Covisint drives ahead with ID management

Known for its pioneering integration work in the automotive industry, Covisint now is taking a leadership role in online identity management.

The company, which handles more than 325,000 user identities on its automotive hub, will announce this month it is readying services for the healthcare industry, as well.

Covisint, an online data integration hub started by the three major automakers in 2000 and now a division of Compuware, estimates the move could bring the number of user identities on its hub to nearly 1 million by year-end. Extending its services to doctors, nurses and insurance plan members could result in tens of millions more in the years ahead.

The so-called federation service is designed to let companies share user identities to support single sign-on across corporate boundaries. The service will employ user identities as a form of access and security control and offer corporations what Covisint says is a cost-effective alternative to building their own infrastructure and creating one-off systems with each of their partners. Covisint, which executes 1.5 million such transactions per month, couples federation with another service it offers, where companies store and manage identities through Covisint.

"Federation is a little like [electronic data interchange] was in the early '70s when it came out," says Dave Miller, chief security officer for Covisint. "Originally these were point-to-point connections and what happened is that these value-added networks came up saying, 'This is unmanageable and what if there was someone in the middle to manage all the connections?' We are really the same thing for managing federation."

Handling the exchange of identity information across organizational boundaries can be challenging not just technically, but also from a legal and contractual perspective, especially the need to establish trust among partners. That is why experts believe identity management hubs could prosper.

"Federation can't occur in totally [one-off] models for large markets, so that is why we think it is likely these hubs will emerge," says Jamie Lewis, president of Burton Group. Hubs have a better chance of succeeding if they are developed by a trusted third party that can build a set of tailored services for specific industries, he adds.

Covisint is following that line.

"Every federation is a different science project," Miller says. "So we can do it cheaper than you can do it because we have a shared [resource] model."

Covisint estimates it costs a company about $100 to incorporate each identity into its own system, but that its service today is priced at half that.

Miller says the company plans to extend its services across industries beyond automotive and healthcare, tailoring it for industry-specific needs and to meet federal regulations. He is banking on the lessons Covisint has learned since it built its first proprietary systems and began sharing identities in 2001.

Among those lessons is trust, which Miller says is easier to build through a common third party than individually. Having a third party involved also simplifies identity ownership issues, he says.