Identity assurance

Identity assurance, in an online context, is the ability of a relying party to determine, with some level of certainty, that a claim to a particular identity made by some entity can be trusted to actually be the claimant's "true" identity. Identity claims are made by presenting an identity credential to the relying party. In the case where the entity is a person, this credential may take several forms, including: (a) personally identifiable information such as name, address, birthdate, etc.; (b) an identity proxy such a username, login identifier (user name), or email address; and (c) an X.509 digital certificate.

Identity assurance specifically refers to the degree of certainty of an identity assertion made by an identity provider by presenting an identity credential to the relying party. In order to issue this assertion, the identity provider must first determine whether or not the claimant possesses and controls an appropriate token, using a predefined authentication protocol. Depending on the outcome of this authentication procedure, the assertion returned to the relying party by the identity provider allows the relying party to decide whether or not to trust that the identity associated with the credential actually "belongs" to the person presenting the credential.

The degree of certainty that a relying party can have about the true identity of someone presenting an identity credential is known as the assurance level (ALs). Four levels of assurance were outlined by a 2006 document from the US National Institute of Standards and Technology.[1] The level of assurance is measured by the strength and rigor of the identity proofing process, the strength of the token used to authenticate the identity claim, and the management processes the identity provider applies to it. These four levels were adopted by the governments of the U.K., Canada and the U.S. for electronic government services.

To conduct online business, entities need to be able to identify themselves remotely and reliably. In most cases, however, it is not sufficient for the typical electronic credential (usually a basic user name and password pair or a digital certificate) to simply assert "I am who I say I am - believe me." A relying party (RP) needs to be able to know to some degree of certainty that the presented electronic identity credential truly represents the individual presenting the credential. In the case of self-issued credentials, this isn't possible. However, most electronic identity credentials are issued by identity providers (IdPs): the workplace network administrator, a social networking service, an online game administrator, a government entity, or a trusted third party that sells digital certificates. Most people have multiple credentials from multiple providers. Four audiences are affected by the transaction-—and the inherent trust therein:

1. Users of electronic identity credentials,
2. Entities that rely upon the credentials issued by electronic identity providers (IdP),
3. Providers of IdP services and auditors or assessors who review the business processes of IdPs, and
4. Relying parties (RPs) trust electronic identity credentials provided by IdPs

Different IdPs follow different policies and procedures for issuing electronic identity credentials. In the business world, and especially in government, the more trustworthy the credential, the more stringent the rules governing identity proofing, credential management and the kind of credentials issued. But while different IdPs follow their own rules, more and more end users (often called subscribers) and online services (often called relying parties) wish to trust existing credentials and not issue yet another set of userID/passwords or other credentials for use to access one service. This is where the concept of federated identity becomes important. Federated identity provides IdPs and relying parties with a common set of identity trust conventions that transcend individual identity service providers, users, or networks, so that a relying party will know it can trust a credential issued by IdP 'A' at a level of assurance comparable to a common standard, which will also be agreed upon by IdPs 'B,' 'C,' and 'D.'

• Non-repudiation
• Self-sovereign identity