ES-LoA Final Report

Open Access

Abstract

The introduction of a distributed authentication and authorisation environment (eg using Shibboleth), creates a new requirement for mechanisms that support feedback on the confidence level of the authentication process. Some resources may be considered more valuable or sensitive than others thus require greater levels of assurance (LoA) that the person or process attempting to gain access is really who or what they purport to be. Standard mechanisms need to be defined and agreed to enable this information to be exchanged securely and with confidence in a wide variety of environments. The e-Infrastructure Security: Levels of Assurance project (ES-LoA) has investigated current definitions of LoA emerging in the UK at government level, and internationally. It has also surveyed potential users of LoA technology, both identity providers (such as universities, colleges) who have to register people to permit access to services, and service providers (including commercial and JISC-funded services).