ISO/IEC 24760-1:2011

Information technology — Security techniques — A framework for identity management — Part 1: Terminology and concepts

ISO/IEC 24760-1:2011 defines terms for identity management, and specifies core concepts of identity and identity management and their relationships. It is applicable to any information system that processes identity information. A bibliography of documents describing various aspects of identity information management is provided.

Technologies de l'information — Techniques de sécurité — Cadre pour la gestion de l'identité — Partie 1: Terminologie et concepts

General Information

• Status: Withdrawn
• Publication Date: 06-Dec-2011
• Withdrawal Date: 06-Dec-2011
• ICS: 35.030 - IT Security
• ICS: 35.040 - Information coding
• Technical Committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
• Drafting Committee: ISO/IEC JTC 1/SC 27/WG 5 - Identity management and privacy technologies
• Current Stage: 9599 - Withdrawal of International Standard
• Completion Date: 29-May-2019

Relations

• Amended By: ISO/IEC 24760-1:2011/FDAmd 1 - Information technology — Security techniques — A framework for identity management — Part 1: Terminology and concepts — Amendment 1: Additional terminology and concepts
• Effective Date: 13-Oct-2020
• Revised: ISO/IEC 24760-1:2019 - IT Security and Privacy — A framework for identity management — Part 1: Terminology and concepts
• Effective Date: 23-Apr-2020

Standards Content (Sample)

INTERNATIONAL ISO/IEC
STANDARD 24760-1
First edition
2011-12-15


Information technology — Security
techniques — A framework for identity
management —
Part 1:
Terminology and concepts
Technologies de l'information — Techniques de sécurité — Cadre pour
la gestion de l'identité —
Partie 1: Terminologie et concepts





Reference number
ISO/IEC 24760-1:2011(E)
©
ISO/IEC 2011

---------------------- Page: 1 ----------------------
ISO/IEC 24760-1:2011(E)

COPYRIGHT PROTECTED DOCUMENT


©  ISO/IEC 2011
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means,
electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or
ISO's member body in the country of the requester.
ISO copyright office
Case postale 56  CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail [e-mail]
Web www.iso.org
Published in Switzerland

ii © ISO/IEC 2011 – All rights reserved

---------------------- Page: 2 ----------------------
ISO/IEC 24760-1:2011(E)
Contents Page
Foreword . iv
Introduction . v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
3.1 General terms . 1
3.2 Identification . 3
3.3 Authenticating an identity . 4
3.4 Management of identity . 5
3.5 Federation . 6
3.6 Privacy protection . 7
4 Symbols and abbreviated terms . 8
5 Identity . 8
5.1 General . 8
5.2 Identity information . 9
5.3 Identifier . 10
6 Attributes . 10
6.1 General . 10
6.2 Types of attribute . 11
6.3 Domain of origin . 11
7 Managing identity information . 12
7.1 General . 12
7.2 Identity lifecycle . 12
8 Identification . 14
8.1 General . 14
8.2 Verification . 15
8.3 Enrolment . 15
8.4 Registration . 15
9 Authentication . 16
10 Maintenance . 16
11 Implementation aspects. 16
12 Privacy . 17
Bibliography . 18
Index of terms . 20

© ISO/IEC 2011 – All rights reserved iii

---------------------- Page: 3 ----------------------
ISO/IEC 24760-1:2011(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are members of
ISO or IEC participate in the development of International Standards through technical committees
established by the respective organization to deal with particular fields of technical activity. ISO and IEC
technical committees collaborate in fields of mutual interest. Other international organizations, governmental
and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information
technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as
an International Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of patent
rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 24760-1 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
ISO/IEC 24760 consists of the following parts, under the general title Information technology — Security
techniques — A framework for identity management:
 Part 1: Terminology and concepts
The following parts are under preparation:
 Part 2: Reference architecture and requirements
 Part 3: Practice
iv © ISO/IEC 2011 – All rights reserved

