re:ID Podcast

As more NFC-enabled devices are being introduced into the market it's important to make sure they all work the same way. FIME tests these devices to make sure they meet industry standards. The company has been testing systems for Isis, the NFC project underway in Austin, Texas and Salt Lake City. Stephanie El Rhomri, new services marketing manager at FIME, talks about the work the company is doing with Isis and the importance of testing and certification.

The Criterion Systems pilot is an attribute exchange network that will enable consumers to securely share information, enhance the user experience and reduce fraud, says David Coxe, CEO of ID Dataweb and cofounder of Criterion Systems. The concept is to simplify the transaction model and enable participants in the ecosystem to get to market and provide those services in a cost effective way for replying parties. The system will be piloted in the financial services sector and online auctions.

In some media reports the National Strategy for Trusted Identities in Cyberspace has been referred to as an Internet driver license so the fact that an association that represents issuers of those documents may seem like a no brainer. Regarding ID's Gina Jordan spoke with Geoff Slagle, director of identity management at the American Association of Motor Vehicle Administrators about the pilot. AAMVA will lead a group of private industry and government partners to implement and pilot the Cross Sector Digital Identity Initiative. The goal of this initiative is to produce a secure online identity ecosystem that will lead to safer transactions by enhancing privacy and reducing the risk of fraud in online commerce.

Internet2 has been in the online identity business for more than a decade so its involvement with the National Strategy for Trusted Identities in Cyberspace may seem like a given. Internet2 will be working on building a privacy infrastructure for the identity ecosystem, including anonymous credentials, something that has been missing thus far, many say. Regarding ID's Gina Jordan spoke with Kenneth Klingenstein, director of middleware for Internet2 about the pilot. "Our goal is to provide a consistent privacy infrastructure that spans all contexts so that whether you're functioning as a citizen, as a consumer, as a worker, you've seen a common set of tools used in a common way to manage privacy," Klingenstein says.

Daon is no stranger to large-scale identity projects, being involved in national ID and border management projects spanning the globe. The company's X-Products group was chosen as a pilot award recipient for the National Strategy for Trusted Identities in Cyberspace. Regarding ID's Gina Jordan spoke with Cathy Tilton, vice president of Standards and Technology at Daon and the lead for Daon's NSTIC pilot program about the award. Daon is providing an identity platform using smart phone technologies that can host multiple authentication methods and do risk based authentication. "That technology is based on using your smart phone as a multi-factor authentication platform into traditional applications, Web apps and mobile apps," Tilton explains. "It hosts up to eight different authentication methods, both traditional and biometric methods, and then based on the risk level of the transaction that's requested, then it would invoke some combination of those authentication methods to get to the assurance that is needed for that transaction." Daon will also be piloting two other portions, including a research agenda, which includes Purdue University. Researchers will look at the usability and accessibility, privacy, security, performance and user acceptance of the solution. The last area will be an operational pilot. Daon teamed with AARP, PayPal, the American Association of Airport Executives, Purdue University's IT department so and then a major bank. Each will be utilizing this technology in a pilot mode and will be collecting data and getting feedback for that as well.

Resilient Network Systems is one of five companies that were awarded a grant to pilot part of the National Strategy for Trusted Identities in Cyberspace. Pat Reilly, executive vice president of business development at Resilient, spoke with Regarding ID's Gina Jordan about the award and what the company will be piloting with the award. Resilient will be doing two projects, one around health care and another around child safety online. "How do I make it so that doctors, insurers and physicians know how to find the information about me from other doctors and labs, etc.," Reilly asks. "How does that whole chain of sharing happen across the health care field?" "And then the second pain that we looked at was basically child safety, online safety. So how do you make sure that the identities of children aren't being misused, that people that purport themselves to be a child indeed are or are not a child and so taking all of that kind of nastiness out of the Internet," Reilly says.

Jeremy Grant, senior executive advisor for identity management and head of the National Program Office for the National Strategy for Trusted Identities in Cyberspace, talks about the pilots awarded and some of the common themes linking the awardees. Grant also talks about the Identity Ecosystem Steering Group and what else the national program office is working on, including plans for next year.

The 2012 Black Hat conference made headlines claiming iris biometrics had been hacked. But don't go sounding the warning alarms quite yet. While it's true that researchers discovered a potential vulnerability, there are countermeasures in place that make the hack impossible, or at least improbable, in the real world. Regarding ID's Gina Jordan spoke with Arun Ross, associate professor at West Virginia University, who was one of the researchers on the project. "It is good to know about these vulnerabilities, but what is more important is to report the fact that there are countermeasures in place that can potentially deflect these attacks," Ross says. "Vulnerabilities have to be reported because that would allow researchers worldwide to further develop algorithms that can successfully make their systems robust to future attacks."

The revised draft of FIPS 201-2 was released and includes quite a few changes. Additional contactless functionality, new biometrics and mobile abilities are all proposed to be included in future generations of the government credential. Neville Pattinson, senior vice president of Government Sales at Gemalto Inc., talks about these changes and some concerns he has about deploying new credentials and an infrastructure to support them.

Large, high profile events, like the London 2012 Olympics, need to be secure while also enabling individuals to get where they need to go without too much of a security hassle. Mark Joynes, director of Product Management at Entrust, explains how security and identity plans for these events are created. He also discusses Entrust’s involvement with the Interpol employee credentials that is used for crossing borders as well as physical and logical access to Interpol facilities and networks.