What are the business models behind Identity Management?

In the use cases previously given in this report, the focus was on mobile network operators. Three options have been highlighted how operators could positions themselves as identity providers.

The first option is a positioning as full-fledged identity provider, offering identity services to third party service providers. This would require that a mobile network operator not only addressed the technical challenges of user authentication, but also the storage and distribution of attributes to services providers under the user consent. 

A Mobile network operator could also be positioned as authentication service providers, offering Identity Management services to other service- or identity providers. In this case, the mobile network operator may provide SIM based user authentication solutions, leveraging a wide scale of infrastructure and identity roaming agreements with other Telco’s.

Finally, mobile network operators could be positioned as authentication enablers, by granting identity provider access to SIM cards to provision certain security elements on the SIM card of their subscribers. This would be most likely the case for services involving a high level of risk or liability, which require the identity provider to have ownership of the management of the users’ authentication or authorization.

Independently how an operator wants to position himself in the context of identity provisioning and if he wants to offer identity services to third parties at all nearly all of his own services need to be authenticated and authorized. Especially in the area of multimedia or portal services additional authentication or authorization mechanisms are needed. Advanced mobile operators already bundled the utilization of portals to the GPRS access. But there is still a way to go for centralized identity management and common subscriber profile management. In present infrastructures many applications are separately managed and self-contained systems with all functionality that is needed for the delivery of the application. These vertical application solutions often have overlapping functionality and it is not possible to reuse functionality or access data from other applications. The service delivery platform approach aims to open up the application area.