Federation Assurance Level

The Federation Assurance Level (FAL) is a security framework outlined in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800 63-3 Digital Identity Guidelines standard. It evaluates the level of confidence in the identity federation process, which enables different organizations or domains to exchange identity information for authentication and access control. FAL is one of the three components of identity assurance, alongside Identity Assurance Level (IAL) and Authenticator Assurance Level (AAL). FAL refers to the assertion protocol used by the federation to transmit authentication and attribute data to a relying party (RP). It defines the strength of this assertion in a federated context, with three levels: FAL1 (basic), FAL2 (high confidence), and FAL3 (very high confidence).

FAL Levels:

  • FAL1:Provides a basic level of protection, requiring the Identity Provider (IdP) to sign the assertion using approved cryptography and the RP to validate the signature. 
  • FAL2:Adds the requirement that the assertion be encrypted using approved cryptography, ensuring that only the RP can decrypt it. 
  • FAL3:Requires the subscriber to cryptographically prove possession of a key bound to the assertion, along with all requirements of FAL2. 

Each level ensures that appropriate security measures are in place based on the sensitivity of the data being accessed and the risks associated with identity federation. Organizations can use FAL to determine the appropriate security measures and controls needed for sharing identity information across different platforms while maintaining user privacy and data protection.

Key Concepts:

  • Assertion:A time-bound message from the IdP to the RP about the subscriber. 
  • Identity Provider (IdP):The entity that authenticates the subscriber. 
  • Relying Party (RP):The entity that relies on the IdP to authenticate the subscriber. 
  • Subscriber:The user whose identity is being asserted. 
  • Authenticator:Something the subscriber has, either in their memory, physical possession, or person, that they can use to prove their identity.