Access Agents solve digital identity problems

The foundation for security and enterprise management

In all the discussion of IBM's recent purchase of Encentuate, I seem to have concentrated on its effect on IBM/Tivoli customers as well as on Passlogix, previous supplier of single sign-on technology for those customers. I've said very little about Encentuate, though. Not that I'm going to do so today. (Although it does appear to be a good deal for that company) Instead, I want to look at something that Peng Ong, the founder of Encentuate, said recently.

I feel obligated to mention this because I hounded Peng to start blogging and he now does so regularly. Well, if one post a year can be considered “regular.” Still, it's not the quantity of the posts but the quality that matters, and he recently opined on a subject near and dear to my heart.

Over the years, I’ve often touted the beneficial properties of a personal directory (see 2002’s “The need for a personal directory,” for example). Ong’s latest blog entry talks about “Access Agents,” which, he says, are a form of personal directory. He goes on to say that Access Agents: “…are required to solve multiple problems in digital identity. Access Agents should perform the user-centric, end-point management of user-id/password pairs, personal private keys,  one-time password (OTP) seeds, OpenID tokens, etc. -- all the credentials an end-user possesses (and is expected to manage). Access Agents should follow end-users around to all the end-points where human comes into contact with cyberspace. (I like to think of end-points as the 4P's -- PC's, PDA, phones, and portals.)”

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

In all the discussion of IBM's recent purchase of Encentuate, I seem to have concentrated on its effect on IBM/Tivoli customers as well as on Passlogix, previous supplier of single sign-on technology for those customers. I've said very little about Encentuate, though. Not that I'm going to do so today. (Although it does appear to be a good deal for that company) Instead, I want to look at something that Peng Ong, the founder of Encentuate, said recently.

I feel obligated to mention this because I hounded Peng to start blogging and he now does so regularly. Well, if one post a year can be considered “regular.” Still, it's not the quantity of the posts but the quality that matters, and he recently opined on a subject near and dear to my heart.

Over the years, I’ve often touted the beneficial properties of a personal directory (see 2002’s “The need for a personal directory,” for example). Ong’s latest blog entry talks about “Access Agents,” which, he says, are a form of personal directory. He goes on to say that Access Agents: “…are required to solve multiple problems in digital identity. Access Agents should perform the user-centric, end-point management of user-id/password pairs, personal private keys,  one-time password (OTP) seeds, OpenID tokens, etc. -- all the credentials an end-user possesses (and is expected to manage). Access Agents should follow end-users around to all the end-points where human comes into contact with cyberspace. (I like to think of end-points as the 4P's -- PC's, PDA, phones, and portals.)”

Now I’ve always seen personal directories as an example of so-called “user-centric” identity management rather than what’s known as “enterprise-centric” identity, but Ong makes a different case:

“There are multiple reasons for end-point Access Agents:

“1. Simplification of the user's world.
“2. Migration to multifactor authentication.
“3. Integration.

“But the bottom-line is control. Control for the end-user in that he/she can finally stop worrying about dozens of access codes. And with better control comes the possibility of increasing security, which also results in control for the enterprise in terms of better security and more auditability. (Yes, the Access Agent can act as big brother for the enterprise.)”

In other words, Access Agents, the compelling application for the personal directory can also play nicely in the corporate world acting on the user’s behalf, but reporting to the enterprise for security and compliance needs. This could be the new frontier for single sign-on and, concomitantly, the “aha!” point for the personal directory.

Read more about security in Network World's Security section.

Dave Kearns is a consultant and editor of IdM, the Journal of Identity Management.