Companies use Windows CardSpace to secure identity authentication

As a proof of concept, it may not be ready for this holiday season, but Microsoft and Experian have developed an identity management solution using Microsoft’s Windows CardSpace that streamlines the identity authentication process and makes it more secure.

Windows CardSpace is a desktop application that acts as an identity selector for controlling what information a user chooses to share online. The combined solution features an “Experian Card” that confirms the identity details of the parties involved and validates the authenticity of the Web site. Experian then forms and returns a signed and encrypted “token,” which contains a confidence level for the person or Web site being authentic. It takes advantage of the industry standards development of single sign-on ID authentication tokens.

Experian is a U.K.-based company that acts as a trusted third party and provides information, analytics, decision-making solutions and processing services for consumers and business needing to authenticate themselves and others on the Web.

All interactions between the individual, Experian and the organization are encrypted and digitally signed to protect the information from many forms of data and identity attack.

Peter Brooker, director at Experian, said in a statement that the public are increasingly buying from Internet-only retailers that may not be well-known brands and are becoming more concerned about who they are buying from and seeking reassurance they are dealing with is legitimate. “This service will work both ways, validating the consumer and the organization’s credentials, delivering a more secure and less stressful online experience for all,” he said.

He said the companies are now taking the proof of concept to the next stage and are in discussion with a number of organizations to demonstrate the CardSpace solution and hopefully launch an Identity Management Service in the near future.

Graham Titterington, principal analyst at Ovum, said the service could ultimately offer useful protection to both businesses and consumers engaged in e-commerce because it authenticates both parties in a transaction and provides mutual assurance about their identities.

“This service appears to be a commercial winner for both companies,” Titterington said. “Experian would win an expansion into the retail business, and Microsoft's CardSpace would become the clear favorite identity management tool in the retail space, further protecting the domestic Windows operating system market.”

He added that the authentication of the Web site provides a balancing and important element of assurance that is lacking in many other authentication approaches. However, users should still beware using unknown suppliers as authentication tells you nothing about the reliability or reputation of the company.