---------------------- Page: 4 ----------------------
ISO/IEC 24760-1:2011(E)
Introduction
Data processing systems commonly gather a range of information on their users, be it a person, piece of
equipment, or piece of software connected to them, and make decisions based on the gathered information.
Such identity-based decisions may concern access to applications or other resources.
To address the need to efficiently and effectively implement systems that make identity-based decisions,
ISO/IEC 24760 specifies a framework for the issuance, administration, and use of data that serves to
characterize individuals, organizations or information technology components which operate on behalf of
individuals or organizations.
For many organizations the proper management of identity information is crucial to maintain security of the
organizational processes. For individuals, correct identity management is important to protect privacy.
ISO/IEC 24760 specifies fundamental concepts and operational structures of identity management with the
purpose to realize information system management so that information systems can meet business,
contractual, regulatory and legal obligations.
This part of ISO/IEC 24760 specifies the terminology and concepts for identity management, to promote a
common understanding in the field of identity management. It also provides a bibliography of documents
related to standardization of various aspects of identity management.

© ISO/IEC 2011 – All rights reserved v

---------------------- Page: 5 ----------------------
INTERNATIONAL STANDARD ISO/IEC 24760-1:2011(E)

Information technology — Security techniques — A framework
for identity management —
Part 1:
Terminology and concepts
1 Scope
This part of ISO/IEC 24760
 defines terms for identity management, and
 specifies core concepts of identity and identity management and their relationships.
This part of ISO/IEC 24760 is applicable to any information system that processes identity information.
A bibliography of documents describing various aspects of identity information management is provided.
2 Normative references
The following referenced documents are indispensable for the application of this document. For dated
references, only the edition cited applies. For undated references, the latest edition of the referenced
document (including any amendments) applies.
No normative references are cited.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
NOTE The terms and definitions in this part of ISO/IEC 24760 are drafted in accordance with ISO/IEC 10241,
International terminology standards — Preparation and layout, which specifies that alternative term(s), often used for the
term expressed in a bold typeface, may be placed on a separate line before the text defining the term. This part of
ISO/IEC 24760 uses only the term in bold face.
3.1 General terms
3.1.1
entity
item inside or outside an information and communication technology system, such as a person, an
organization, a device, a subsystem, or a group of such items that has recognizably distinct existence
EXAMPLE A human subscriber to a telecom service, a government agency, a SIM card, a passport, a network
interface card, a website.
© ISO/IEC 2011 – All rights reserved 1

---------------------- Page: 6 ----------------------
ISO/IEC 24760-1:2011(E)
3.1.2
identity
partial identity
set of attributes (3.1.3) related to an entity (3.1.1)
NOTE 1 An entity can have more than one identity.
NOTE 2 Several entities can have the same identity.
NOTE 3 In a particular domain of applicability an identity can become a distinguishing identity or an identifier to allow
entities to be distinguished or uniquely recognized within that domain.
[13]
NOTE 4 ITU-T X1252 specifies the distinguishing use of an identity. In this part of ISO/IEC 24760 the term identifier
implies this aspect.
3.1.3
attribute
characteristic or property of an entity (3.1.1) that can be used to describe its state, appearance, or other
aspects
NOTE The primary function of the concept of an attribute in this part of ISO/IEC 24760 is to be a particular, well-
defined aspect of the description of an entity in an identity management system. The values of attributes in an identity
together describe the entity in a domain.
EXAMPLE An entity type, address information, telephone number, a privilege, a MAC address, a domain name are
possible attributes.
3.1.4
identifier
unique identity
distinguishing identity
identity information (3.2.4) that unambiguously distinguishes one entity (3.1.1) from another one in a given
domain (3.2.3)
NOTE 1 An identifier may be suitable for use outside the domain.
NOTE 2 An identifier may be an attribute with an assigned value.
NOTE 3 An identifier may be the one or more attributes that determine if an identity passes or fails specific criteria.
EXAMPLE A name of a club with a club-membership number, a health insurance card number together with a name
of the insurance company, an email address, or a Universal Unique Identifier (UUID) can all be used as identifiers. In a
voter’s register, the combination of attributes name, address and date of birth is sufficient to unambiguously distinguish a
voter.
3.1.5
domain of origin
feature of an attribute (3.1.3) that specifies the domain (3.2.3) where the attribute was created or its value
(re)assigned
NOTE 1 The domain of origin typically specifies the meaning and format of the attribute value. Such specification may
be based on international standards.
NOTE 2 An attribute may contain an explicit value that references the domain of origin, e.g. an ISO country code for a
passport number as reference to the issuing country that is the domain of origin of identity information in the passport.
NOTE 3 Operationally, a domain of origin may be available as an authoritative source for an attribute (sometimes
known as the Attribute Authority). An authoritative source may be operated outside the actual domain of origin. Multiple
authoritative sources may exist for the same domain of origin.
EXAMPLE The domain of origin of a club-membership number is the specific club that assigned the number.
2 © ISO/IEC 2011 – All rights reserved

