The Laws of Identity Smart Card Alliance身份智能卡联盟.pptVIP

Laws for Secure Credentialing Gilles Lisimaque Steve HowardDave Auman The Laws of Identity User Control and Consent Minimal Disclosure for a Constrained Use Justifiable Parties Directed Identity Pluralism of Operators and Technologies Human Integration Consistent Experience Across Contexts How does this apply to smart tokens The credential should never be used without implicit or explicit user’s consent The credential should reveal only the minimum information required for a given interaction All parties involved should be authenticated Entities interacting with a smart token should be able to prove the capacity in which they are acting There will always be multiple technologies as well as multiple identity issuing authorities involved The rules of the game should be understandable by humans Identity systems should be designed with coherence and appear consistent for all users Definitions (1/2) Subject is a person, system or object with associated attributes Attribute is a quality or characteristic inherent in or ascribed to a subject Claim is an assertion by a subject about the value of an attribute Vetting is the process of inspection and adjudication of claims An Identity is an association between vetted claims and a subject, certified by a trusted authority A Credential is a physical or logical representation of an identity or privilege issued by an authority Definitions (2/2) Identity Authority is a trusted authority able to do the vetting of a subject’s claims Application Authority defines the rules of the application and attribute disclosure required from a subject to be disclosed in order to provide the service which may be delegated to a service provider A Challenge is the demand for disclosure of one or more attributes related to a subject made by a service authority Authentication is the process of determining whether someone or something is, in fact, who or what it is declared to be. A Privilege is an authorization granted by an application authority