Jan Schoonderbeek: GF added

2013-04-04T13:04:46Z

GF added

New page

{{Maturity|3}}
{{Pageheaderbox4GF
|name=Identity Validation
|WorkingArea=Middleware
|version=0.2
|owner=J.A.H. Schoonderbeek
|summary=The Identity Validation function offers the ability to validate a digital identity.
}}
The Identity Validation function offers the ability to validate a digital identity. In essence, it can answer the question "how do I know I can trust this entity?". The facility can be offered an identity (in the form of a set of digital identity attributes) and one or more corresponding credentials; the facility then validates that the credentials match the offered identity.<br>
An example of an identity attribute and matching credential would be a login name and a password; the Identity Validation facility must respond with a message, either confirming that the identity is valid, or not.

Identity Validation is an important part of Authentication and Authorization. Beware, however, that Identity Validation is NOT synonymous to Authentication. Authentication roughly looks like this:
* A priori, for a particular authentication process, a security officer determines what identity will be proffered (e.g. someone shows up in person), and what type of credentials will be required (e.g. passport)
* The credentials of the correct type are distributed to the entities that are entitled to them (e.g. the issue of passports to people)
* Where the authentication is required, a process is put in place that can test the credentials (e.g. airport passport check)
When the above process for credential checking is automated (e.g. a passport scanning machine at an airport gate), then the facility deciding on the validity of the offered credential is performing Identity Validation functionality. Note that the functionality is NOT delivered by the scanning machine ''per se'', but rather by the combination of that scanning machine and the backend against which the scanned passport is checked. The scanning machine offers the passport data scanned (which contains both the data on the identity and the credentials), and the Identity Validation facility signals back that the identity in the passport is (or isn't) valid. That is not to say that the passenger presenting the passport truly IS who the passport claims it is, only that we have a certain degree of certainty about it; a degree of certainty that (we believe) is very high when the credential is a passport - certainly higher than when we'd used a library card as credential.

Note that Authentication means that someone (himself authorized to do so) makes a decision on the trustworthiness of credentials; thus the process of authentication always involves a security officer. Identity validation is only an automated means for ''part'' of that process, the correct deployment of which must itself be checked by a security officer.

To validate a digital identity, the Identity Validation facility often needs access to an {{FriendlyPageLink|GF.Identity_Store}}. Note that the identity repository in itself is not part of the Identity Validation facility.
{{FunctionIcon
|image=Icon GF Identity Validation.png
}}
{{Text Footer GF}}

GF.Identity Validation - Revision history

Jan Schoonderbeek: GF added