1. Tokens & Proofing De-Mystified
Firefighter
Father
Driver
Customer
Student
Veteran

2. Joe’s Online Presence

3. Hi, I’m Joe

4. Token Management Process
Joe interacts with Someone
Joe provides some details
Joe is issued a “Token”

5. Proof of Joe being Joe

6. Identity Proofing Process
Joe interacts with Someone
Joe’s details are “Verified”
Joe is “Proofed”

7. What does it take for Joe to get a strong credential?
Management
Token
Secure Linking Process
Proofing
Identity
Credential = Token + Identity

8. Authentication Attribute Authority Binding Joe Token Manager Identity
manages
Token Management
Service
Consent
Service
Identity
Record
Manager
manages
Identity Proofing
Service
Authentication
Attribute Authority
Binding
Binding
Manager
manages
Token-Identity
Link Record
Validation
Service
Authentication
Token: Something that the individual possesses and controls that is used to authenticate the individual. Tokens are possessed by an individual and controlled through one or more of the traditional authentication factors (something you know, have, or are).
Identifier: An attribute used to uniquely distinguish between individuals (versus describing individuals)
Identity: A set of attributes that uniquely describe an individual within a given context.
Credential: An object or data structure that authoritatively binds an identity to a token possessed and controlled by an individual.
Authentication: Process intended to establish an understood level of confidence that an identifier refers to a specific individual
Identity Resolution: Process intended to resolve identity attributes to a unique individual (i.e. no other individual has the same set of attributes.)
Validation: Process intended to establish soundness or correctness of a construct
Verification: Process intended to test or prove the truth or accuracy of a fact or value
Token Managers have the ability to assert to a specific level of confidence, via the authentication service, that an individual has maintained control over a token entrusted to them and that the token has not been compromised. Authentication of a Token simply establishes an understood level of confidence that it is the same individual at the other end of the wire. But not who the individual is.
Identity Managers verify attributes and associate them with a unique individual as part of an identity proofing process and, via the validation service, have the ability to assert those verified attributes
Online
Application (RP)

9. Joe’s Identity is the Starting Point for Delivering
High Value Services, Benefits and Entitlements to Him
Today, identity is managed in “cylinders of excellence” a.k.a silos …
Financial Sector
Who are you?
How will you pay?
Identity Risk Issues
Financial fraud
Money laundering
Higher transaction fees
Public Sector
Who are you?
Are you eligible for a government benefit?
Identity Risk Issues
Benefits fraud
Longer processing times
Redundant processes
Healthcare Sector
Who are you?
What is your medical history?
Identity Risk Issues
Prescription fraud
Patient privacy
Record integrity
Why should Joe get a strong credential?
The above picture shows how the starting point for service delivery, across the sectors, is the question of "Who are you?". The risk inherent in answering that question results in all of us being impacted by issues such as fraud, privacy breeches, and higher transactions costs. So, the initial establishment of identity by authoritative entities, and successfully leveraging it across multiple contexts is critical to reducing identity risk.
In the physical world, we deal with this on a regular basis, and rely upon a few authoritative entities to be accountable for the identity establishment function. Taking the United States as an example, if you look at DHS Form I-9, Page 9, List A and List B (Documents that Establish Identity + ), they include:
U.S. State and Canadian Driver’s license
U.S. Passport
Green Card
Government issued ID Card
U.S. Military Card
U.S. Coast Guard Merchant Mariner Card
Native American Tribal Document ….
… but the impacts are felt by everyone

