eekim.com: EEK Speaks

Tue, Jul 06, 2004

Identity Commons: Empowering the Individual #

At last month's PlaNetworkConference, BlueOxenAssociates proudly demonstrated the first IdentityCommons system for SingleSignOn. Conference attendees could access the PlaNetwork Wiki (which we hosted), LivingDirectory (for online profiles), NeoSociety (a social networking site), and the conference site itself, all with one username and password. Although I've mentioned this work in passing on a few occasions, I've neglected to explain exactly what IdentityCommons is about. (1LG)

In short, we're building a system where individuals have full control over their digital profiles. It's an idea that was heavily inspired by the AugmentedSocialNetwork paper that was published last year. (1LH)

Here's how the system works. Individuals have one or more global identifiers -- e-names -- and IdentityBrokers? associated with their e-names. (1LJ)

These IdentityBrokers? know three things about you: (1LK)

How to authenticate you (e.g. your password). (1LL)
Where your profile data is located. (1LM)
Link contracts that define who can access your data and what they're allowed to do with it. (1LN)

The latter two points are critical, because they differentiate this system from efforts such as LibertyAlliance and MicrosoftPassport. IdentityBrokers? know where your data is, but they don't necessarily store the data themselves. There is no central repository. Your data can be completely distributed across multiple sites. The only way sites can access your data is if you give them permission to do so via the link contracts. (1LO)

There are two components to all of this: the technology and the social/legal agreements. The latter is the hard stuff. It's not enough to build systems that can negotiate and agree on contracts; the organizations behind these systems have to respect these contracts. That's why IdentityCommons exists. IdentityCommons is a member-owned ChaordicOrganization? founded by OwenDavis, whose primary purpose is to work out and enforce these social and legal agreements. (1LP)

e-names and XRI (1LQ)

I'll have more to say about social agreements another time, most likely in response to other people's queries and comments. In the meantime, here are a few more technical details. (1LR)

E-names are based on an OASIS standard called XRI -- eXtensible Resource Identifiers. Think of them as extended URIs. E-names are (mostly) persistent, globally unique, globally resolvable identifiers. E-names have multiple forms, but the ones most people will see are: (1LS)

  =eekim
  @blueoxen*eekim    (1LT)

The first form is part of a flat, global namespace (as specified by "="). Sometime in August, individuals will be able to register global e-names as part of an IdentityCommons fundraiser. The second form is an e-name associated with an organization (as specified by the "@"). That's my actual, working e-name. (1LU)

E-names are associated with e-numbers, which are persistent, numerical addresses. (Think IP addresses, except persistent.) You can associate multiple e-names with an e-number. In other words, requests for the email address of =eekim and @blueoxen*eekim would go to the same place, because they would both be associated with the same e-number. (1LV)

You can use e-names for SingleSignOn, and you can also use them for data sharing and synchronization. For example, an e-commerce site could regularly request your latest contact information from your IdentityBroker via your e-name, and it would get it -- provided you give them permission. That information might be stored at another e-commerce site or at a social networking site or at a gaming community to which you belong. Neither the e-commerce site nor the IdentityBroker care where that information lives. (1LW)

Why do users need to remember yet another identifier format? Why not use email addresses? That would defeat the purpose of what this system is supposed to be about. Your email address should be your information, and you should control how it is used. If you just gave your email address out indiscriminately, that leaves you vulnerable to spam, which is the status quo. If you passed out an e-name, you couldn't be spammed -- folks would have to get your explicit permission to get your email address. (1LX)

Why not use URIs? Two reasons: They're not persistent, and they're not user-friendly. One of the nice things about working with the OASIS XRI Technical Committee is that they are accomodating. None of the other TC members have had to worry about identifiers being user-friendly, because only software has seen those identifiers. However, they have already made some changes in their 1.1 spec to accomodate our desire for the identifiers to be more user-friendly. (1LY)

SingleSignOn (1LZ)

We've got the basic XRI resolution working and a SingleSignOn system working on top of that. The protocol is available on the IdentityCommons Wiki. The protocol looks just like any other SingleSignOn protocol, and in fact, will most likely resemble the LibertyAlliance and SAML spec even more closely over time. Our intention is to use what's good and available, not to reinvent the wheel. (1M0)

I wrote the Perl implementation of the client library (XDI::SPIT), and there are currently PHP and Java versions as well. One way you can contribute immediately is to develop implementations in other languages (Python anyone?). The other way is to integrate these libraries into your tools. Note that all of this stuff is technically pre-alpha. It will change. That said, the APIs should remain fairly stable. It's good enough for people to start using immediately. (1M1)

Link Contracts and XDI (1M2)

The most important pieces of all this are the data interchange protocol and the link contracts format. FenLabalme, the chief architect of the IdentityCommons project, is working hard on this right now, with help from VictorGrey, who implemented the first IdentityBroker and also founded LivingDirectory. (1M3)

Both of these pieces will be built on top of XDI (XRI Data Interchange), an XML application that is currently going through the standardization process. This is not something that's being designed from scratch. XDI is based on previous work developed by OneName? (now Cordance). (1M4)

How does FOAF fit into all of this? The short answer is, "It will." Think of what we're doing as FOAF with authentication and link contracts. To be brutally honest, I can't accurately assess this question until I see the XDI stuff, but I see no reason why XDI won't be able to interoperate with FOAF, and vice versa. In fact, I'll be gathering with Fen, Victor, and some other folks tonight to start exploring that possibility. (1M5)

What's Next? (1M6)

This is without a doubt a grassroots effort, but there's some serious technical and intellectual weight behind it. The technical specs are based on OASIS standards, with representatives from major corporations. The global registry for e-names will be operated by NeuStar, which operates the .biz and .us registries among many others. Several of the people working on IdentityCommons participated in LibertyAlliance. (1M7)

Realistically, Amazon.com and Visa aren't going to adopt this overnight. Once user demand passes a certain threshold, however, companies are going to have to start paying serious attention. Right now, users don't have a choice. It's give up your data or nothing. Once users realize they have a choice, I firmly believe that people will opt for privacy over the status quo. (1M8)

Our strategy for getting to that threshold is to target civil society groups. So far, response has been outstanding, and I hope that this blog entry generates additional interest. SingleSignOn and data sharing solves an immediate technical need, and the fact that it does this while respecting individual privacy is a huge bonus. (1M9)

What's my role in all of this? BlueOxenAssociates is about improving collaboration for a better world. This system fits the bill perfectly. Not only does it promote tool interoperability, it does so in a way that will help improve people's lives. I'm proud to be one of the project's many contributors right now, and I'm proud that BlueOxenAssociates will be one of the first large-scale users of the system when our collaboratories go live next year. (1MA)

If you want to help, more information is available at the IdentityCommons Wiki. (1MB)

/collaboration | Posted at 4:09pm