Attribute Vector

Full Title or Meme

A list of Attributes about an individual that is presented to a provider of goods or services (the Relying Party) to establish to ability of the user to successfully complete a transaction with the provider.

Preconditions

• The primary use case for the Attribute Vector is a user navigating to the web site of a Relying Party where they need be able establish a level of trust by the Relying Party to meet its need for assurance about the user's ability to be trusted with their goods or services while maintaining the user's expectations of privacy. As such it is expected that user stipulations will be included as well as User Private Information.
• Both the user and the Relying Party have the capability to create and understand the vector and its release of Attributes to the Relying Party.

Problems

• Today the user is prompted for User Private Information by the web site it whatever form that site wishes. There is no real understanding by the user of what all will be requested or what conditions the user may be able to place on the release of information to the site.

Solutions

1. Users can Authenticate in a manner that gives a Relying Party a consistent Identifier that can be sued from session to session without the need for sharing any User Private Information.
2. To be fully compliant with the various Privacy legislation like the GDPR or the California legislation the Relying Party may first require that the user establish a channel back to the user for the performance of required Redress and Recovery operations.
3. Only then should the Relying Party be in a position to request additional Attributes from the User.
4. Once the Relying Party has possession of the Attribute Vector it can apply its own risk profile to the vector to determine if the user meets the site's policy for granting trust to users on the site.

References

• NIST Request for Information