How IVS works

Initially people will only be able to use the igovt identity verification service for government services of those agencies participating in the ‘limited service.’  For the ‘limited service’ people wishing to register with the igovt identity verification service will need to do so in person. They’ll need to provide a current New Zealand passport (less than five years old), or provide a citizenship certificate granted in the last five years. Further information on how to register will be available in mid 2009.

Once a person has joined the igovt identity verification service they can use it to verify their identity using the Internet to government service providers (that use the igovt identity verification service) whenever they need to.

The process of using the igovt identity verification service will work in five key stages:

1. The person goes to the government service provider website and requests a service. If they want to verify their identity using the Internet and if that government service provider is using the igovt identity verification service they can proceed to use it.  Or, they can choose to verify their identity in traditional ways e.g. by visiting the government service provider's office.
2. They then choose to be redirected to the igovt website so that igovt can verify their identity to the relevant government service provider.
3. They log on to igovt which would display their igovt ID – name, date of birth, sex and place of birth (or only some of these as required by the government service provider).
4. They give their consent for it to be sent to the government service provider.
5. They would then be re-directed back to the original government service provider's website which will then know who they are and give them access to the service they require. Their igovt logon can also be used for ongoing access to that government service provider’s online services.

How the igovt identity verification service maintains privacy

The igovt identity verification service protects privacy in a similar way to the igovt logon service.  Each government service provider involved with the igovt identity verification service will identify people in a different way using an identifier or code unique to that government service provider. There will be no external national unique identifier. There is no way for government service providers to share information about anyone through this service.  The Office of the Privacy Commissioner has been kept informed throughout the development of the service and regular Privacy Impact Assessments are carried out and published.

Federated identifiers (unique codes) are sent to the government service providers to represent igovt logons and igovt IDs.  The federated identifier for any given logon or igovt ID will be different for each government service provider to which it is sent.  This approach avoids the use of unique identifiers which could be used to facilitate data matching or any exchange of data about a user.

The igovt logon service and the igovt identity verification service are two separate, distinct services.  Each of the services will maintain the association between federated identifiers that they hold and the logon or igovt ID (respectively).

The federated identifier generated from the igovt logon is called the Federated Logon Tag (FLT). The Federated Identifier generated from the igovt ID is called the Federated Identity Tag (FIT).

The following two diagrams illustrate the basic relationship between the igovt logon service, the igovt identity verification service and the government service providers.  The first diagram shows the operation of the igovt logon service with government service providers (no igovt identity verification service involved).

A person, ‘Bruce Wayne’ has an igovt logon, his user name is ‘batman’. He used this logon to access government service providers’ web sites. For each government service provider a unique Federated Logon Tag is created.

The next diagram shows the operation of the igovt logon service and the igovt identity verification service with government service providers:

The igovt identity verification service and the igovt logon service have different roles

When a person needs to access a service which requires the verification of identity he or she will assert their igovt ID using the igovt identity verification service.  Once the assertion is complete on-going online interactions can occur with the government service provider via the igovt logon service.

Find out more

To find out more about how your agency can use the igovt identity verification service please contact igovt@dia.govt.nz