1  INTRODUCTION

The guide is designed to provide an expert view on what a Trust Framework to enable Smart Digital ID should look like, by detailing its salient components: the principles, content, roles and responsibilities.

It builds upon the OIX 2017 paper “Trust Frameworks for Identity Systems”, which attained worldwide acceptance; becoming a benchmark guide used by global organizations defining rules and standards for trust. This new guide incorporates lessons learnt from existing national and international frameworks including eIDAS in Europe, Verify in the UK, the PCTF in Canada and Aadhaar in India.

OIX provides comprehensive, practitioner informed descriptions along with real-world examples of all the potential components in a trust framework by defining it within the following context:

• Principles and Trustmarks
• Trust rules (e.g. Proofing, Authentication, Identity Assurance)
• User services (e.g. Consent, Multiplicity, ID creation)
• Organizational services (e.g. User access, Liability, SLAs)
• General and Legal rules (e.g. Data Management, Record Keeping, Fraud Controls)
• Security and Technical Requirements (e.g. Schemas, Chain of Trust)
• Governance (e.g. Certification, Enrolment, Operations)
• Interoperability

Additionally, it defines and details the roles and responsibilities within a framework, outlining the functions, input and outputs of each party within the framework. This is critical for potential new entrants to determine how they can participate, contribute to, or derive the most benefit from a trust framework.

The guide is intended to provide a clear guide to trusted identity and Attributes for both users and organizations, in line with the OIX mission to present the human end of identity as opposed to a solely technical viewpoint. To this end, the guide is technology agnostic providing the neutrality to allow providers of trust frameworks to implement frameworks in accordance with their own specific technical needs. The trust framework presented in this guide is suitable for the governance of both decentralised and centralised ID ecosystems, including those supporting federation of IDs.

In the context of this guide a Digital ID could be for:

• An individual acting in their personal capacity
• An individual acting on behalf of an organization.  
• A thing that is controlled by an individual or an organisation.

For all the above scenarios a User controls the Digital ID. Sometimes the user must be involved every time a Digital ID is used. Other times, for example for the Digital ID of a thing, users might only be involved to set up and manage the thing on a more occasional basis with the things Digital ID acting on its behalf the rest of the time.

This guide describes Digital ID in the context of users controlling a Digital ID that is asserted to an organization that consumes the Digital ID for the provision of products and services.

It is recognised that there are Digital ID solutions which create Digital IDs that identify an organization. This allows an organization to assert their ‘organizational Digital ID’ so that individuals can trust an organization, enabling them the be sure of the entity they are transacting with.

It will allow regulators to comprehend the relevance of trust frameworks when defining appropriate regulations for areas such as anti-money laundering.

As stated above, this guide draws on previous OIX work on trust frameworks, in particular:

Paper	Date Published	Authors
Trust Frameworks for Identity Systems	Jun 2017	Esther Makaay – SIDN Tom Smedinghoff - Locke Lord LLP Don Thibeau - Open Identity Exchange
Establishing a Trusted Digital Identity Ecosystem	Oct 2019	Ewan Villars, Innovate Identity

 

The identity community uses a plethora of specialist terminology. In order to try and standardise the vernacular OIX has created a separate Glossary of Identity Terms, including common synonyms.

How is the guide being evolved?

This guide links to further, more detailed, reference guides on the previously mentioned topics. These reference guides will detail what needs to be accomplished in order to deliver the high-level contents and what considerations need to be given to ensure the success and interoperability of any resulting trust framework or scheme.

Full PDF versions of the guide and the glossary can be found by clicking on the link at the top right handside of this page.

2  WHO IS THE INTENDED AUDIENCE

The guide will be of use to a broad audience:

• Individuals (users) - explains how trust frameworks can provide them with portable, re-usable, ubiquitous identities through the focus on interoperability between trust frameworks which will allow individuals to use their trusted digital identities and attributes across sectors and borders. The framework emphasises that Digital IDs need to understand the rules of complex processes and help the users through those processes; the Digital ID must be smart.  This guide is not intended to provide an end-user explanation of trust frameworks, but should enable expert users, with an IT and identity background, to understand how they are put together.
• Organizations (Relying Parties, as the consumers of trust) – explains how trusted identities work and what roles and governance they should expect to see in the ecosystem. Why can they trust a Digital ID? How should a Digital ID work for them in terms of working to their rules. The OIX directory can be used to find trusted suppliers of IDs: Credential Issuers, Identity Providers or ID Brokers. The OIX directory provides a single reference point for Trust Schemes, trust providers and their associated certification.
• Framework Creators – provides a Guide to creating frameworks that then ensures any framework created is following proven best practice and should be interoperable with other frameworks. The OIX directory will list other frameworks for reference.
• Global Identity Influencers - Brings together their already largely aligned thinking into a single, high level, easy to understand web-reference.
• Existing Framework Operators - Defines how interoperability between frameworks can work.
• OIX ID Services Members - The OIX Directory positions each member’s services against the framework based on their role (or sub-role) in the ecosystem.