Taxonomy AHG Meeting 12/12/2013
Jump to navigation
Jump to search
Quick Links: Taxonomy | Taxonomy Project Management | Taxonomy AHG Catalog | Taxonomy AHG Glossary |
Attendees
| Adam Madlin (Chair) | Ryan Galluzzo | Ben Wilson |
| John Stearns | Mike Garcia | Seetharama Durbha |
| Winthrop Baylies | Jim Fenton | Eric Krum |
| Anne Racuya-Robins | Christopher Spottiswoode | Suzanne Lightman |
Notes
Objectives/Intro:
- Finalize definitions for authentication and credential.
Credential:
- Current definitions up for consideration are:
- An attribute set presented as evidence of a claimed or asserted identity.
- The secure binding of a token to an identity.
- A data structure used to bind a digital identity to a token that is used for authentication.
- There seem to be a few concerns around inclusion of the terms “data structures” and “attribute set.”
- Eric and Seetharama believe that “data set” could be used in place of these two terms in the definition
- There are also concerns over the term token. Eric considers the physical device to be the token; the credential is the data (which may or may not be stored on a token) used for the authentication. He does not consider passwords to be tokens.
- It was proposed that the group go forward with the definition: “a set of data presented as evidence of a claimed or asserted digital identity.”
- Adam wanted to know if the “binding” process needs to be included or represented in the definition.
- Seetharama believes that including “binding” in the definition would limit the entities that are capable of actually conducting authentication.
- Eric agrees that this is not necessary, and while it may be preferred for high level assurance credentials, it is not part of the core credential definition
- Adam wanted to know if there is a difference between claimed and asserted. Is one a user action and the other a third party action?
:*Seetharama would like to remove asserted. :*The group agreed to remove “asserted.”
- There were no objections to the definition, “A set of data presented as evidence of a claimed digital identity.”
Authentication:
- There are three current definitions the AHG is considering:
- The process of confirmation of a claimed digital identity based on valid credentials.
- Process of determining the validity of a credential used to claim a digital identity.
- A multi-party process involving presentation of a credential, and determining validity of a digital identity.
- In the last definition, Mike is not certain that “multi*party process” is needed.
- Eric agrees with this; including “claimed” implies that there is more than one party involved.
- Seetharama suggested that signatures associated with data can be authenticated offline and may not need two parties to be accomplished.
- John believes that authentication is the validation of the identity not the credential.
- Most of the group disagreed with this and believe that authentication is only validating the credential that is being presented.
- The group agreed that the third definition could be removed from consideration.
- Mike and Seetharama prefer the second definition; John still prefers the first definition; he believes it better addresses the use of multiple credentials.
- Mike suggested the inclusion of “one or more” in the second definition to try and address this concern; John agreed that this would be acceptable.
- The group agreed upon the following definition, "Process of determining the validity of one or more credentials used to claim a digital identity."
Anonymity and Pseudonymity
- Mike would like to focus the discussion on interacting or conducting transactions in an anonymous or pseudonymous way. He suggested there is no way to truly remain “anonymous” digital or otherwise. Typically, someone always has an idea of who you are.
- Eric believes that we should define pseudonymity and anonymity. He also believes that these can be accomplished, and should at the least be defined.
- Seetharama agrees with Eric and believes that these can be accomplished.
- Anne thinks that we need to be very clear and careful in how we communicate these ideas to the public.
- Jim believes that by focusing on “transactions” we open up greater options. For example, an IDP can know who a person is, but can also allow that user to conduct pseudonymous interactions.
- Anne questioned whether or not, even when using a pseudonym, you can actual be pseudonymous due to data aggregation and data analysis. She thinks we need to make sure that people understand our terms by aligning them to what happens in the real world as this is their basis of understanding.
- Seetharama thinks we should be focused on what is possible, not what exists. We may not currently be able to achieve anonymity or pseudonymity, but that does not mean they cannot be achieved in the future.
- John believes that true anonymity is unlinkability.
- Mike believes it must go farther than that, it must address to whom things are unlikable. He used the journalist example and the “anonymous source”—not really anonymous the journalist knows who provided the information. The reader, as the relying party, trusts that what the journalist is relaying to us is accurate. The source is anonymous to the readers, but not the journalist.
- Seetharama thinks this is an excellent example of how the context determines where and how anonymity and pseudonymity occur.
- Suzanne pointed out that this is about defining taxonomy so that those in the IDESG can have a common understanding of words when they move them from the definitional to operational. The focus should not be on the multitude of potential implementations, but around a common understanding of what the terms underpinning those implementations mean.
- Mike suggested a list of nine terms, which were whittled down to 5 for further consideration by the AHG:
- Pseudonymous interaction
- Pseudonymous digital identity
- Anonymous interaction
- Anonymity
- Pseudonymity
- Anonymity and pseudonymity will be secondary terms considered after the first three have been addressed.
- “Pseudonym” was removed because it was considered to be covered by “pseudonymous digital identity.”
- “Pseudonymous/Anonymous transactions” were removed because they were considered to be narrower than “interactions.”
- “Anonymous digital identity” was removed because most believed it is not something that, at this time, can be properly defined.
Close out
- The next meeting will focus on the above identified terms relating to anonymity and pseudonymity.
- Mike will send out the new definitions of Credential and Authentication to the listserv to determine if there are any objections.
Actions
| Action | Owner | Due | Status |
|---|---|---|---|
| Complete Glossary 1.1 | AHG | 19-Dec | In-progress |
Quick Links: Taxonomy | Taxonomy Project Management | Taxonomy AHG Catalog | Taxonomy AHG Glossary |