BT leading the way for identity management

BT intends to lead the way in implementing consumer identity and access management solutions.

Among the developments it is working on are biometric access solutions which will enable BT customers to access services over the phone using "voiceprint analysis", revealed exclusively to silicon.com by one of the senior techies working on BT's 21st Century Networks (21CN) project.

Already the telco giant has rolled out identity and access management solutions to internal staff and four million customers who can now access the full breadth of its services via BT.com by using a single sign-on - which allows the website to communicate with back-end applications from the likes of PeopleSoft, SAP and Siebel.

Originally the idea behind implementing the SiteMinder technology from Netegrity, now part of CA, was to streamline identity management internally and cut costs associated with resetting passwords and provisioning users, said Alec Cartwright, lead designer on BT's 21CN authentication common capability team.

He told silicon.com: "We were looking for a set of products to give single sign-on access across the enterprise."

In some cases BT staff, forced to change their passwords every month, were changing 50 different passwords every 30 days, costing the company serious time and money.

The system was initially rolled out to 20,000 call centre workers and latterly all 150,000 BT staff. Now customers are also involved. And it won't stop there, said Cartwright, adding that the back-end is scalable to adapt to new forms of identification at varying levels of maturity such as two-factor authentication using tokens and one-time passwords, or biometrics - such as a "voiceprint analysis" trial that is underway currently.

He said: "Now we've got BT.com done the next service that comes along will be that much quicker."

Potentially that could see BT rolling out a single IAM solution to around 26 million customers as BT Global Services looks to resell the CA technology for its own customer base to offer, said Cartwright. "We've experienced the pain for them," he said of BT's ability to use its own experience as both testimony and model for implementation.

And Cartwright said such a broad implementation could create the perfect platform for federation - the process of trusted third parties sharing single-on credentials across their services.

He added: "The big question is who federates the identities? Will it be the banks? Will it be the government? I'm not sure the banks will want to do it and I'm not sure people will want the government to. So why not BT?"

He cited an example - such as downloading movies online from a trusted third-party website - whereby BT Openworld consumers may be able to use the same federated identity for logging on to such services, without needing to manage multiple identities.

A spokeswoman for CA said BT is already well ahead of the rest of Europe in leveraging its size and breadth of offering to simplify the process of identity management and to streamline its access offering.