Yearly Archives: 2019

Request for Review and Comment: PCTF Model Overview Discussion Draft V0.02 Review

STATUS: This review is now closed. Thank you for your participation!

Invitation:

DIACC is pleased to provide the Pan-Canadian Trust Framework (PCTF) Model Overview Discussion Draft. DIACC invites all interested parties to comment including identity issuers, identity consumers, developers, and potential users.

Veuillez trouver la traduction française ci-dessous…

Context:

The purpose of the open commentary is to ensure transparency in development and diversity of truly Pan-Canadian, and international, input. This discussion draft has been developed by the DIACC Trust Framework Expert Committee (TFEC) that operates under the DIACC controlling policies and benefits from broad and diverse public and private sector stakeholder representation. In alignment with our Principles for an Identity Ecosystem, processes to respect and enhance privacy are being prioritized through every step of the PCTF development process.

DIACC expects to modify and improve this discussion draft based on public comments. Comments made during the review will be considered for incorporation to the next draft and DIACC will prepare a disposition of comments to provide transparency with regard to how each comment was handled. This draft will be translated to French when it becomes more stable.

To learn more about the broad Pan-Canadian Trust Framework vision and benefits-for-all value proposition please review the Pan-Canadian Trust Framework Overview | Aperçu du cadre de confiance pancanadien.

PCTF Model Overview Summary:

The purpose of this document is to provide a high-level overview of the Pan-Canadian Trust Framework (PCTF). The document includes a recap of contextual information, PCTF goals and objectives, and an outline of the functional areas with which the PCTF is primarily concerned. This outline provides readers a general sense of the information with which the PCTF is concerned and the various processes involved in creating, managing, and using that information. Individual PCTF component documents provide detailed descriptions of every function and process that are part of the digital identity domain.

Documents:

Period:

  • Opens: February 13, 2019 at 23:59 PST
  • Closes: March 15, 2019 at 23:59 PST

Process:

  • All comments submitted are subject to the DIACC Contributor Agreement
  • Log comments in the provided DIACC Comment Submission Form Spreadsheet
  • Be sure to reference the corresponding line number found in the PCTF Model Overview Discussion Draft for each comment submitted
  • Email completed DIACC Comment Submission Form Spreadsheets to review@diacc.ca
  • Questions may be sent to review@diacc.ca

Demande de révision et de commentaire: Model aperçu du cadre de confiance pancanadien

Invitation

Le DIACC a le plaisir de vous soumettre le document de travail sur l’aperçu du modèle de cadre de confiance pancanadien (CCP) et invite toutes les parties intéressées – émetteurs et consommateurs d’identité, développeurs et utilisateurs potentiels – à le commenter.

Contexte

Les commentaires ouverts ont pour but d’assurer une transparence dans l’élaboration et la diversité d’une contribution véritablement pancanadienne et internationale. Ce document de travail a été préparé par le Comité d’experts du cadre de confiance du DIACC, qui est régi par les politiques de contrôle du DIACC. Conformément à nos principes pour un écosystème de l’identité, la priorité est accordée aux processus à respecter et à une confidentialité accrue à chacune des étapes du développement du CCP. 

Le DIACC s’attend à modifier et à améliorer ce document de travail en fonction des observations du public. Les commentaires effectués pendant l’examen seront pris en compte en vue d’être incorporés dans la prochaine ébauche, et le DIACC va préparer un recueil de commentaires afin d’indiquer de façon transparente la façon dont chaque commentaire a été traité. Cette ébauche sera traduite en français une fois qu’elle sera plus définitive. 

Pour en savoir davantage sur la vision du cadre de confiance pancanadien et la proposition de valeur dans l’intérêt général, nous vous invitons à prendre connaissance de l’Aperçu du cadre de confiance pancanadien | Pan-Canadian Trust Framework Overview.

Résumé de l’aperçu du modèle de CCP

Ce document a pour but de fournir un aperçu général du cadre de confiance pancanadien (CCP). Il comprend une récapitulation des renseignements contextuels, et des buts et objectifs du CCP, ainsi qu’une présentation des domaines fonctionnels qui interpellent surtout le CCP. Cet aperçu donne aux lecteurs une idée générale des renseignements auxquels le CCP s’intéresse, et des divers processus intervenant dans la création, la gestion et l’utilisation de ces renseignements. Les différents documents qui composent le CCP fournissent des descriptions détaillées de chaque fonction et processus faisant partie du domaine de l’identité numérique.

