Project Liberty

Getting It Right

Digital identification and fine-grained billing in the Web services world.

A Sun Microsystems Executive Brief
By Greg Papadopoulos, Chief Technology Officer

Digital Identity

There's no such thing as personal identity on the Internet.

What we have today is an illusion. We're greeted by name on customized Web sites, but these sites don't recognize individuals; they recognize Web browsers. That's why, even though I may see "Welcome, Greg!" at the top of the page, I'm also presented with "If you're not Greg, click here" or words to that effect.

At first glance, that may not seem like such a big deal, but I'm convinced that identity is destined to become the defining issue of the networked economy. Today the Internet is a network of individual connections, not individual users. By that I mean, the Net recognizes the browser, not the person using it.

We need to turn that around if we're to make the Net all that it can be.

Web Services

The next phase of the Net will go well beyond customized portals to something far more sophisticated and infinitely more helpful -- and I'm not alone in saying so. Every major technology company today envisions a Web of new services interacting seamlessly (often without human intervention) to make our lives easier.

I'll give you an example: Imagine a calendar service interacting with a map service, so that your car can give you directions to your next appointment without being asked -- it could even interact with a traffic service to help you avoid delays due to road construction or stalled vehicles.

Identity -- including authentication, authorization, and billing services -- will drive this new generation of Web-based services. Moving forward, it's no longer a question of licensing a software package to run on a particular machine. It's a question of whether an individual is authorized to access a particular service -- from any device he or she chooses at any given moment.

To make the vision of highly personalized, seamlessly linked Web services a reality, several things have to be in place. The first is an agreed-upon set of open technology standards, which I'm encouraged to see coming together with XML, UDDI, SOAP, ebXML, and Java technologies, to name a few (though I should point out that implementations need to encourage interoperability and not create unfair preferences). Beyond that, however, service providers need to have an efficient way to identify people and bill them small amounts -- akin to short phone calls -- appropriate to the service rendered.

Fine-Grained Billing

If we don't develop a way to do fine-grained billing on the Net, we will be cutting ourselves off from all kinds business opportunities, all kinds of innovations -- not to mention one of the fundamentals of economics: the ability to charge a price the market is willing to bear. In this case, a low price.

Consumers have grown accustomed to free Web-based services, supplemented by advertising -- a model that continues to work for TV and radio broadcasters, and will continue to work for a number of Web sites. But with the U.S. economy slowing and advertising dollars harder to come by, we're starting to see more companies create premium services, for a fee.

Think basic cable, premium channels, and pay-per-view -- those are the new templates. And why not? Millions of Americans pay $35 a month for basic cable -- more for premium channels. The total comes to $30 billion a year in just the United States.

But the question remains: How much are you willing to pay for a given service?

Take Internet searches -- free from a variety of sources. Would you be willing to pay a fee for a higher quality of search? Perhaps. But how much? Specialists routinely pay hundreds of dollars a month for access to specialized databases, but a harried consumer might only be willing to pay 25 cents a search for more accurate results on "early music of Appalachia" or "origins of bone china." That may not sound like much at first, but multiply it by the number of frustrated Web searchers and pretty soon you're talking about real money.

Right now, there's no universally accepted online equivalent to pocket change -- what you use when you want to buy a newspaper or a hundred other small items you wouldn't dream of paying for with a credit card. With a fine-grained billing system, such micropayments could open up whole new markets online. Consider music downloads,for example. How much would you pay for a single song -- or a single listening? What if, after four or five listenings, the rest were free?

An Old-Fashioned Notion

Whatever the billing method, it has to be hassle-free for consumers -- and for merchants. Consumers want easy, one-step access to the collection of services they've selected; merchants want a standard way to identify and bill individual customers. The technical issues encompass privacy, personalization, and the rules surrounding who gets to see an individual's data. But for the creators of Web services, the larger concern has little to do with technology -- it's an old-fashioned notion called fair play.

If we look at the consumer-oriented businesses spawned on the Net so far, we see that most are either electronic storefronts selling goods and services or else media outlets supported by advertising. In short, they took their cues from common business models -- a natural starting point.

To move beyond these basic models into more sophisticated and uniquely Net-based services, we need to explore more complex business arrangements. The natural starting point, then, is to look at how identity is handled today. Even though the Internet has nearly 400 million users worldwide, the real grownups in this field are the telecommunications industry with 502 million GSM subscribers and credit-card companies with 1.8 billion card holders. (With 281 million U.S. Citizens, the federal government is one of the larger single entities, but it can't match these other industries in terms of daily transactions.)

Of these, telecommunications may be the most directly applicable example. Carriers across the country -- indeed, around the world -- seamlessly transfer callers between their various networks and, through peering agreements, share profits equitably. Given the volume of calls, both wired and wireless (which adds roaming to the mix), this can be an exceedingly complex undertaking, but the carriers have it down to a system -- a veritable service grid in which consumers and service providers all benefit.

No comparable billing system exists on the Net. No standard way to simply connect and be billed for services the way cell phone users are automatically billed for roaming or long-distance service. No peering and settlement systems to ensure that each service provider collects its due.

If we go back to my example of the calendar, map, and traffic services all working together, then its easy to see that each needs to be compensated -- and users will likely want a choice between a flat monthly rate or a small per-use fee.

Getting It Right

Until we get this right -- and in my opinion early efforts are fundamentally flawed -- the next wave of Internet business will be severely handicapped. Held back by inconvenience, incompatibility, and mistrust.

It's only natural, I suppose, that the leading Internet service providers, with their millions of paying subscribers, were among the first to see the problem and try to address it. But they are not in the best position to create a global solution for the whole Net. Their intentions may be good -- making it easy for subscribers to purchase goods and services without having to continually re-enter credit information -- but they have no incentive to create a neutral, open billing system that treats all merchants the same. These providers and their business partners will inevitably find themselves in competition with other providers of similar Web-based services. Which puts those competitors in the untenable position of paying fees that go to their rivals.

What we need is a universal identity system that doesn't play favorites.

We clearly have good models to draw from. Such a system could borrow from telecommunications (peering, roaming, and settlement), credit-card systems (trusted third-party intermediaries), and government (passports for international travel, issued and honored by many different countries, not by a single entity).

But as we put this all together, we need to go a step further. We need to consider, as part of the architecture, how we address critical questions such as: What are the views on the data that's generated by all these transactions? Who gets to see it? How will it be used? Who controls it -- the individual or the ID service?

There's a sense in which each of us can say, "That's my data. It didn't become yours because I used your ID service." And we need to establish standards around that -- standards that apply across the Internet, telecommunications, financial services, and government.

If actions speak louder than words, then we are what we do. It's part of our identity.