Identity assurance system moves into beta test phase

The Government Digital Service (GDS) has begun testing a system that will allow citizens to securely prove their identity when accessing online public services.

The new system, called “the hub”, is part of the identity assurance programme, which will set up competing companies that citizens can register with to access digital services.

The concept is similar to web users using their Facebook or Google accounts to sign in to third-party services.

According to a post on the GDS identity assurance (IDA) blog, the hub has now entered the beta test phase of its development.

“The hub will manage communications between users, identity providers and government service providers. It will allow users to select and register with an identity provider, and then use their assured identity to access digital services,” wrote Steve Wreyford, the head of communications and marketing for the IDA programme.

Eight companies were selected last year to provide IDA services - The Post Office, Cassidian, Digidentity, Experian, Ingeus, Mydex, Paypal and Verizon.

“Initially we will be connecting the first of our identity providers and testing that users can prove their identity to a mock-up of a government service. Once we’ve done that we will connect our first ‘exemplar’ government services and run further small-scale tests before rolling out the full service,” wrote Wreyford.

The “exemplar” services are 25 of the most frequently used government transactions, ranging from visa applications to benefit claims to booking prison visits. GDS is working on a 400-day programme that started earlier this year to make all 25 services “digital by default”.

Citizens wishing to use the online services will first register with an IDA provider, then use that identity to securely log into the relevant government website. Longer term, IDA identities could be used to access local government services and even commercial websites.

Wreyford stressed the importance of security in the development of the hub.

“The identity providers will also need to be international standards (ISO 27000) compliant and certified by an independent, certification organisation (tScheme) as meeting the identity proofing and credential management requirements set out in our Good Practice Guides. If the providers fail to pass the gates or not achieve certification, they will not be able to offer a fully live service,” he wrote on the GDS blog.

Universal Credit, the government’s flagship welfare reform programme, was originally expected to be the first service to use IDA, but major problems with the IT development underpinning the scheme led to it being dropped from the initial roll-out.