Reliable™ OpenID

News
Media
Forum
Subscription
# You chose: Other Type of enrollment Reliable Identities offers a range of online and face-to-face enrollment options that serve to back up your claim of identity. The level of rigor involved will be determined by the most demanding needs of the most demanding relying party. Any Reliable OpenID credential may be upgraded at any time through a more exacting enrollment procedure. Proper enrollment may take place in an online session where the subject is not at the same location where the key pair is generated, or enrollment may take place in a face-to-face setting with a signing agent, notary, enrollment officer or other public official. Generally remote enrollment is weaker than face-to-face enrollment. For the purpose of quantifying the strength of enrollment practices we have assigned a value from zero to nine for each of the following enrollment procedures. # Here's what will happen after you click the "Begin Validation Procedure" button below. First, your computer will open a "tunnel", an encrypted SSL session with the Osmio certification authority. Osmio will greet you and ask you for a name and email address where you can receive a validation code. You're probably familiar with what happens next. You'll open the message from Osmio, copy a validation code, and paste it into a space on Osmio's validation form. This will give Osmio sufficient assurance to generate a Provisional Certificate, which is a digital certificate that serves as the starting point for one of our more formal validation and enrollment procedures. The FREE procedure you've chosen is called Val-ID™ Level 1. (Others are more rigorous and involve payment of a fee.) Once your Provisional Certificate is issued, Osmio will need to present you with a series of questions to further validate your identity. But since these questions involve PII or Personally Identifiable Information, you'll need to formally grant Osmio a license to have and use this personal information for purposes of validation, enrollment, and eventually for authentication. You see, Osmio's privacy policy is of a new and powerful type. Instead of making vague promises of questionable legal bearing, Osmio considers information about you to be your legal property, subject to copyright and trade secret law, and to be used by Osmio only under a license granted by you to Osmio. The license is based upon a document called your Persnal Nondisclosure Agreement, which formally establishes your ownership of indormation about yourself. So your new identity credential delivers not only convenience but a whole new privacy fortress, built upon the principles in the book Own Your Privacy by our CIO Wes Kussmaul. (According to US Government legal guidelines, anyone who misuses your personally identifiable information may be subject to a fine of $11,000.) # So let's get started! # Choose the enrollment procedure that fits the most demanding needs of your most demanding relying party: # REMOTE ENROLLMENT
EP | EPS Value | Meaning
P | 0 | The Provisional Certificate (description in preceding paragraph)
VA | 1 | After receiving a Provisional Certificate, Subject is directed to an Osmio VRD SSL web page. A cookie is placed in the Subject's computer, MAC and IP addresses of user's computer are recorded for inclusion in enrollment records, A key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database.
VI | 2 | After receiving a Provisional Certificate, Subject is directed to an Osmio VRD SSL web page that invokes an identity validation session during which Subject is asked a series of questions which request national identity number (SSN in USA), address of primary residence, driver’s license number, and answers to a series of questions about personal history. Upon satisfactory completion of this PII corroboration session a key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database.
VB | 2 | After receiving a Provisional Certificate, Subject is directed to an Osmio VRD SSL web page. Subject is directed to a web form that prompts for name, address, and identity assertion network ID information and a telephone number or voip address that the host system is to call upon submission of the form. An automated system places a call to that number or voip address. Upon receipt of the call an automated voice prompt asks the Subject to look for a control number on his or her computer screen and enter it into the telephone handset. If the correct number is entered, a cookie is placed, MAC and IP addresses of user's computer are recorded. A key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database.
VC | 3 | Same as preceding enrollment procedure but with the addition of a voice recording step after the correct number is entered: the Subject is asked to recite a string of digits into the telephone. The recital of each digit is recorded separately in the enrollment record, which is signed by the automated enrollment system.
