In the previous post, I defined the following terms:
- Digital Identity
- Transaction Identity
In this post, I will discuss two more concepts: Digital identity ecosystem and level of assurance (“LoA”) of an identification process.
The digital identity ecosystem consists of three parties, the subject, the OSP, the CSP and the relationship between each two.
The LoA of an identification process is the level of certainty in the veracity of that identification event. Different transactions require different minimum LoAs. For example, signing up for an e-mail list is a low LoA transaction, while filing your taxes on the CRA’s website is a high LoA transaction.
According to the World Economic Forum, the LoA of a given transaction is determined by two main factors:
1. Registration protocols: How stringently the identity provider [the CSP] verifies
attributes when onboarding users
2. Authentication method: The strength of the authentication method used to complete transactions between the identity provider [the CSP] and the relying party [the OSP]
Accordingly, LoA can be increased by either making the registration protocols more stringent or by strengthening the authentication methods. Establishing standards for OSPs and CSPs for their registration protocols and authentication methods and requiring OSPs to use CSPs for the authentication of an identity claim can greatly increase the LoA of transactions.
Since the digital identity field is a rather new one, the terminology used differs from place to place. However, I will be using the terminology discussed here and in the previous post throughout the blog.