Network of Excellence in Future of Identity

Identity has both static, biological as well dynamic, social and psychological components. At a basic and biological level, our identity is unique to us and it is revealed by numerous biometric indicators such as fingerprint and iris patterns. This identity is fixed. All of these indicators track back to a single person, and one of our challenges is to develop systems and infrastructures capable of linking those multiple indicators so that the right people have access to the right services, systems, or information at the right times. Identity management is key in this regard, and it is dependent on robust controls designed to verify that users are who they say they are, across both real and online contexts. Improvements will enable the capability to verify identity, providing access to those who require it whilst ensuring the safety and security of often sensitive information by minimising false positive access of fraudsters. Such verification systems need to be able to operate across the various systems or applications that a single user might use.
At another level, i.e., the social and psychological level, our identity is dynamic and relative. It is defined by the social group we are in and/or the task that we are undertaking, and so we develop and reveal our self-image accordingly. Our identify affords us certain rights and privileges, which may change over time and place. This makes identity a much more challenging concept, and raises an entirely new set of questions which require an entirely new set of methodologies. In this regard, the definition of our identity according to our social group becomes important because it affords a single individual quite different rights and privileges across the many identities that they may hold. In essence, the challenge of identity is then even more complex because each individual can now be understood to hold many roles, and to display many indicators of identity within each of these roles. For instance, if we merely take the name as an indicator of identity, I may have a name that I use in the workplace, a name that I use amongst friends, another within an online social network, and another as a unique email ID. All of these are 'me' across the different roles that I occupy, and all would need to be tracked back to me for a complete understanding of who I am both at psychological level and at an identity management level.
An interdisciplinary perspective is now needed to address the diversity of user and system needs suggested above. Given the complexities introduced by the volume of e-providers, and the demands to comply with the provisions of the Data Protection Act, these are far from trivial problems. Expertise in psychology and human factors is needed to understand the barriers to robust authentication systems, and to explore how best to counteract phishing and other human engineering attacks. Legal expertise is also necessary given that the use of federated identity management (FIM) systems introduces the notion of trust between service providers but also necessitates the introduction of liabilities and warranties against breaches. This network in identity will bring these expertise under one forum to discuss some of the future challenges in the area of establishing identity. In addition to this it will act as a 'one-stop-shop' where industries, government agencies and the academic community can interact and seek the necessary expertise to resolve issues around establishing the identity.

The project is supported by the involvement of GCHQ, SOCA, Government Office for Science, Home Office, BT, IBM, GB Group, and Accenture. This direct involvement of the stakeholders in the project will greatly help to exploit the tools and technologies developed in this project. At the WDYTYA (Who do you think you are?) sandpit, the Technical Director of GCHQ made clear that the UK intelligence services now understand the threat posed from the misuse of identity in the cyber world and, in seeking to illuminate 'known unknowns', it is important to extend the research horizons of the closed intelligence community through dialogue with the open academic community. One potential application is related to the challenges that the Home Office/Passport Agency face today in the establishment of identity of citizens applying for UK Passports.

The algorithms, technologies, methodologies and processes developed by the Network members can be used in commercial products and we will take steps to make contact with potential commercial partners, as well as relevant government agencies. The United Kingdom has already several companies that are world leaders in this area of identity management. We will present the results of our investigation to them for possible commercial exploitation or R&D related to the integration in their products.

We also plan to offer advice to governmental agencies about requirements and procurement of systems for identification, which might also include the algorithms and techniques developed in this project.