In yesterday’s article I described a few general characteristics of identity attributes. Today I want to narrow this down and also describe some more concepts behind identity attributes the way I see them. There are many different types of identity attributes and each of these attributes may have their own attributes in turn so it’s important to get the definitions right.

• Identity (I): the entity having a certain agreed upon number of identity attributes that identify the identity uniquely.
• Identity Attribute (IA): The identity attribute itself.
• Identity attribute internal value (IAIV): We will use this term to indicate an identity attribute’s value to the holder of the identity.
• Identity attribute external value (IAEV): We will use this term to indicate an identity attribute’s value to somebody other than the holder of the identity.
• Identity attribute visibility (IAV): An identity attribute value such as ‘hair color’ or ‘eye color’ or even ‘fingerprint’ is only visible within a certain physical range. Outside that range the attribute becomes more easily reproducible.
• Identity attribute reproducibility (IAR): Digital attributes are often said to be easier to reproduce because there is no evidence of theft of the IA. While this appears to be a valid observation, all IA’s can to some extent be stolen without the the identity being aware of it. A hair can easily be stolen for example to reproduce a DNA sample of the identity. An iris picture can simply be copied the digital way once such a picture has been taken. Only perhaps human’s most intimate IA’s, their personal deepest thoughts, cannot yet be stolen but they’re also not useful as IA’s since they will also never be used to identify us.
• Identity Attribute Entropy (IAE): the distinct number of values our IA can have
• Identity Database (ID): The identity storage.

Identity Mathematics

In the first article we defined that an identity is a finite set of attributes belonging to an entity that make the entity uniquely identifiable. Mathematically we can represent this like:

Where n is the number of attributes we choose and IA(i) is identity attribute i.

The total internal value of an identity equals:

The total external value of an identity equals:

While the mathematical representations of these values are not yet strictly necessary yet they are convenient short forms and many more relations can be written in this notation.

Identity Database

Since we plan to store complete identities, we need to consider that identity theft is a real problem. It’s not a problem that was introduced by the online world, it has in fact been around for as long as there have been thieves. Simple disguises by using wigs, make up and padding are quite adequate to trick anybody into thinking they’re dealing with a different person altogether if only the externally visible attributes are used as IA’s.

Although digitally stored IA’s are not typically reproduced with much greater ease, they can certainly be distributed with much greater speed once a method is found to reproduce them. This particularly holds true when the whole identity is stored on one single machine for example; the only thing required is to punch through the defenses of the one server to get to all the IA’s and steal potentially huge amounts of identities at the same time.

Since there is no absolute security we will not work under that assertion. We will factor in that IA’s can in fact be stolen. Of course we will make IA theft as difficult as possible to do but that doesn’t take away the simple fact that there’s always a smarter mousetrap and thieves will find it. So taking this into consideration, how do we prevent identity theft then? First of all, we will utilize multiple servers. In fact we will use a potentially unlimited amount of servers. We will then stripe the IA’s over all these servers in such a way that it may be possible to steal one or a few IA’s but the IA’s on one machine will never make up a full identity.

Additionally, we do not want the machine’s operators to be able to read the actual IA values so we will only store a one-way encrypted IA value on the machine.

One-way encryption is a mechanism where the original cannot be decrypted out of the encrypted value so the only thing we can do with it is to compare an encrypted IA value with the stored IA value to verify if they match. This is a mechanism which has been used for a long time by the Unix password mechanism and it’s strength stands or falls with a large number of possible values for the ‘password’. As the encryption algorithm is time consuming, it is near impossible to use brute force to find the original password. However, passwords are frequently based on dictionary words with a non-random character. With some IA values, for example ‘eye color’, there will be very few possible values which makes it easy to do a brute force attack. This is why we will also introduce pairing and redundancy of IA values over the different machines.