Not your father's identity management

As service providers look for new paths to revenue, the prospect of making federated identity a marketplace of its own is becoming a very hot topic.

Most experts believe North American service providers will soon experience what is already heating up in Asian and European markets, where BT, NTT, France Telecom and others believe themselves to be the trusted source for how consumers and businesses will access applications online.

“In countries where the majority of Internet use happens through mobile devices, service providers consider identity management as a major service to monetize,” said Matthew Gardiner, director of security business units for CA and president of the Kantara Initiative (which grew out of the Liberty Alliance), who is now gearing up for the Burton Group Catalyst Conference at the end of the month, where members will showcase the identity services marketplace.

Gardiner predicts it will be a couple of years before North American carriers feel the same type of pressure now being felt in places like Japan, where identity management is at the center of security and management discussions. The consortium recently put together a Telecommunications Identity Work Group to reconcile fragmented efforts in the telco specifications development area regarding identity management.

Service providers already work behind the scenes to assert users’ identities and to stitch together identities with partners so that users have a more seamless experience when consuming content or applications from other providers. For example, affiliations to specific services (such as Facebook or MySpace) and propagation to applications like Twitter through provider-specific authentication allows subscribers to increasingly access content and services in a seamless fashion. The problem is that that type of sign-in is usually done as a value-added service for which carriers typically do not get compensated in any way. In fact, it usually happens without anyone knowing what party is responsible at all.

Today, however, most enterprise users and consumers still are burdened to register and log in to dozens of accounts online using multiple passwords. The dream is to instead have service providers (unless government, utilities or financial services companies beat them to the punch) register and credential people through a centralized mechanism. This is actually happening already with Equifax and its “Online Identity Card” (I-Card), designed to help business lower fraud risks as well as build customer loyalty. Customers “click in" to Web and e-commerce sites that subscribe to the I-card for what they tout as more “security and control” without the hassle of filling out forms or remembering multiple passwords. In addition to further bonding consumers and businesses subscribing to the I-Card, the relationships also reduce the need for enterprises to store and manage thousands or millions of customers’ personal identification information, thus closing holes through which security breaches occur.

However, it really could be telcos – over whose networks and devices people increasingly interact as part of their “personas” either at work or home— that have the advantage in the identity management marketplace. Further, the opportunity exists to not only provide authentication and authorization of identity, but to integrate payments into the process as well. The big picture is that service providers must look at how mobile devices can become “personal tokens” central to people’s lives and activities.

In emerging countries, where no social security numbers or tax IDs exist, communications service providers are already critical to their customers and countries’ governments and utilities, which need to piggyback on communications infrastructure to track bills and taxes and to resolve fraud or criminal activities.