The SERP Trust Federation

Abstract

IdRC handles end user authentication in the ON-RCPN ecosystem, with around 120 client applications, 6 million users and 250 thousand authentications per day. The talk shows that this infrastructure does not answer a different and equally important question, that of whether one service can trust another, within the same national operator or across operators. Starting from that gap, the presentation discusses why trust between SERP services is a problem of its own, today solved statically at each integration. The proposal uses OpenID Federation to evaluate policies and resolve chains of trust dynamically and verifiably. The horizon is a marketplace in which services from different national operators can discover and trust one another without manual agreements.