171 VIEWS
Pinterest LinkedIn LINE

Recently, all kinds of articles about Digital Identity have been circulating. In this blog, I plan to jot down whatever comes to mind, ranging from meta-level questions such as what exactly Digital Identity requires to matters of implementation.


For this first installment, I will start with some extremely high-level requirements.

  1. It must be possible to use identifiers to point not only to people and things but also to their attributes, and to access metadata and data in a RESTful manner.
  2. Access control must be possible when doing so.
  3. Access control must be established as a “contract” that is legally meaningful under contract law. (This makes transactions across national borders possible as well.)
  4. A request for data must present a proposed contract, with the data becoming available once the contract is concluded.
  5. It must be possible to establish rules in advance so that contracts can be concluded automatically.
  6. If a contract cannot be concluded automatically, it must be possible to present the contract request to the individual.
  7. The contract request must be presented in a form that individuals can read and understand.
  8. Contracts must be applicable not only to individuals and legal entities but also to groups. (multi-party contract)
  9. Pseudonym-based information exchange must be possible so that individuals do not need to be identified unless absolutely necessary.
  10. Conversely, when real-name identity is required, the parties must be able to point to one another using persistent, unique identifiers.
  11. It must also be possible to access historical data associated with those identifiers.
  12. Third-party certification must be available for each individual, legal entity, and thing.
  13. Third-party audits and certification must be possible for the operational level of each identity; that information must be available and usable for automatically concluding contracts.
  14. A Reputation Service must be available for each identity and usable for automatically concluding contracts.

Technical Requirements

  1. The number of identities will be enormous. The database must therefore be distributed.
  2. Sharing a persistent identifier may pose a privacy risk, so it should be avoided whenever possible. A service is needed that accepts a pseudonym and verifies its existence and trustworthiness.
  3. Identifiers must be internationalized.
  4. Identifiers must be URIs.
  5. The data obtained must be enclosed in a consistent format that does not require schema extensions.
  6. For this purpose, abstract identifiers must be established as a vocabulary.

For now, that is what immediately comes to mind while I am feverish.

Incidentally, based on these ideas, as well as the slides from my presentation at Oasis Open Day (2003/11/20) and my talk at ACIMOD (2004/8), I am posting the file I prepared for a WSI study session.

wsi-xdi

“XDI/XRI Primer” (materials for a WS-I study session, 2004/9/30)

Related posts

The Haraguchi 5 Principles and OpenID

The “Haraguchi 5 Principles on Identification Numbers” have been announced. Principle 1: The system must protect the rights of citizens The number is intended to protect…

Identity · 2010-03-19