VD | 4 | After receiving a Provisional Certificate, Subject is directed to an Osmio VRD SSL web page where Subject fills in a web form that and enters the name of a published information source that lists a telephone number that is associated with the Subject, as in a directory publication or as disclosed by a principal relying party (employer, insurer, bank, etc.). At a randomy determined time the Enrollment Officer calls the published telephone number. The Subject answers the phone, verifies that he or she authorized the call and is asked to enter a one-time web address into his or her browser. A control number is presented in the browser window. Subject is asked to enter the control number into the telephone handset. If that is done correctly, the Subject is asked series of questions that the enrollment officer has retrieved from NCMS, ChoicePoint, Lexis Nexis, or other PII corroboration service. If the questions are answered satisfactorily the Subject is asked to recite a string of digits into the telephone. The recital of each digit is recorded separately in the database record. A key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database.
| 5 | After receiving a Provisional Certificate, Subject is directed to an Osmio VRD SSL web page where Subject fills in a web form that produces an enrollment appointment that includes the name of a published information source that lists the telephone number that is associated with the Subject, as in a directory publication or as disclosed by a principal relying party (employer, insurer, bank, etc.) and username or other identifier for an online videoconference or video chat facility. At the agreed time the Enrollment Officer initiates a video communication with the Subject and calls the published telephone number. The Subject responds to the video communication request and answers the phone, verifies that he or she authorized the call and is asked to turn to his or her computer. The MAC and IP addresses of user's computer are recorded, and the Subject is asked to enter the control number into the telephone handset. If that is done correctly, the Subject is asked series of questions that the enrollment officer has retrieved from ChoicePoint, Lexis Nexis, or other PII corroboration service. If the questions are answered satisfactorily the Subject is asked to recite a string of digits into the telephone. The recital of each digit is recorded separately in the database record. A key pair and certificate signing request is generated. A key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database.
Val-ID™ Level 2 | 4 | After receiving a Provisional Certificate, Subject is prompted for national identity number (SSN in USA), address, driver’s license, and answers to a series of questions about personal history. After satisfactory answering of questions, an Enrollment Officer places a telephone or VOIP call to the telephone number that is listed in Subject's name in a public directory or to Subject's place of employment at an established organization, asking questions to confirm Subject's identity. Satisfactory responses in both online and telephone sessions causes the Enrollment Officer to digitally signs an entry at the Osmio VRD Certification Authority authorizing the signing of a Val-ID Level 2 Certificate to the holder of the corresponding Provisional Certificate, that is, the Subject. Subject is instructed on the creation of a key pair and Certificate Signing Request. A key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database.
| 6 | REMOTELY SUPERVISED FACE-TO-FACE ENROLLMENT (Patent Pending) After receiving a Provisional Certificate, Subject fills in a web form that prompts for information to be included in an Affidavit of Identity and for preferred times and location(s) for a face-to-face enrollment appointment at either the Subject's location or the office of a Notary Public. The resulting affidavit, in the form of a pdf file, is emailed to both Subject and notary public, who prints the document. At the subsequent enrollment session a computer with video camera and microphone is made to join an online session with a similar computer at the office of an Enrollment Officer. The Notary Public uses proper procedures for verifying government-issued identity credentials (driver's license, passport) and birth certificate. (If the birth certificate is not available, that fact is noted in the certificate.) Over the video link, Enrollment Officer asks a series of questions that the enrollment officer has retrieved from ChoicePoint, Lexis Nexis, or other PII corroboration service. If the questions are answered satisfactorily, the Enrollment Officer prepares his or her computer to record a video of the subsequent proceedings, and instructs the Notary Public to administer an Oath of Identity, using the affidavit which was previously printed. The video continues to record the signing of the affidavit by the Subject and the signing and sealing of the accompanying jurat by the Notary Public. After the video recording is stopped and the file encrypted with the Enrollment Officer's key and saved to the Enrollment Officer's secure enrollment records database, the Notary Public is instructed to hold the identity documents to the camera; still images are taken, encrypted, and saved to the secure enrollment records database. If the Subject requests an unencrypted copy of the video and still enrollment records, the records are saved to a CD, a digitally signed certification by the Enrollment Officer that no other unencrypted copy of the enrollment records exists nor will the encrypted version be decrypted except under conditions defined by the Subject's personal information ownership infrastructure, is added to the CD, and the CD is sent via certified mail to the Subject. A key pair is generated according to the standards defined in this document (Credential Carrier Score). A key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database.
