The Authenticity Alliance
The eight metrics of Identity Quality™
Degree of protection of personal assets
Does the user have "skin in the game" or are your organization’s assets the only ones at risk? If the only reliable way to prevent credential sharing is to use credentials that protect the user's financial, reputational, and identity assets, then to what extent does the identity protect those personal assets? Ownership of the credential itself is considered in this score.
Each scored on a scale of 0-9
Quality of enrollment practices
What type of enrollment procedure was used? Did it involve PII corroboration (“KBA”)? Was it face-to-face notarial or remote? How is provisioning performed? How is the process supervised and audited? How many eyes are watching? Each risk profile and highest protected digital asset value will call for a particular enrollment procedure.
Quality of means of assertion
Does the credential support OpenID, i-Name, Shibboleth, CardSpace? Does it use SAML assertions? A well-used identity is a more reliable identity; the more places it is used the better.
Quality of authoritative attestation
What source of authority attests to the validity of the assertion — that is, the claimed identity? Is the attesting party a certification authority? How reliable are their attestation practices? How is identity status reported: CRL, OCSP, or another method?
Self-sovereign EOI and attestation from others
To what extent does the “complex relational web” of self-sovereign methods support the subject’s claim of identity, and to what extent do colleagues, employers, and sources of other relationships corroborate the subject's claim of identity? The more acquaintances who are willing to back up the subject’s claim of identity, and the higher the scores of those who do so, the higher this score will be.
Quality of the credential
What are the characteristics of the credential and its carrier? Is one key pair used for everything, or are different key pairs or simple serial numbers used for different applications? The carrier of the credential is equally important. Some risk-profile/asset-value situations call for two-, three-, or four-factor hardware tokens or a one-time password, while a soft credential in the client computer or even a record in a directory will suffice for others.
Quality of assumption of liability
If fraud is committed with the use of the credential, who carries the liability? Is that commitment bonded? What are the terms of the bond? What is the source of funds for fulfillment of the bond? Are there caveats or is the commitment absolute, regardless of the circumstances that made the credential available to the perpetrator? To protect assets and processes of the highest value, where a compromised identity would have the most serious consequences, there should be both civil and criminal liability involved in the issuance and ongoing use of the credential. Equally important is protection against fraudulent repudiation. Non-repudiation is perhaps the most difficult goal for a trust system to achieve, but it is necessary for the system to be useful to relying parties where significant transactions are involved.
Reputation of the credential
How long has the credential been used without revocation or reported compromise? How many transactions and authentication events has it been used for in total? The longer a credential has been used without incident, the more reliable it tends to be. Note that the reputation of the credential is not the same thing as the reputation of the person. For example, if someone with a very good personal reputation has a habit of lending his or her credential to family members and colleagues — resulting in documented confusion over who is responsible for what — then the reputation of the credential is greatly diminished.
What is Authenticity™?
Home
IDQA vs. NIST 800-63
[Animated GIF "placeholder" goes on top of this]
IDQA Calculator
Try out the interactive dashboard
HOW RELIABLE is a credential in representing the person it claims?
Eight metrics measure a wide range of considerations, from original identity enrollment to the track record of the credential's use.
Relying parties, authentication gateways, and identity-sensitive transactions can require a minimum IDQA for access.
The user's credential contains the total IDQA score (0-72) and the individual scores (1-9) of the eight metrics, allowing judgment on the relative importance of particular metrics.
For example, a seller in a multimillion-dollar real estate deal might require the buyer to have a high score on Metric 7 (assumption of liability) to protect against a fraudulent transaction, but a chat room for young girls might require a high Metric 2 score that ensures face-to-face enrollment, to protect against child predators joining the room. Relying parties can weigh the importance of metrics that are most relevant to their requirements.
Access to individual metrics
Turn Up the Trust