---------------------- Page: 7 ----------------------
ISO/IEC 24760-1:2011(E)
3.1.6
reference identifier
RI
identifier (3.1.4) in a domain (3.2.3) that is intended to remain the same for the duration an entity (3.1.1) is
known in the domain and is not associated with another entity for a period specified in a policy after the entity
ceases to be known in that domain
NOTE 1 A reference identifier persists at least for the existence of the entity in a domain and may exist longer than the
entity, e.g. for archival purposes.
NOTE 2 A reference identifier for an entity may change during the lifetime of an entity, at which point the old reference
identifier is no longer applicable for that entity.
EXAMPLE A driver license number that stays the same for an individual driver’s driving life is a persistent identifier,
which references additional identity information and that is a reference identifier. An IP address is not a reference identifier
as it can be assigned to other entities.
3.2 Identification
3.2.1
identification
process of recognizing an entity (3.1.1) in a particular domain (3.2.3) as distinct from other entities
NOTE 1 The process of identification applies verification to claimed or observed attributes.
NOTE 2 Identification typically is part of the interactions between an entity and the services in a domain and to access
resources. Identification may occur multiple times while the entity is known in the domain.
3.2.2
verification
process to determine that presented identity information (3.2.4) associated with a particular entity (3.1.1) is
applicable for the entity to be recognized in a particular domain (3.2.3) at some point in time
NOTE Verification can involve checking that the required attributes are present, have the correct syntax, and exist
within a defined validity period.
3.2.3
domain
domain of applicability
context
DA
environment where an entity (3.1.1) can use a set of attributes (3.1.3) for identification (3.2.1) and other
purposes
NOTE 1 In general the domain of an identity is well defined in relation to the particular set of attributes.
[13]
NOTE 2 ITU-T X1252 uses the term context; this part of ISO/IEC 24760 prefers the term domain.
EXAMPLE An IT system deployed by an organization that allows users to login is the domain for the user’s login
name.
3.2.4
identity information
set of values of attributes (3.1.3) optionally with any associated metadata in an identity (3.1.2)
NOTE In an information and communication technology system an identity is present as identity information.
© ISO/IEC 2011 – All rights reserved 3

---------------------- Page: 8 ----------------------
ISO/IEC 24760-1:2011(E)
3.3 Authenticating an identity
3.3.1
authentication
formalized process of verification (3.2.2) that, if successful, results in an authenticated identity (3.3.2) for
an entity (3.1.1)
NOTE 1 The authentication process involves tests by a verifier of one or more identity attributes provided by an entity
to determine, with the required level of assurance, their correctness.
NOTE 2 Authentication typically involves the use of a policy to specify a required level of assurance for the result of a
successful completion.
NOTE 3 Identification is usually done as authentication to obtain a specific level of assurance in the result.
3.3.2
authenticated identity
identity information (3.2.4) for an entity (3.1.1) created to record the result of authentication (3.3.1)
NOTE 1 An authenticated identity typically contains information obtained in the authentication process, e.g. the level of
assurance attained.
NOTE 2 The existence of an authenticated identity in a particular domain denotes that an entity has been recognized in
that domain.
NOTE 3 An authenticated identity typically has a lifespan restricted by an authentication policy.
3.3.3
identity information authority
IIA
entity (3.1.1) related to a particular domain (3.2.3) that can make provable statements on the validity and/or
correctness of one or more attribute (3.1.3) values in an identity (3.1.2)
NOTE 1 An identity information authority is typically associated with the domain, for instance the domain of origin, in
which the attributes, which the IIA can make assertions on, have a particular significance.
NOTE 2 The activity of an identity information authority may be subject to a policy on privacy protection.
NOTE 3 An entity can combine the functions of identity information provider and identity information authority.
3.3.4
identity information provider
identity provider
IIP
entity (3.1.1) that makes available identity information (3.2.4)
NOTE Typical operations performed by an identity information provider are to create and maintain identity information
for entities known in a particular domain. An identity information provider and an identity information authority may be the
same entity.
3.3.5
credential
representation of an identity (3.1.2)
NOTE 1 A credential is typically made to facilitate data authentication of the identity information in the identity it
represents.
NOTE 2 The identity information represented by a credential can be printed on paper or stored within a physical token
that typically has been prepared in a manner to assert the information as valid.
EXAMPLE A credential can be a username, username with a password, a PIN, a smartcard, a token, a fingerprint, a
passport, etc.
4 © ISO/IEC 2011 – All rights reserved

