI

FEMA

Managing Partner

GSATreasDoEdDOIDOL

Government to Business1. Federal Asset Sales2. Online Rulemaking Mgmt3. Expanding Tax Products for Businesses4. Consolidated Health Informatics 5. Business Gateway6. International Trade Process Streamlining

Managing Partner GSAEPATreas

HHSSBADOC

E-Authentication

6


Critical Elements of E-Authentication

Policy

Applications

Technology

Trusted Credential Service Providers

Program Management

7


Policy

Overall program governance

Credential assurance levels (OMB & National Institute of Standards and Technology)

Certification of credential providers

Business model

8


Applications

6500 Government applications with business and public

Role of Gov’t Paperwork Elimination Act (GPEA) and the Office of Management and Budget (OMB) mandates

Risk assessments (Carnegie Mellon)

9


Technology Requirements

Federated model

Standards-based

COTS-based

Flexible

Scalable

Extensible

Reliable

Manageable

Supportive of multiple protocols

10


Trusted Credential Service Providers

Key tenet of E-Auth is re-use of existing, trusted 3rd party credentials

Allow US citizens, business and government employees to use electronic identity credentials they already have for E-Government purposes

Requires ability to map those 3rd party credentials to E-Authentication policy framework

E-Authentication-developed Credential Assessment Framework is primary tool for mapping – may be modified for use across different business lines

11


Program Management

Managing relationships: Agency Application Owners CSPs

Maintaining tools: E-RA CAF Trust List Approved Technology Providers List Interface Specs Cookbooks Implementation Guides

Developing & Implementing business model

Keeping the trains running

12


E-Authentication Progress to Date

Applications Deployed: 1 GSA’s eOffer, Level 3 (PKI), Hosted CAM

Credentials on Trust List: 12 9 PKI, 3 User ID/Password Discussions underway with individual banks, as well as FSTC

(Bank Industry group)

Approved Technology Providers: 5 Products from Entegrity, HP, Oblix, RSA, Sun Additional products undergoing testing in Interop Lab

Pilots Underway: 8 Grants.gov, EPA, 2 GSA, NIH, NPS, Treasury, VA

13


Near-Term Focus

Delivery of Authentication Service Component of the FEA Steering Committee ratification of technical architecture End user implementation manuals and tools

E-Grants Pilot USDA, NSF, ORC, HHS

Financial Institutions Pilot Financial Services Technical Consortium

Steering Committee Approved Pilots 6 pilots lead by GSA, EPA, Treasury, NPS, VA, NIH

14


For More Information

Phone E-mail

Brian Doherty 703-872-8606 [email protected]

Stephen Sill 703-872-8594 [email protected] Manager

Websiteshttp://cio.gov/eauthenticationhttp://www.eapartnership.org/

http://cio.gov/fpkipa

Documents

The E-Authentication Initiative: A Status Report