Documents

Période

  • Début : 13 février 2019 à 23 h 59 heure du Pacifique
  • Fin : 15 mars 2019 à 23 h 59 heure du Pacifique

Processus

  • Tous les commentaires soumis sont assujettis à l’Accord de contribution avec le DIACC.
  • Les commentaires doivent être entrés dans le formulaire de soumission (fichier Excel) destiné au DIACC.
  • Assurez-vous d’utiliser le numéro de ligne correspondant que vous trouverez dans le document de travail sur le modèle de CCP pour chaque commentaire soumis.
  • Le formulaire de soumission des commentaires doit être envoyé par courriel, dûment rempli, au DIACC à review@diacc.ca.
  • Les questions peuvent être adressées à review@diacc.ca.

Exploration of Remote Identity Proofing Alternatives to Knowledge Based Verification

A recently published white paper developed by DIACC members Digidentity and ID Crowd explores remote identity proofing alternatives to knowledge-based verification. The paper proposes that digital identity has the potential to mitigate risks associated with fraud. Greater customer reach, better compliance, and secure and streamlined onboarding processes are among the benefits digital identity can provide.  

Read the full white paper, “Exploration of Remote Identity Proofing Alternatives to Knowledge Based Verification.”

“The US and Canadian identity ecosystems will benefit from this research as it demonstrates that robust alternative methods of remote verification are theoretically possible, both technical as well as commercial,” said Marcel Wendt, CTO and Founder of Digidentity.

Knowledge-based verification refers to a security method in which a user is asked to answer at least one “secret” question. The challenge with this approach, the authors purport, is that it is largely based upon the foundation of “what the user knows,” and relies on the integrity and secrecy of the underlying information that is being verified.

Given that 2017 and 2018 were years in which online data breaches became part of the public consciousness, concerns surrounding data privacy and protection are mounting.

“Data breaches are becoming more frequent; these breaches undermine the integrity of confirming the identity of an individual using knowledge based verification” said Dick Dekkers, Director Business Development at Digidentity.

“The inability to trust these traditional data set to identify, verify and authenticate individuals and assets, undermines the development undermines the development of identity ecosystems in North America.”

Posing the question – “is the entity asserting the evidence the true owner of the asserted identity?”- the research studied five alternatives to traditional knowledge-based verification.

  • The comparison between a machine readable travel document and a “selfie” of the user asserting their identity
  • A government issued driver’s license as identity evidence
  • Comparing a user’s asserted identity with that of their mobile phone contract
  • Verifying the ownership of a financial account under the control of the user
  • Verification using credit card transaction data

“The NIST 800-63A identity standards enabled us to grade each method and the evidence in terms of their issuance, validation and security features” noted David Black, Director at ID Crowd.

All methods, the study determined, are credible identity verification alternatives to the traditional knowledge-based verification approach.

“The five methods selected are not as vulnerable to breaches as traditional methods such as the credit file as they rely on a spread of features including strong issuance processes, biometric comparisons and cryptographic protective measures,” said Gillan Ward, Director, ID Crowd.

About the Paper

The Information in this report is based on research funded by the U.S. Department of Homeland Security Science & Technology Directorate (DHS S&T). Any opinions contained herein are those of the performer and do not necessarily reflect those of DHS S&T.

This content of this white paper is developed under the governance of the DIACC International Applied Research program. The International Applied Research program connects innovators that align with the DIACC Digital Identity Ecosystem Principles with international applied research funding opportunities. The content of the paper was submitted by Digidentity and ID Crowd and does not necessarily reflect those of the DIACC membership.

Spotlight on Entersekt

Meet Entersekt

  1. What is the mission and vision of Entersekt?

Entersekt’s vision is of a world where everyone can interact and transact digitally without fear. In 2008, Entersekt launched the very first out-of-band, mobile push-based transaction authentication product in the world. Since then we’ve continued to innovate, and today millions of people across the world use our products daily to secure their online banking, mobile banking, online shopping, and corporate networks.