---------------------- Page: 9 ----------------------
ISO/IEC 24760-1:2011(E)
3.3.6
verifier
entity (3.1.1) that performs verification (3.2.2)
NOTE A verifier may be the same as, or act on behalf of, the entity that controls identification of entities for a
particular domain.
3.3.7
relying party
RP
entity (3.1.1) that relies on the verification (3.2.2) of identity information (3.2.4) for a particular entity
NOTE A relying party is exposed to risk caused by incorrect identity information. Typically it has a trust relationship
with one or more identity information authorities.
3.3.8
identity assertion
statement by an identity information authority (3.3.3) used by a relying party (3.3.7) for authentication
(3.3.1)
NOTE An identity assertion may be the cryptographic proof of a successful authentication, created with algorithms
and keys agreed between parties, e.g. in an identity federation.
3.3.9
identity assurance
level of assurance in the result of identification (3.2.1)
NOTE Identity assurance expresses the level of confidence in provenance, integrity and applicability of identity
information including confidence in identity information maintenance.
3.4 Management of identity
3.4.1
identity management
IDM
processes and policies involved in managing the lifecycle and value, type and optional metadata of attributes
(3.1.3) in identities (3.1.2) known in a particular domain
NOTE 1 In general identity management is involved in interactions between parties where identity information is
processed.
NOTE 2 Processes and policies in identity management support the functions of an identity information authority where
applicable, in particular to handle the interaction between an entity for which an identity is managed and the identity
information authority.
3.4.2
identity proofing
initial entity authentication
particular form of authentication (3.3.1) based on identity evidence (3.4.4) that is performed as the
condition for enrolment (3.4.3)
NOTE 1 Typically identity proofing involves an extensive verification of provided identity information and may include
screening, vetting and uniqueness checks, possibly based on biometric techniques.
NOTE 2 Authentication, at the heart of identity proofing, typically is based on an enrolment policy that includes
specification of the verification criteria of the identity evidence provided by the entity.
NOTE 3 The authenticated identity that is the result of the authentication in identity proofing may during subsequent
enrolment be included in the registration and may serve to facilitate future identification of the entity.
© ISO/IEC 2011 – All rights reserved 5

---------------------- Page: 10 ----------------------
ISO/IEC 24760-1:2011(E)
3.4.3
enrolment
process to make an entity (3.1.1) known within a particular domain (3.2.3)
NOTE 1 Enrolment leads to identity registration. Identity proofing is typically performed to establish the identity
information to be registered for a particular entity.
NOTE 2 In general enrolment collates and creates identity information for storage in an identity register to be used in
subsequent identification of the entity in the domain. It is the start of the lifecycle of an identity in the domain for an entity.
3.4.4
identity evidence
evidence of identity
identity information (3.2.4) for an entity (3.1.1) required for authentication (3.3.1) of that entity (3.1.1)
NOTE Identity evidence includes the presented and gathered information related to a claimant that is needed for a
successful authentication. Any such information may be part of the authenticated identity for the claimant.
3.4.5
identity register
IMS register
repository of identities (3.1.2) for different entities (3.1.1)
NOTE 1 A typical identity register is indexed by a reference identifier.
NOTE 2 The identity information authority in a particular domain typically uses its own identity register. However, an
identity register may be shared between related domains, e.g. within the same commercial entity.
NOTE 3 The reliability of the identity information in an identity register is determined by the authentication policies used
during enrolment.
3.4.6
identity registration
process of recording an entity’s (3.1.1) identity information (3.2.4) in an identity register (3.4.5)
3.4.7
reference-identifier generator
tool used during enrolment (3.4.3) to provide a fresh unique value for a reference identifier (3.1.6)
EXAMPLE A database management system can be the reference identifier generator when it assigns a unique
record number to a new record being added to a table and the record number is used as reference identifier.
3.5 Federation
3.5.1
federated identity
identity (3.1.2) for use in multiple domains (3.2.3), which together form an identity federation (3.5.2)
NOTE 1 A federated identity may be jointly managed by identity information providers of the federated domains.
NOTE 2 The shared attributes used in the federated domains may in particular be used for identification, e.g. to
support single-sign-on (SSO).
NOTE 3 The federated identity may persist or may be a temporary one, e.g. as single-sign-on identity.
6 © ISO/IEC 2011 – All rights reserved

