861 VIEWS
Pinterest LinkedIn LINE

Kim Cameron, who left Microsoft on May 5 this year(*1), formulated the “7 Laws of Identity (Seven Laws of Identity)” from discussions with the “Identity Gang.” It is a foundational document cited by many people in the field, but surprisingly few people in Japan know about it, so I am reproducing here an abridged translation by Mr. Fujie of CTC.

# Law Description
1 User Control and Consent Identity systems must not disclose information identifying a user without the user’s consent.
2 Minimal Disclosure for a Constrained Use The most stable, long-term solution is one that minimizes the identity information disclosed and appropriately limits access to that information.
3 Justifiable Parties Identity systems must be designed to disclose identifying information only to parties that need it in a given context and have a legitimate right to obtain it.
4 Directed Identity Identity systems must support both “omnidirectional” identifiers for public use and “unidirectional” identifiers for private use. This preserves public discoverability while preventing the unnecessary disclosure of relationships.
5 Pluralism of Operators and Technologies Identity systems must preserve the interoperability of multiple identity technologies operated by multiple identity providers.
6 Human Integration Identity systems must define the user as 1 component of a distributed system. They must integrate the user into the distributed system through an unambiguous human-machine interface and protect the user’s identity.
7 Consistent Experience Across Contexts Identity systems must provide a consistent interface between users and technology while enabling the separation of identity contexts in different situations.
Overview of the “7 Fundamental Laws of Identity in the Internet World”
The original text containing the details can be viewed in the PDF document published on Kim Cameron’s blog.

(Source) http://www.atmarkit.co.jp/fwin2k/operation/adfs2sso02/adfs2sso02_02.html

Much time has passed since this document was written, but its intent has not faded. Alongside the OECD 8 Principles(*2), these are “laws” worth reflecting on again and again. By chance, I had an opportunity to have a drink with Kim in Mountain View two days before his departure, so I am also recording this summary here as a keepsake. (Incidentally, I saw him again in Munich the week after he left. 🙂

(*1) Kim Cameron: Former Identity Architect at Microsoft. He had a profound influence on thinking in the identity industry and was one of the creators of InfoCard. These 7 Laws were reflected in InfoCard’s design, but unfortunately InfoCard did not achieve commercial success and became feature complete. These ideas, however, have been carried forward into OpenID Connect.

(*2) OECD 8 Principles:
#1 Purpose Specification Principle
The purposes of collection should be specified, and subsequent data use should fulfill those purposes.
#2 Use Limitation Principle
Data should not be used for purposes other than those specified except with the consent of the data subject or by the authority of law.
#3 Collection Limitation Principle
Data should be collected by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.
#4 Data Quality Principle
Data should be relevant to the purposes for which they are used and should be accurate, complete, and kept up to date.
#5 Security Safeguards Principle
Data should be protected by reasonable security safeguards against loss, destruction, use, modification, disclosure, and similar risks.
#6 Openness Principle
Policies and practices concerning data collection should be made public, and the existence and purposes of use of data, the data controller, and related matters should be disclosed.
#7 Individual Participation Principle
Individuals should be able to confirm the location and contents of data concerning them and be assured the ability to challenge those data.
#8 Accountability Principle
Data controllers are responsible for complying with measures that give effect to these principles.

Related posts