Words to ponder as we think about the best way to secure our digital persona.
Identifier – A text string we use to uniquely identify ourselves to a relying party, person, government, employer, club or entity we wish to have or need to maintain a relationship with. This group of entities hereafter will referred to as a replying party.
Identity – We each are unique and have attributes
Verification – A process the entity we seek to establish a relationship with uses to determine the truth of the attributes we share. One could argue this is or should be a mutual process. Many call this identity verification or identity proofing.
Registration – When we take these three words identifier, verification and identification and think about the first time we present ourselves to a relying party in the global digital environment. We typically present ourselves through a user interface to the entity we are interested in establishing a relationship with. We register and the relying party creates a record of our existence. They seek to recognize and record our identity.
This process typically requires us to invent or the relying party to present us with a unique identifier and agree to identify ourselves with this unique string, often called a user name, email address, bank account number, social security number, employee id, passport number, drivers license number or payment (card) account number ‘PAN’. The ultimate goal of registration is for the relying party tonassure themselves we are unique and that the attributes we share are linked to our person. They verify our identity.
Today the challenge is to find an efficient, convenient and none intrusive method of Verification.
Authentication – We exist, we can be recognized and are able to present oneself over and over again to the relying party, using our identifier. The challenge is how do we prove or assure our identity to the relying party each time. We need to authenticate ourselves.
Identification – Many confuse the dialogue above with this word. The difference is how we present ourselves or better said how the relying party expects us to present ourselves.
With the wide use of biometrics and many of the identifier we spoke of earlier, our identifier many not simply be some random string. A biometric is personal and linked to our body or actions. This biometric can be converted into an identifier and therefore once accepted as genuine and integrates the act of authentication into recognition of our identity.
Certain identifiers create a level of assurance, because the relying party trusts the attributes it asserts based on who issued that identifier. They are willing to trust in our identity and associated attributes because of the verification done by the isuing party. It a passport, an employee id, bank card or a drivers license. The instrument has characteristic, privileges and attributes linked to the issuing party, not simply attributes associated with the individual.
As we move from a physical world to a digital world. As people seek to use our identity to present themselves as someone they are not. As we seek to separate the various relationships we establish. Requires that we find ways of assuring our privacy while securing our relationships. All this demands we find more secure methods of authentication that are convenient.
