Australian Government releases draft Trusted Digital Identity Framework for public feedback
Image credit: Digital Transformation Agency
The Australian Government has released a draft of the Trusted Digital Identity Framework, following a period of consultation with government, industry and privacy representatives. The Government is seeking public comment on the draft national standards and rules that will frame the Australian Government’s digital identity program.
Assistant Minister for Digital Transformation, Angus Taylor, said, “The framework sets out a nationally-consistent approach to how digital identity will be managed.”
The Framework will give people the choice to set up a digital identity once, and complete their business with a range of online government services rather than visiting a shop front.
This is a “federated” style identity system, which refers to a decentralised model enabling individuals to access public and private sector services through a choice of identity provider. This is as opposed to a syndicated system a single identity credential is issued, typically by government, to provide single sign-on access to public and private sector services.
(In the image above the article demonstrating the Identity Federation Conceptual Architecture, Identity is defined combination of identity attributes which uniquely distinguishes a person within a specific context. While Identity Attribute is a piece of information relating to identity. E.g. Name or Date of Birth.
Identity Service Providers verify the identity of individuals, bind an identity to an authentication credential and assert identity to other members of the identity federation.
Identity Exchange conveys, manages and coordinates the flow of identity attributes and assertions between members of the identity federation. Once an Identity Exchange has been granted accreditation it becomes a trusted core element of the identity federation. Identity Service providers also undergo accreditation.
Accreditation is the procedure by which an authoritative body gives independent attestation conveying formal demonstration of a Service Provider’s competence to provide services of the kind specified in an assurance framework.)
The Trust Framework addresses the following functional responsibilities:
- Governance and Policy Development: Developing and amending policies; decision making; stakeholder-facilitation; managing standards and procedures; accountability mechanisms.
- Policy Enforcement: Ensuring compliance with Trust Framework standards and requirements; enforcement mechanisms; performing assessments or audits; managing policy changes and releases.
- Participating Entity Management: Administration and enrolment of participating entities; accreditation/on-boarding; support; dispute resolution.
- Network Evolvement: Growing and supporting the identity eco-system; marketing; communication and strategy developing.
- Trust Framework Operations: Offering central services to the participating entities and/or public, e.g. information and discovery services
People can provide feedback on just one or all of the 14 documents  that make up the framework and define minimum requirements (the rules) and recommended approaches (the tools). This includes documents outlining how providers will be accredited, privacy, security, risk and fraud management requirements, as well as standards for usability and accessibility.
The draft Trusted Digital Identity Framework is available for feedback until 8 December 2017 at the Digital Transformation Agency website.
The framework sits alongside the Digital Transformation Agency’s Govpass technology platform, which is currently in private beta. GovPass aims to make the process of proving who you are to government services online simple, safe and secure. The Govpass platform will be tested with a broader number of users and services in the first half of 2018.
 The fourteen documents include:
- Trust Framework Structure and Overview
- Trust Framework Accreditation Process
- Glossary of Terms
- Privacy Assessment
- IRAP Assessment
- Core Privacy Requirements
- Core Protective Security Requirements
- Core User Experience Requirements
- Core Risk Management Requirements
- Core Fraud Control Requirements
- Digital Identity Proofing Standard
- Digital Authentication Credential Standard
- Information Security Documentation Guide
- Risk Management Guide