Entities, identities, identifiers and credentials — what does it all mean?

Abstract

This paper looks at the concepts of entities, identities, identifiers and credentials, their definitions, and how they combine to authenticate an identity to an account, or function, within a service. Credentials can be divided into several different types on the basis of their use, origin and characteristics. In particular, types such as composite, dynamic and derived credentials will be considered, and their applicability within an identity management system. Each credential must be managed through its entire life cycle from initial registration, general use and suspension, to deletion. The notion of public (i.e. freely distributable) and private (i.e. known only to you) aspects of a credential is explored. The bindings, by trusted third parties, of identifiers and public credentials into permits and instruments of proof is explained along with the convenience, but greater exposure, of local information. Several scenarios are analysed in terms of how different types of credentials are employed during the authentication process.