Liberty Alliance duly unwrapped its version 1.0 specifications yesterday, outlining a standard for federated network identity sign-on as a secure method for identifying individuals using any manner of internet-connected devices.

The first phase of work undertaken by Liberty Alliance in its first year has focused on the use of so-called opt-in account-linking so that businesses and customers can share and re-use recognized sign-on procedures and preferences. Once users' accounts are federated, they can log-in and authenticate at one linked account and navigate to another linked account, without having to log in again.

This single sign-on feature is deemed critical to the future success of e-commerce and the concept could play a significant role in the development of web services.

Federated online identities are expected to provide businesses with increased opportunities on the internet, by enabling them to maintain ownership of their customer databases while still being able to work closely with business partners to share customer leads and customer data securely over any access device.

The Liberty version 1.0 specifications do not involve the exchange of personal information. Instead, they involve a format for exchanging authentication information between companies so the identity of the user is held safe, without specific details having to be shared. The user could choose which account or accounts should be linked, but could opt to maintain separate identities in different locations while still benefiting from use of a seamless sign-on.

The version 1.0 specifications will enable consumers to choose their identity provider and benefit from the convenience of simplified sign-on when navigating the internet from any device. Version 1.0 also takes "a first stab at the problems of authentication context," Timo Skytta of Nokia Mobile Software and chairman of the architecture board for Liberty Alliance confirmed to ComputerWire. This is a method that allows companies linking accounts to communicate the type and level of authentication that should be used when a user logs in to different accounts.

Authentication context may incorporate the use of attributes or data such as a mobile telephone user's call number, a digital signature, a user name and password, or some other combination. It will also account for user preferences and whether access is via a fixed or wireless device. It is an ambitious plan: "It is an issue that has not yet been tackled fully by the security vendors," Skytta confirmed to ComputerWire.

The Liberty alliance includes large organizations such as General Motors, American Airlines, and Hertz, and achieving federated identity will require some agreement on standards among these commercial businesses as much as collaboration among numerous hardware and software technology vendors. As a demonstration of the specifications' acceptance among the 65 or so Liberty Alliance member organizations, several concurrently announced plans to deliver Liberty-aware products and services. These vendors include Communicator, Entrust, NeuStar, Novell, OneName, RSA Security and Sun Microsystems.

The first products are expected to be available by the end of 2002 and industry-watchers will want to track vendor-specific "enhancements" to the specification carefully, as first-edition standards will inevitably be inadequate for many requirements and will necessitate vendor-specific approaches to overcome some security concerns.

© ComputerWire