The Open Identity Exchange (OIX) is a membership organisation that works to accelerate the adoption of digital identity services based on open standards. It is a non-profit organisation and is technology agnostic. It is collaborative, and works across the private and public sectors.
Members work together to jointly fund and participate in pilot projects (sometimes referred to as alpha projects). These pilots test business, legal and/or technical concepts or theory and their interoperability in real world use cases. A white paper is published for every project.
History
Genesis
Shortly after coming into office, the Obama administration asked the U.S. General Services Administration (GSA) how to leverage open identity technologies to allow the American public to more easily, efficiently, and safely interact with federal websites such as the National Institute of Health (NIH), the Social Security Administration (SSA), and the Internal Revenue Service (IRS).
At the 2009 RSA Conference, the GSA sought to build a public/private partnership with the Open ID Foundation (OIDF) and the Information Card Foundation (ICF) in order to craft a workable identity information framework that would establish the legal and policy precedents needed to establish trust for Open ID transactions.
The partnership eventually developed a trust framework model, described below. Further meetings were held at the Internet Identity Workshop in November 2009, which resulted in OIDF and ICF forming a joint steering committee. The committee's task was to study the best implementation options for the newly created framework.
Foundation
The US Chief Information Officer recommended the formation of a non-profit corporation, the Open Identity Exchange (OIX). In January 2010, the OIDF and ICF approved grants to fund the creation of the Open Identity Exchange. OIX was the first trust framework provider certified by the US Government. Booz Allen Hamilton, CA Technologies, Equifax, Google, PayPal, Verisign, and Verizon were all members of either OIDF and ICF, and agreed to become founding members of OIX.
Launch
The Open Identity Exchange was publicly launched at RSA 2010 and it addressed the increasing challenges of building trust in online identity as outlined below: Relying Parties must be able to trust that the Identity Provider is providing accurate data Identity Providers must be able to trust that the Relying Party is legitimate (i.e. not a hacker, phisher, etc.) Direct relying parties to identity provider trust agreements are a common solution, but are impossible to manage at Internet scale
In 2012 the executive director position was founded and National Strategy for Trusted Identities in Cyberspace (NSTIC) pilot projects showed the growing proof of traction and increased awareness and attention. In 2012 OIX UK was formed and throughout 2013 initial UK Cabinet Office Identity Assurance Programme (IDAP) pilots were launched and white papers published.
OIXnet
In 2014, OIX established the OIXnet trust registry, a global authoritative registry of business, legal and technical requirements needed to ensure market adoption and global interoperability.
In 2014, OIDF also announced plans to register all companies self-certifying conformance to OpenID Connect via the OpenID Certification Program on OIXnet.
Purpose
It is an official online and publicly-accessible repository of documents and information relating to identity systems and identity system participants. Referred to as a “registry”, it functions as an official and centralized source of such documents and information, much like a government-operated recorder of deeds. That is, individuals and entities can register documents and information with the OIXnet registry to provide notice of their contents to the public, and members of the public seeking access to such documents or information can go to that single authoritative location to find them.
The OIXnet registry is designed to provide a single comprehensive and authoritative location where documents and information relating to a specific purpose (in this case, identity systems) can be safely stored for the purpose of putting others on notice of certain facts, and from which such documents and information can be accessed by interested stakeholders seeking such information.