Open Identity Exchange

Origins Shortly after coming into office, the Obama administration asked the General Services Administration (GSA) how to leverage open identity technologies to help the American public interact more easily and efficiently with federal websites, such as those of the National Institutes of Health (NIH), the Social Security Administration (SSA), and the Internal Revenue Service (IRS). At the 2009 RSA Conference, the GSA sought to build a public/private partnership with the OpenID Foundation (OIDF) and the Information Card Foundation (ICF) to craft a workable identity information framework that would establish the legal and policy precedents needed to establish trust for Open ID transactions. This partnership eventually developed a trust framework model; to trust that the Identity Provider is delivering accurate data, Identity Providers must ensure that the Relying Party is legitimate (i.e., not a hacker or phisher). While direct trust agreements between relying parties and identity providers are a common solution, they become unmanageable at the scale of the Internet. Further meetings were held at the Internet Identity Workshop in November 2009, resulting in OIDF and ICF forming a joint steering committee. The committee's task was to study the best implementation options for the newly created framework. Foundation The US Chief Information Officer recommended the formation of a non-profit corporation, the Open Identity Exchange (OIX). In January 2010, the OIDF and ICF approved grants to fund the creation of the Open Identity Exchange. Booz Allen Hamilton, CA Technologies, Equifax, Google, PayPal, Verisign, and Verizon were all members of either OIDF or ICF and agreed to become founding members of OIX. OIXnet was an official, online, and publicly accessible repository of documents and information relating to identity systems and participants. It functioned as an official and centralised source of such documents and information, much like a government-operated recorder of deeds. Individuals and entities could register documents and information with the OIXnet registry to provide notice of their contents and allow access to the public or stakeholders. In 2015, the OIDF also announced plans to register all companies self-certifying conformance to OpenID Connect via the OpenID Certification Program on OIXnet. OIXnet was launched in 2015. The OpenID Foundation was the first registrant, registering the initial set of organisations, including Google, ForgeRock, Microsoft, NRI, PayPal, and Ping Identity, certifying conformance to OpenID Connect. Additional registrations were added to OIXnet throughout 2015 and 2016. The OIXnet registry was in a pilot phase as of 2016, registering new and diverse trust frameworks and communities of interest. OIX developed a chapter's policy in 2015 that allows regional OIX chapters to be established. In 2016, the OIX United Kingdom Chapter was approved by the OIX board and launched. == Government relations ==

The OIX board met with Howard Schmidt in 2011 to discuss the public–private partnership envisioned in the NSTIC strategy. The UK government's Cabinet Office joined the OIX at the board level, as it began the work on its Identity Assurance Programme, which became GOV.UK Verify. In 2015, the States of Jersey commissioned an OIX Discovery project to explore how the knowledge, expertise, and components of one of these models, the UK's GOV.UK Verify identity assurance scheme could be leveraged to provide a cost-effective solution to meet Jersey’s requirements. == OIX UK Europe Chapter ==

At the beginning of 2015, the Cabinet Office requested that the Open Identity Exchange begin exploring the legal, business, and pragmatic considerations of creating a self-sustaining UK 'chapter' of the Open Identity Exchange. Up until that point, OIX UK operated as an independent UK entity, able to administer 'directed funding' from member organisations. It had received a series of grants from the UK Cabinet Office, that were used for the collaboratively funded projects. An ad hoc board of advisers was formed of independent, experienced, public and private sector leaders who addressed policy considerations during this transition process. In addition to considering the role of OIX UK in the future, this board of advisers considered the private sector's needs for identity services, resulting in an ongoing OIX project. The Open Identity Exchange board of directors approved an OIX chapters policy at the end of 2015, allowing the formation of individual chapters affiliated with OIX in various local markets. In April 2016, the OIX UK Europe Chapter appointed its board of directors. == White papers ==

OIX white papers delivered joint research to examine a wide range of challenges facing the open identity market and to provide possible solutions. They were written by experts in the fields of technology, particularly open identity. OIX • OIX: An Open Market Solution for Online Identity Assurance Trust Frameworks • Trust Framework Requirements and Guidelines • The Personal Network: A New Trust Model and Business Model for Personal Data • Federated Online Attribute Exchange Initiatives • Personal Levels of Assurance (PLOA) • The Three Pillars of Trust UK Identity Assurance Programme (IDAP) • Overview of Legal Liability in the IDAP (In development) US National Strategy for Trusted Identities in Cyberspace (NSTIC) Source: • Comments on US NSTIC Steering Group Draft Charter and Related Governance Issues • United States National Strategy for Trusted Identities in Cyberspace Identity Ecosystem Steering Committee Plenary and Governing Board Charter • OIX Response to "Models for a Governance Structure for the National Strategy for Trusted Identity in Cyberspace" White Papers Published in 2016 Open Identity Exchange (OIX) white papers focused on current issues and opportunities in emerging identity markets. They were intended to deliver value to the identity ecosystem and take one of two perspectives: a retrospective report on the outcome of a given project or pilot, or a prospective discussion on a current issue or opportunity. OIX White Papers were authored by independent domain experts and intended as summaries for a general business audience. These include: • Use of online activity as part of the identity verification • UK private sector needs for identity assurance • Use of digital identity in peer-to-peer economy • Shared signals proof of concept • Creating a digital identity in Jersey • Just Giving and GOV.UK Verify • Creating a pensions dashboard • Could digital identities help transform consumers attitudes and behavior towards savings? • Digital identity across borders: opening a bank account in another EU country • Generating Revenue and Subscriber Benefits: An Analysis of: The ARPU of Identity == Projects ==

States of Jersey: Creating a Digital ID OIX thought that the UK Government identity assurance model could be adapted for Jersey with the support of certified UK IdPs and potential identity assurance hub providers, to meet the requirements of the Government of Jersey. They also considered that this would create an attractive market opportunity in Jersey for one or more of these providers. LIGHTest Project LIGHTest (Lightweight Infrastructure for Global Heterogeneous Trust management in support of an open Ecosystem of Stakeholders and Trust schemes) was a 3-year project that started in September 2016 and was partially funded from the European Union's Horizon 2020 research and innovation programme under G.A. No. 700321. The LIGHTest consortium consisted of 14 partners from 9 European countries, though it sought to expand even beyond, and was coordinated by Fraunhofer-Gesellschaft. The objective of LIGHTest was to create a global cross-domain trust infrastructure that renders it transparent and easy for verifiers to evaluate electronic transactions. By querying different trust authorities worldwide and combining trust aspects related to identity, business, and reputation, it would become possible to conduct domain-specific trust decisions. This was achieved by reusing existing governance, organization, infrastructure, standards, software, community, and the existing Domain Name System, along with new innovations. This approach allowed an efficient global rollout of a system to assist decision-makers in their trust decisions. By integrating mobile identities into the scheme, LIGHTest also enabled domain-specific assessments on Levels of Assurance for these identities. GOV.UK Verify The UK Government's Cabinet Office joined the OIX at board level as it began the work on its Identity Assurance Programme (IDAP). Through the OIX Directed Funding programme, a considerable number of projects were carried out under OIX governance, the results of which helped with the ongoing development of GOV.UK Verify such as how digital identities can be used in both the public and private sectors. GOV.UK Verify was built and maintained by the Government Digital Service (GDS), part of the Cabinet Office. The UK Government was committed to expanding GOV.UK Verify and helping to grow a market for identity assurance that will be able to meet user needs in relation to central government services, as well as local, health, and private sector services. GOV.UK Verify used certified companies to verify users' identity for the government. ==References==