Entersekt’s mission is to be the preferred fintech partner for bringing financial service providers and their users closer together. We enable our customers with secure, privacy-enhanced, user-centric solutions that allows them to maintain a high degree of trust with their customers. With that foundation of trust, consumer adoption of lower-cost digital channels increases, while increasing the ability for the organization to offer more high-value services across those channels.

2. Why is trustworthy digital identity critical for existing and emerging markets?

In today’s world, customer engagement and intimacy, built on trust, have become key differentiators for organizations. Unfortunately, in existing markets, the amount of personal data that has been compromised due to breaches makes it difficult for any organization to know that they are dealing with a real person, and that the person on the other side of an interaction is actually who they claim to be. In emerging markets, identity is critical for social and economic advancement. Often however, an authoritative registry of individuals does not exist, which can complicate the identity proofing and corroboration process.

These factors highlight the need for a robust and scalable digital identity framework, since it’s more important than ever for organizations to be able to validate and engage with end-users securely. If this can be done efficiently, a world of potential can be unlocked where, for example, consumers can be allowed to engage in self-service activities, which can lower costs, enable new products and ultimately create better value propositions for both consumers and organizations.

3. How will digital identity transform the Canadian and global economy? How does Entersekt address challenges associated with this transformation?

Digital identity and interoperability are key to transforming and enabling any digital economy. With a trusted and secure digital identity, organizations will finally be able to move from legacy and physical processes over to digital, thereby reducing costs and improving the level of service . In addition, interoperable solutions can potentially allow for new lines of business and innovative products and services to be made available to the global market.

Entersekt provides organizations with the ability to accurately identify and authenticate users across the omni-channel via a convenient, secure, and privacy-enhanced user experience. Strong authentication is not only about telling the good guys from the bad. It helps to foster and maintain trust between organizations and their customers, allowing businesses to accelerate consumer adoption of their lower-cost digital channels while building on the foundation of trust.

4. What role does Canada have to play as a leader in the space?

The benefits of a successful digital identity ecosystem are well-documented: cost savings, fraud reduction, improved regulatory compliance, and enhanced privacy are only some of the advantages identified. As a highly-developed country of technology-savvy citizens comfortable with a range of digital interactions, Canada is already establishing itself as a global thought leader in digital identity.  The added support that Canada’s public and private sector bring to the table as demonstrated through organizations such as DIACC, the willingness of stakeholders to be part of the process, as evidenced through numerous POCs in market, and the openness to transparency and collaboration are all crucial factors contributing to making Canada a leader in this space. The Canadian economy at large will ultimately benefit from the final outcome of these activities, while the global economy will benefit from the lessons it can learn from Canada’s leadership in this space.

5. Why did Entersekt join the DIACC?

At Entersekt, we believe that developing a national trust framework and digital identity ecosystem is the future, and we recognize the value of a digital identity ecosystem that prioritizes security, scalability, and transparency. As a company where the utmost security has always been the foundation of everything we do, the principles of a digital identity ecosystem for Canada, as set out by the DIACC, truly resonates with us. Joining the DIACC helps us play a part in this ecosystem, and provides a platform for us to share our global experience, and learn with fellow stakeholders as we work towards solving global issues across the digital domain.

6. What else should we know about Entersekt?

Entersekt’s mobile app security and authentication technology is used in more than 45 countries across the world to protect tens of millions of consumers as they transact over the Internet, via mobile devices, or by using other self-service channels. We provide organizations 100% certainty regarding the devices they are interacting with, and based on that certainty we can deliver outstanding user experiences. Entersekt is GDPR, PSD2, PCI DSS and MiFiD compliant.

Profiles in Leadership: Marc Brouillard

Marc Brouillard, Chief Technology Officer for the Government of Canada

In this new series, we are shining a light on DIACC Directors, who work to drive the digital economy forward in Canada. Meet Marc Brouillard, Chief Technology Officer for the Government of Canada. 

