Technical Glossary
A representation of a real-world entity within a digital system that enables authentication, authorization, and attribute-based access control. Digital identity encompasses identifiers, credentials, and metadata that collectively describe a person, organization, or device in electronic interactions. Modern digital identity frameworks prioritize user control, interoperability, and privacy by design. Standards from NIST, ISO, and W3C define identity assurance levels and technical requirements for trustworthy digital identity systems.
The process of collecting, validating, and verifying evidence about an individual to establish their identity at a specified assurance level before issuing a digital credential. Identity proofing involves document validation, biometric comparison, and knowledge-based verification steps as defined by NIST SP 800-63A. Automated proofing systems increasingly employ AI-driven document authentication and liveness detection to reduce fraud. The process is foundational to Know Your Customer, anti-money laundering, and government identity programs.
An architecture that enables identity information to be shared across organizational boundaries through trust relationships and standardized protocols such as SAML, OpenID Connect, and OAuth 2.0. Federated identity allows users to authenticate once with an identity provider and access multiple service providers without creating separate accounts. This reduces credential proliferation, improves user experience, and centralizes authentication policy enforcement. Enterprise federation frameworks are governed by trust frameworks that define liability, data handling, and assurance requirements.
An authentication layer built on top of the OAuth 2.0 authorization framework that enables clients to verify end-user identity and obtain basic profile information through a standardized REST-based protocol. OIDC introduces ID tokens encoded as JSON Web Tokens that convey authentication claims from identity providers to relying parties. The protocol supports multiple flows including authorization code, implicit, and hybrid for different client architectures. It has become the dominant web authentication standard adopted by major identity providers and enterprise platforms.
Authentication systems that leverage deep learning models to match physiological or behavioral biometric traits such as fingerprints, facial geometry, voice patterns, and keystroke dynamics against enrolled templates. AI-driven approaches improve accuracy through convolutional neural networks for image processing and recurrent networks for sequential behavioral data. These systems must address presentation attack detection, demographic bias mitigation, and template protection requirements. NIST evaluates biometric algorithm performance through programs like the Face Recognition Vendor Test.
A W3C web standard that enables passwordless authentication by allowing web applications to use public key cryptography and platform authenticators such as biometric sensors and security keys. WebAuthn defines a JavaScript API through which browsers mediate the creation and assertion of cryptographic credentials bound to a relying party origin. It eliminates phishing vulnerabilities inherent in password-based systems by ensuring credentials are origin-bound and never transmitted to servers. The specification is a core component of the FIDO2 framework maintained by the FIDO Alliance.
A discoverable FIDO2 credential that replaces passwords by binding a cryptographic key pair to a user account and synchronizing the private key across the user's devices through platform credential managers. Passkeys leverage WebAuthn for registration and authentication while adding cross-device availability through cloud synchronization provided by operating system vendors. They resist phishing, credential stuffing, and server-side breaches because the private key never leaves the user's secure enclave. Major platform providers including Apple, Google, and Microsoft have implemented passkey support in their operating systems and browsers.
A framework of policies, processes, and technologies that manage digital identities and their access entitlements throughout the identity lifecycle including provisioning, certification, and deprovisioning. IGA systems enforce the principle of least privilege, automate access reviews, and maintain audit trails for regulatory compliance. AI-enhanced IGA platforms use machine learning to detect anomalous access patterns and recommend role-mining optimizations. The discipline intersects with identity analytics, privileged access management, and zero trust architecture principles.
An access control model that evaluates authorization decisions based on attributes of the subject, resource, action, and environment rather than static role assignments. ABAC policies are expressed using standards such as XACML and enable fine-grained, context-aware access decisions that adapt to changing conditions. AI integration allows dynamic attribute evaluation through risk scoring and behavioral analytics. NIST SP 800-162 provides the authoritative guide for implementing ABAC in enterprise environments.
A compact, URL-safe token format defined by IETF RFC 7519 that encodes claims as a JSON object and optionally signs or encrypts the payload for integrity and confidentiality. JWTs consist of a header, payload, and signature and are widely used as bearer tokens in OAuth 2.0 and OpenID Connect authentication flows. They enable stateless session management by embedding user identity and authorization claims directly in the token. Related specifications including JWS, JWE, and JWK define the signing algorithms, encryption mechanisms, and key representation formats used with JWTs.
A security paradigm that continuously verifies user identity throughout a session rather than relying solely on a single authentication event at login. Continuous authentication systems employ behavioral biometrics, device posture signals, and contextual risk scoring to detect session hijacking and unauthorized access in real time. Machine learning models analyze typing patterns, mouse movements, and interaction cadence to build adaptive user profiles. This approach aligns with zero trust principles that mandate ongoing verification of identity and device trust.
A personal data storage and messaging hub specified by the Decentralized Identity Foundation that enables individuals to store, replicate, and manage identity-related data across multiple nodes under their control. DWNs provide a standardized interface for applications to read and write data associated with a DID without requiring centralized cloud storage. They support data synchronization, access permissions, and protocol-based messaging for decentralized application architectures. DWNs are a key infrastructure component for Web5 and self-sovereign data ecosystems.
A security discipline that applies AI and analytics to detect and respond to identity-based attacks including credential theft, privilege escalation, and account takeover in real time. ITDR systems correlate signals from identity providers, endpoint agents, and network telemetry to identify anomalous authentication patterns and lateral movement. They complement traditional SIEM and XDR platforms by focusing specifically on the identity attack surface. The discipline emerged in response to the growing volume of identity-centric attacks targeting cloud and hybrid enterprise environments.
A privacy-enhancing capability that allows a credential holder to share only specific attributes from a verifiable credential rather than revealing the entire credential contents to a verifier. Selective disclosure is implemented through techniques such as SD-JWT, BBS+ signatures, and zero-knowledge proofs that enable granular claim-level presentation. This mechanism supports data minimization principles mandated by privacy regulations and reduces the risk of over-collection of personal information. The IETF SD-JWT specification and W3C Verifiable Credentials standard define the technical frameworks for selective disclosure implementations.
A security model that eliminates implicit trust by requiring continuous verification of identity, device posture, and context for every access request regardless of network location. Zero trust architecture treats identity as the primary control plane and enforces per-request authentication and authorization through policy engines and identity-aware proxies. AI and machine learning enhance zero trust by enabling adaptive risk scoring and automated policy adjustment based on behavioral analytics. NIST SP 800-207 provides the reference architecture that defines the core tenets and deployment models for zero trust implementations.