|  | FACE-TO-FACE ENROLLMENT (Digital Birth Certificate™)
| 7 | After receiving a Provisional Certificate, In a subsequent online session, Subject completes an Affidavit Form which prompts for such information as is typically found on a traditional birth certificate, as well as national identity number (SSN in USA), address, driver’s license, and answers to a series of questions about personal history. Upon completion of the form, an Affidavit of Identity in the form of a pdf file is sent to Subject's email address. Subject prints the Affidavit of Identity and requests an appointment with a Notary Public. Enrollment Officer selects a Notary Public meeting QEI standards near Subject and makes the appointment. A copy of the Affidavit of Identity may be emailed to the selected Notary Public. Subject then takes this Affidavit and his/her identification documents to the notary where an oath is administered based upon the contents of the Affidavit of Identity and the certificate or jurat is sealed by the Notary Public. Enrollment Officer contacts the Notary Public, confirms that verification of documents and oath proceeded satisfactorily and requests copies of all documents including sealed Affidavit of Identity. Enrollment Officer digitally signs an entry at the Osmio VRD Certification Authority authorizing the signing of a Digital Birth Certificate to the holder of the corresponding Provisional Certificate, that is, the Subject. A key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database.
|  | After receiving a Provisional Certificate, Subject fills in a web form that includes fields for entry of content of an Affidavit of Identity and a space for preferred times for a face-to-face enrollment appointment at the Subject's location or the enrollment officer's office. At the appointment the enrollment officer, a notary, examines the Subject's identity document(s) (driver's license and/or passport), the Subject is asked series of questions that the enrollment officer has retrieved from ChoicePoint, Lexis Nexis, or other PII corroboration service. If the questions are answered satisfactorily, administers an oath of identity wherein the Subject recites the content of the affidavit. The enrollment officer signs and seals the jurat attached to the affidavit. A key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database.
| 8 | Digital Birth Certificate (DBC) After receiving a Provisional Certificate, Subject fills in a web form that includes fields for entry of content of an Affidavit of Identity and a space for preferred times for a face-to-face enrollment appointment at the Subject's location or the enrollment officer's office. At the appointment the enrollment officer, a signing agent, examines the Subject's identity document(s) (driver's license and/or passport), the Subject is asked series of questions that the enrollment officer has retrieved from ChoicePoint, Lexis Nexis, or other PII corroboration service. If the questions are answered satisfactorily the enrollment officer administers an oath of identity wherein the Subject recites the content of the affidavit. The enrollment officer signs and seals the jurat attached to the affidavit and uses his or her specially equipped computer to capture biometric data including fingerprint, iris image, facial image and voice. A key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database.
| 9 | After receiving a Provisional Certificate, Subject fills in a web form that includes fields for entry of content of an Affidavit of Identity and a space for preferred times for a face-to-face enrollment appointment at the Subject's location or the enrollment officer's office. At the appointment the enrollment officer, a Tabelio Officer, examines the Subject's identity document(s) (driver's license and/or passport), using a source of ultraviolet light that is part of the Tabelio Officer's enrollment workstation, compares the documents to examples in the ID Checking Guide, checks the data and barcodes, turns on a video camera with microphone that is connected to the Tabelio Officer's enrollment workstation and administers an oath of identity wherein the Subject recites the content of the affidavit on camera. The enrollment officer signs and seals the jurat attached to the affidavit and takes a fingerprint and iris image of the Subject. The enrollment workstation is used to sign in to an online facility. A key pair is generated, with one of the keys being designated the public key. The public key, identity verification supporting information, and any additional Identity Quality information is made part of a certificate signing request, which is sent to Osmio VRD. Subsequently the X.509v3 identity certificate is created by the signing of the public key by Osmio VRD. The certificate is sent to the user's information appliance or wallet (computer, phone, token, smart card etc.) and recorded with supporting information in the Osmio VRD database. The private key is embedded into a fingerprint-enabled USB token or smart card or wireless token or other multi-factor identity device. The Subject is given two copies of a DVD containing all information, including biometric data, encrypted using the Subject's key, from the session and is offered an escrow service to safeguard the private key from loss.
Both civil and criminal liability are assumed by the notary in the face-to-face enrollments. While there is also an assurance that that individual is the one named in the identity documents, a fake identity document of particularly high quality is undetectable and thus it is possible that an impostor's name will be bound to the resulting identity certificate. Even in that case, however, the relying party can be assured of a reliable identity because the public key that is issued and signed is bound inextricably to the human being who was enrolled. If it is subsequently shared in spite of on-token biometrics and other measures to prevent sharing, non-repudiation remains strong.
About us |  | Services |  | Products |  | Press room |  | Contacts
Copyright © 2009 Reliable Identities, a unit of The Village Group, Inc. All rights reserved. Patents Pending. Read Legal and Privacy policy.