  1. Why are you (and your organization) committed to advancing digital identity Canadians can use with confidence? 

TBS is leading the Government of Canada’s OneGov vision, with the goal of enabling citizens to access any service (e.g. passport renewal, tax filing) on any device (e.g. smartphone, voice assistants, cars) on any platform (e.g. Google, Expedia) with any partner (e.g. provinces/territories, private sector, academia).  Digital identity is a foundational and enabling component to this vision. We are committed to digital identity because it is a key enabler and starting point for the digital transformation of our services to Canadians.

2.  How important is digital identity in the context of Canada’s economic and societal growth? 

It’s extremely important and foundational to our OneGov vision. Within the public sector, digital identity is crucial in ensuring the integrity of programs, increasing the efficiency of delivering services and improving the overall experience of interacting with government for Canadians. However, within the private sector, digital identity plays an even more important role: it can reduce overall transaction friction and play a role in multiplying benefits enabled by innovative business models and new investment opportunities which contribute to overall economic growth and benefits for Canadians.

3.   When it comes to strategy, how do you see Canada as taking a lead in comparison to other regions? 

The Government of Canada is looking closely at what other countries have done with digital identity and is applying lessons learned from their experiences to its approach. Some countries have implemented mandatory national identity card schemes, but Canada’s approach will be federated in nature. Rather than mandating a single centralized identity, Canada’s vision is to enable an individual to use any trusted digital identity of their choice to access high-value services.  Trust will be established and verified through the Pan-Canadian Trust Framework (PCTF), a public-private partnership designed to establish common rules across the country to validate the trustworthiness of the various digital identities and enable interoperability across jurisdictions.

4.  What do you predict for the future of digital identity in the next year? 

Technology is rapidly changing and new capabilities are emerging on the horizon. I am hoping for some pleasant surprises. We are monitoring very closely the developments in self-sovereign identity, blockchain and digital wallets. We are seeing innovative solutions being proposed by many vendors. It’s too early to tell which will be the winners, but we want to ensure that we can weave the innovation into a standards-based ecosystem that will accelerate our own digital service delivery.  


5.  What digital identity issues do you see as important that need more attention? 

The biggest challenge is trust and adoption. Will Canadians actually trust the digital identity solutions available to them? Will they actually understand how to use and integrate these solutions into their everyday lives? We need to pay close attention to how we build the trusted solutions and how Canadians feel about these solutions.

6.  How important is public and private collaboration in the effort to advance digital identity and what role(s) might each sector play?

The digital identity space is a rapidly changing environment and, as identity increasingly moves from a paper to the digital world, the lines between the public and the private sectors are blurring. Public and private collaboration is especially important as we collectively adapt to disruptive technologies that are changing the landscape of identity. As a government, we need to ensure that there is a fair, competitive marketplace for the private sector to thrive, but we also need to fill gaps for services that only the public sector can provide. We need to satisfy citizens’ demands for convenience and choice. Both the public and private sectors have major roles in service delivery. The public sector has a distinct and special role in creating foundational evidence identity (birth and arrival in country record) which merit unique treatment. However, the private sector can add significant value in the provision and management of digital identities, anchored to foundational evidence of identity. Together, the public and private sectors serve Canadians by: establishing legislation, regulations and standards, and providing valuable services that comply with legislation, regulations and standards.

7.  What drew you to become a leader on the DIACC Board? 

For me, it’s an opportunity to work with the best experts in the industry, and make a contribution to Canada across many sectors. Canada has an opportunity to lead globally in this space, and I want to be a part of that, helping to foster collaboration across public and private sector boundaries.

8.  What advice would you give to others who are thinking about investing in digital identity or becoming members of the DIACC?

Digital identity is needed by everyone. Digital identity will affect everyone. Either you will shape the digital identity agenda, or be shaped by the digital identity agenda. DIACC is an opportunity for you to shape the digital identity agenda and work with the best digital identity experts in the world.

9. Are there any other thoughts you’d like to share with our readers?

It’s an exciting time for digital identity. There’s no shortage of innovation. We are doing most of this work in the open, so we encourage you to contribute your thoughts.  Full collaboration and partnership across Canada is critical to tackle this very important initiative.

Newer Entries »