In the first article in this series of articles on Identity Management I made a pretty big statement:
- Identity Management becomes easier, not harder, when more information is shared online.
In the article on Identity Attributes I made a point that:
- All of our identity attributes together form our unique identity. Combinations of attributes from our identity vault are pulled out when needed to form a temporary key to authenticate ourselves.
In a bit of an infuriated mood caused by Identity Management: What’s out there? I made a rather bold statement:
- People who allow the company they work for to keep their identities as a strategic asset are too dumb to take a crap.
While being rather bold here, think about it for a minute. We constantly create identity keys on the fly to authenticate ourselves in many different situations. Our identity keys can literally be considered to be keys as keys open doors to us. Our identity key formed of ‘username’ and ‘password’ opens the door to our Facebook account. When we log off we close the door and pull the key out of the lock. Now why would anybody voluntarily allow the company they work for to make a backup copy of your key and store it in their vault?
Yet, a whole industry branch exists to do the so called routine of provisioning:
- Provisioning: The process of massively retrieving identity attributes from people in order to make a backup copy on the databases of a company.
In an interesting (Dutch) article titled Google collects data on us I read that an IA like an IP address is considered an identity attribute and that under European privacy laws any processing of identity attributes requires explicit permission from the owner of the IA, there should be full disclosure of the usage of the IA and there should be an opt-out of usage of the IA. Yet a whole industry branch exists, also in Europe, to do data provisioning for IdM solutions.
Identity Key Definition
While we have used the term identity key rather loosely many times already, it is now time to properly define it in the context of our earlier definitions in the article on Identity Attributes (part 2):
- Identity Key (IK): A well defined subset of IA’s taken from the identity I, used to authenticate ourselves in various situations.
In intuitive mathematical notation we could write this as:
Recalling that the identity I was earlier defined in intuitive mathematical notation as:
Where n is the number of attributes we choose and IA(i) is identity attribute i, we can put a ceiling on k by saying that 
- An IK may only be requested by an entity who’s identity we know.
- When an IK is requested we should be asked whether we want to allow the requesting entity to use it.
- When such permission to use an IK is given, a record should be logged of this permission.
- When an IK is used a record should be logged of this usage.
- An entity should be able to retrieve a log of IK usage.
- An entity should be able to retrieve a log of IK permissions
The implications of the above cannot be underestimated as they imply ENORMOUS logs. While storage capacity and CPU power still grow at an immense pace, storing global IdM logs like the above would most likely grow even faster. We can however mitigate this by:
- IK’s may have a limited lifetime. Permission granters should be able to indicate the lifetime of the IK, either through automatic defaults for relatively low value IK’s or manual settings for high value IK’s.
This is similar to the offline situation where we offer our passport to the employee behind the counter in order to identity ourselves; here we know implicitly that the employee will look at the passport briefly and will 1) not be able to instantly reproduce it, and 2) have forgotten about it altogether in a few minutes.
If you are interested in this article but cannot fully understand the context of it, I invite you to read my other articles on Identity Management. Should you have any questions, feel free to post comments on the articles as I scan the comments frequently every day. I’m currently in the process of trying to find thinkers who would like to participate and discuss the subject.
Here are other articles in the Identity Management series:
