Identity management (or ID management, or simply IdM) is a broad administrative area that deals with identifying individuals in a system (such as a country, a network, or an organization) and controlling access to the resources in that system by placing restrictions on the established identities of the individuals.
Identity management is multidisciplinary and covers many dimensions, such as:
Contents |
Identity management (IdM) is a term related to how humans are identified and authorized across computer networks. It covers issues such as how users are given an identity, the protection of that identity, and the technologies supporting that protection (e.g., network protocols, digital certificates, passwords, etc.).
Digital identity: Personal identifying information (PII) selectively exposed over a network. See OECD[1] and NIST[2] guidelines on protecting PII[3] and the risk of identity theft.
While the term management requires little explanation, the term identity is a more abstract concept that will always be difficult to define in a way that satisfies everyone. It is a concept that is fluid and contextual depending on a number of factors including culture.
Thus the term management is appended to "identity" to indicate that there is technological and best practice framework around a somewhat intractable philosophical concept. Digital identity can be interpreted as the codification of identity names and attributes of a physical instance in a way that facilitates processing. In each organization there is normally a role or department that is responsible for managing the schema of digital identities of their staff and their own objects, these represented by object identities or object identifiers (OID).[4]
The SAML protocol is a prominent means used to exchange identity information between two identity domains. Other examples are listed on the Website of this project. [5]
In the real-world context of engineering online systems, identity management can involve three perspectives:
A general model of identity can be constructed from a small set of axiomatic principles, for example that all identities in a given abstract namespace are unique and distinctive, or that such identities bear a specific relationship to corresponding entities in the real world. An axiomatic model of this kind can be considered to express "pure identity" in the sense that the model is not constrained by the context in which it is applied. In general, an entity can have multiple identities, and each identity can consist of multiple attributes or identifiers, some of which are shared and some of which are unique within a given name space. The diagram below illustrates the conceptual relationship between identities and the entities they represent, as well as between identities and the attributes they consist of.
In most theoretical and all practical models of digital identity, a given identity object consists of a finite set of properties. These properties may be used to record information about the object, either for purposes external to the model itself or so as to assist the model operationally, for example in classification and retrieval. A "pure identity" model is strictly not concerned with the external semantics of these properties.
The most common departure from "pure identity" in practice occurs with properties intended to assure some aspect of identity, for example a digital signature or software token which the model may use internally to verify some aspect of the identity in satisfaction of an external purpose. To the extent that the model attempts to express these semantics internally, it is not a pure model.
Contrast this situation with properties which might be externally used for purposes of information security such as managing access or entitlement, but which are simply stored and retrieved, in other words not treated specially by the model. The absence of external semantics within the model qualifies it as a "pure identity" model.
Identity management, then, can be defined as a set of operations on a given identity model, or as a set of capabilities with reference to it. In practice, identity management is often used to express how identity information is to be provisioned and reconciled between multiple identity models.
User access requires each user to assume a unique "digital identity" across applications and networked infrastructures, which enables access controls to be assigned and evaluate against this identity. Technically, the use of a unique identity across all systems ease the monitoring and verification of potential unauthorized access, and allows the organization to keep tabs of excessive privileges granted to any individual within the company. From the user lifecycle perspective, user access can be tracked from new hire, suspension to termination of employee.
In the service paradigm perspective, where organizations evolve their systems to the world of converged services, the scope of identity management becomes much larger, and its application more critical. The scope of identity management includes all the resources of the company deployed to deliver online services. These may include devices, network equipment, servers, portals, content, applications and/or products as well as a user's credentials, address books, preferences, entitlements and telephone numbers. See Service Delivery Platform and Directory service.
Today[update], many organizations face a major clean-up in their systems if they are to bring identity coherence into their influence. Such coherence has become a prerequisite for delivering unified services to very large numbers of users on demand — cheaply, with security and single-customer viewing facilities.
The management of identity raises a certain number of issues, such as privacy issues that may lead to the implementation of a surveillance society (Taylor, Lips & Organ 2009), or risk related to the stealing of identity (identity theft).
The advent of the social web, and in particular the important development of online social networking services, for which the management of their identities of their members represent a core element of these systems, also create a certain number of risks related to the disclosure of personal information (Gross, Acquisti & Heinz 2008), and in particular in losing an individual's privacy (Taylor 2008).
First, it should be noted that people, and in particular the young people (15-25), are well aware of the risks towards eID enabled services (Lusoli & Miltgen 2009). More specifically young people:
Addressing these different issues may be done only by legislation or via the use of technical systems, but have to combine the different dimensions such as:
Research related to the management of identity covers a variety of disciplines (such as technology, social sciences, the humanities and the law (Halperin & Backhouse 2009)) and areas, and tries to investigate many different issues (technical, legal, societal, etc.).
Within the Seventh Research Framework Programme of the European Union from 2007 to 2013, several new projects related to Identity Management started. PICOS investigates and develops a state-of-the-art platform for providing trust, privacy and identity management in mobile communities. On the backdrop of an increased risk to privacy of the citizen in the Information Society, PrimeLife will develop concepts and technologies to help individuals to protect their autonomy and retain control over personal information, irrespective of their activities. SWIFT focuses on extending identity functions and federation to the network while addressing usability and privacy concerns, and leverages identity technology as a key to integrate service and transport infrastructures for the benefit of users and the providers.
Other identity related projects from older European Union funded framework programs include:
Different academic journals can be used to publish articles related to identity management such as:
Less specialized journals may also publish on the topic, and for instance have special issue on Identity such as:
ISO (and more specifically ISO/IEC JTC1, SC27 IT Security techniques) is conducting some standardization work for identity management (ISO 2009), such as the elaboration of a framework for identity management, including the definition of different identity related terms.