 Security: Identity ManagementThis newsletter is sponsored by Fluke NetworksNetwork World's Security: Identity Management Newsletter, 10/17/07How the identity oracle could solve the privacy problemBy Dave KearnsBob Blakley, principal analyst at the Burton Group has, from time to time, talked about the “identity oracle.” Currently there are none, but Bob is convinced that there is a sound business model for one, which will – in the fullness of time – allow one to sprout, grow and flourish. This will happen, because – in Bob’s words: “…as long as we continue to try to solve privacy problems using technology, we are going to continue to fail, and the Internet will continue to lack an identity layer, and it will continue to be a privacy hazard. Identity and privacy are not technology problems – they’re social, legal, and economic problems – and no technology can solve these problems.” But the identity oracle can solve the privacy problem. Let’s say there’s a person, we’ll call him “Bob,” who wants to buy some wine from an Internet site and have it shipped to his house. In today’s market, Bob must provide the retailer with his credit card information, his shipping and billing addresses (because wine can only be shipped to certain states) and Bob must be home when it is delivered in order to prove to the delivery person that he is of legal age to buy alcoholic beverages.
None of that information needs to go to the wine seller (and, thus, to whomever the wine seller wishes to disclose it, either for free or for cash). Bob simply indicates to the wine seller who his identity oracle is. The wine seller asks the oracle: “Can Bob legally buy wine and receive it at his home address?” To which the Oracle replies either “yes” or “no.” If yes, the following transactions can occur: 1) The wine seller tells the oracle to bill Bob for the wine purchase. The wine seller cannot spam Bob (either by e-mail or snailmail) as it doesn’t know his address. Neither the bank nor the carrier knows what it is that Bob purchased. Only Bob and the oracle can reconstruct the entire transaction. So why trust the oracle? As Blakley puts it: “The identity oracle charges the wine seller and other relying-party customers money for its services. The asset on the basis of which the identity oracle is able to charge money is its database of personal information. Because personal information is its only business asset, the identity oracle guards personal information very carefully. Because disclosing personal information to relying-party customers like the wine seller would be giving away its only asset for free, it strongly resists disclosing personal information to its relying-party customers. In the rare cases in which relying parties need to receive actual personal data (not just metadata) to do their jobs, the identity oracle requires its relying-party customers to sign a legally binding contract stating what they are and are not allowed to do with the information.” The identity oracle lies on the cusp of an escrow service and a Swiss bank, but it is a compelling and fascinating idea, isn’t it?
|
| Contact the author: Dave Kearns is the editor of IdM, the Journal of Identity Management as well as a consultant to both vendors and users of IdM technologies. He's written a number of books including the (sadly) now out of print "Complete Guide to eDirectory." His other musings can be found at the Virtual Quill, an Internet publisher which provides content services to network vendors: books, manuals, white papers, lectures and seminars, marketing, technical marketing and support documents. Virtual Quill provides "words to sell by..." Find out more by e-mail. Comments to this newsletter can be e-mailed to Dave here. This newsletter is sponsored by Fluke NetworksARCHIVEArchive of the Security: Identity Management Newsletter. BONUS FEATUREIT PRODUCT RESEARCH AT YOUR FINGERTIPS Get detailed information on thousands of products, conduct side-by-side comparisons and read product test and review results with Network World’s IT Buyer’s Guides. Find the best solution faster than ever with over 100 distinct categories across the security, storage, management, wireless, infrastructure and convergence markets. Click here for details. PRINT SUBSCRIPTIONS AVAILABLE International subscribers, click here. SUBSCRIPTION SERVICESTo subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here. This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription. Advertising information: Write to Associate Publisher Online Susan Cardoza Network World, Inc., 118 Turnpike Road, Southborough, MA 01772 Copyright Network World, Inc., 2007 |
No comments:
Post a Comment