Digital identity is a necessity. It should be simple and accurate as well as easily eliminable. Users should be able to expect control over the dissemination of their personal data.
Each person has only one physical identity, but they can have many digital identities. Often digital identities are disposable (e.g., when users register to try a service but then abandon it if they do not like it). The user may have abandoned the service, but the service often continues to use the user’s personal data (given in the registration process) to follow the user, hopeful that sooner or later the person will come back.
There are many ways to ensure your digital identity is legally recognized (i.e., authentic, integral and not repudiable), such as using a digital signature as an alternative to a physical autograph. There are also identity provider services that certify that a username is only owned by the correct user.
However, these individual components are limited because they are separated. If I register with two services that are managed by two distinct identity providers, then I have to register twice, meaning I have to give my personal data twice. A solution to this can be achieved with symmetrical recognition between the two parts that must be identified with each other. The recognition must take place on the reliability of the digital identity that at that time corresponds to a physical identity, and, at the same time, the data subject must be certain that the site providing the service is registered with a control authority.
This solution is possible with an extension of the identity process based on identity provider; instead of a single trusted identity provider for both, everyone chooses their own. The guarantee of the actual identity is established by two trustees (double trustee), one for each party.
Editor’s note: For further insights on this topic, read Luigi Sbriz’s recent Journal articles, “A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 1,” and “A Symmetrical Framework for the Exchange of Identity Credentials Based on the Trust Paradigm, Part 2,” ISACA Journal, volume 2, 2022.
ISACA Journal turns 50 this year! Celebrate with us—and do not forget you can still receive the print copy by visiting your preference center and opting in!