10. Credential Service Provider
Joe
Token
Manager
manages
Token Management
Service
Consent
Service
Identity
Record
Manager
manages
Identity Proofing
Service
RP delegates
Authentication, Identity Management and Binding
Authentication
Attribute Authority
Binding
Binding
Manager
manages
Token-Identity
Link Record
Validation
Service
Authentication
Token: Something that the individual possesses and controls that is used to authenticate the individual. Tokens are possessed by an individual and controlled through one or more of the traditional authentication factors (something you know, have, or are).
Identifier: An attribute used to uniquely distinguish between individuals (versus describing individuals)
Identity: A set of attributes that uniquely describe an individual within a given context.
Credential: An object or data structure that authoritatively binds an identity to a token possessed and controlled by an individual.
Authentication: Process intended to establish an understood level of confidence that an identifier refers to a specific individual
Identity Resolution: Process intended to resolve identity attributes to a unique individual (i.e. no other individual has the same set of attributes.)
Validation: Process intended to establish soundness or correctness of a construct
Verification: Process intended to test or prove the truth or accuracy of a fact or value
Token Managers have the ability to assert to a specific level of confidence, via the authentication service, that an individual has maintained control over a token entrusted to them and that the token has not been compromised. Authentication of a Token simply establishes an understood level of confidence that it is the same individual at the other end of the wire. But not who the individual is.
Identity Managers verify attributes and associate them with a unique individual as part of an identity proofing process and, via the validation service, have the ability to assert those verified attributes
Online
Application (RP)
RP uses
External Credential

11. Identity Manager RP manages Authentication and Binding RP uses
Joe
Token
Manager
manages
Token Management
Service
Consent
Service
Identity
Record
Manager
manages
Identity Proofing
Service
RP manages
Authentication and Binding
RP uses
External Identity
RP delegates
Identity Management
Authentication
Attribute Authority
Binding
Binding
Manager
manages
Token-Identity
Link Record
Validation
Service
Authentication
Token: Something that the individual possesses and controls that is used to authenticate the individual. Tokens are possessed by an individual and controlled through one or more of the traditional authentication factors (something you know, have, or are).
Identifier: An attribute used to uniquely distinguish between individuals (versus describing individuals)
Identity: A set of attributes that uniquely describe an individual within a given context.
Credential: An object or data structure that authoritatively binds an identity to a token possessed and controlled by an individual.
Authentication: Process intended to establish an understood level of confidence that an identifier refers to a specific individual
Identity Resolution: Process intended to resolve identity attributes to a unique individual (i.e. no other individual has the same set of attributes.)
Validation: Process intended to establish soundness or correctness of a construct
Verification: Process intended to test or prove the truth or accuracy of a fact or value
Token Managers have the ability to assert to a specific level of confidence, via the authentication service, that an individual has maintained control over a token entrusted to them and that the token has not been compromised. Authentication of a Token simply establishes an understood level of confidence that it is the same individual at the other end of the wire. But not who the individual is.
Identity Managers verify attributes and associate them with a unique individual as part of an identity proofing process and, via the validation service, have the ability to assert those verified attributes
Online
Application (RP)

12. Token Manager RP delegates Authentication RP manages
Joe
Token
Manager
manages
Token Management
Service
Consent
Service
Identity
Record
Manager
manages
Identity Proofing
Service
RP delegates
Authentication
RP manages
Identity and Binding
RP uses
External Token
Authentication
Attribute Authority
Binding
Binding
Manager
manages
Token-Identity
Link Record
Validation
Service
Authentication
Token: Something that the individual possesses and controls that is used to authenticate the individual. Tokens are possessed by an individual and controlled through one or more of the traditional authentication factors (something you know, have, or are).
Identifier: An attribute used to uniquely distinguish between individuals (versus describing individuals)
Identity: A set of attributes that uniquely describe an individual within a given context.
Credential: An object or data structure that authoritatively binds an identity to a token possessed and controlled by an individual.
Authentication: Process intended to establish an understood level of confidence that an identifier refers to a specific individual
Identity Resolution: Process intended to resolve identity attributes to a unique individual (i.e. no other individual has the same set of attributes.)
Validation: Process intended to establish soundness or correctness of a construct
Verification: Process intended to test or prove the truth or accuracy of a fact or value
Token Managers have the ability to assert to a specific level of confidence, via the authentication service, that an individual has maintained control over a token entrusted to them and that the token has not been compromised. Authentication of a Token simply establishes an understood level of confidence that it is the same individual at the other end of the wire. But not who the individual is.
Identity Managers verify attributes and associate them with a unique individual as part of an identity proofing process and, via the validation service, have the ability to assert those verified attributes
Online
Application (RP)