---------------------- Page: 11 ----------------------
ISO/IEC 24760-1:2011(E)
3.5.2
identity federation
agreement between two or more domains (3.2.3) specifying how identity information (3.2.4) will be
exchanged and managed for cross-domain identification (3.2.1) purposes
NOTE 1 Establishing an identity federation typically includes an agreement on the use of common protocols and
procedures for privacy control, data protection and auditing. The federation agreement may specify the use of
standardized data formats and cryptographic techniques.
NOTE 2 The federation agreement can be the basis for identity authorities in each of the domains of applicability to
mutually recognize credentials for authorization.
3.5.3
single-sign-on identity
SSO identity
identity (3.1.2) that includes a single identity assertion (3.3.8) that can be verified (3.2.2) by a relying party
(3.3.7) in multiple domains (3.2.3)
NOTE The identity assertion in a single-sign-on identity is created during authentication of an entity in one domain
and can be used in authentication of the entity in any other domain in the same identity federation.
3.6 Privacy protection
In jurisdictions where certain types of legal entities are granted the right of privacy protection, the term ‘person’
in the following definitions should be interpreted to include such entities; otherwise the term ‘person’ is used in
relation to a single human individual.
3.6.1
selective disclosure
principle of identity management (3.4.1) that gives a person a measure of control over the identity
information (3.2.4) that may be transferred to a third party, e.g. during authentication (3.3.1)
3.6.2
minimal disclosure
principle of identity management (3.4.1) to restrict the request or transfer of identity information (3.2.4) to a
third party to the minimum information strictly required for a particular purpose
NOTE The principle of proportionality is related to minimal disclosure in so far as the effort of control intervention is
reasonable in relation to the activity.
3.6.3
pseudonym
identifier (3.1.4) that contains the minimal identity information (3.2.4) sufficient to allow a verifier (3.3.6) to
establish it as a link to a known identity (3.1.2)
NOTE 1 A pseudonym can be used to reduce privacy risks that are associated with the use of identifiers with fixed or
known values.
NOTE 2 A pseudonym can be an identifier with a value chosen by the person, or assigned randomly.
3.6.4
anonymity
Condition in identification (3.2.1) whereby an entity (3.1.1) can be recognized as distinct, without sufficient
identity information (3.2.4) to establish a link to a known identity (3.1.2)
NOTE Anonymous identification typically involves the use of special credentials that can be cryptographically
validated. Cryptographic protocols for validation of an anonymous credential exist that can be configured to provide a
verifier with required identity information. The identity obtained in this way may have multiple attributes.
© ISO/IEC 2011 – All rights reserved 7

---------------------- Page: 12 ----------------------
ISO/IEC 24760-1:2011(E)
4 Symbols and abbreviated terms
DA Domain (of applicability)
ICT Information and Communication Technology
IDM Identity Management
IMS Identity Management System
IIP Identity Information Provider
IIA Identity Information Authority
RI Reference Identifier
RP Relying Party
SSO Single Sign On
URI Uniform Resource Identifier
UUID Universal Unique Identifier
5 Identity
5.1 General
An identity is the information used to represent an entity in an ICT system. The purpose of the ICT system
determines which of the attributes describing an entity are used for an identity. Within an ICT system an
identity shall be the set of those attributes related to an entity which are relevant to the particular domain of
application served by the ICT system. Depending on the specific requirements of this domain, this set of
attributes related to the entity (the identity) may, but does not have to be, uniquely distinguishable from other
identities in the ICT system.
This part of ISO/IEC 24760 considers any set of attributes that describes a particular entity as an identity for
the entity. In some domains, the identity information for different entities may be the same. In other standards,
e.g. ITU-T X1252[13], the explicit pur
...