Donec aliquam et ligula id congue. Sed eu urna et tellus placerat viverra. Quisque ut posuere magna, nec
- accumsan augue. Nullam mauris tortor, semper finibus elementum maximus, imperdiet in felis. Suspendisse quis
- imperdiet nibh, eget ultrices justo. Pellentesque vitae malesuada justo. Vestibulum quis scelerisque lectus,
- non rutrum odio. Aenean leo orci, semper non massa sed, facilisis ornare ipsum. Morbi at sem orci. Integer
- eros mi, faucibus sed lorem id, pharetra imperdiet nisl. Integer viverra enim vel luctus lobortis. Ut turpis
- tellus, consequat nec lectus et, dictum elementum nunc. Integer rhoncus venenatis molestie. Donec egestas
- condimentum ligula in porttitor. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per
- inceptos himenaeos.
-
-
term 2
-
-
Pellentesque suscipit ipsum varius, mattis diam in, elementum nunc Term 1, Term Three, Term 3, Term
- 4. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Donec
- placerat, elit sed tempor viverra, magna ligula porttitor tortor, eget suscipit erat enim vel nisl. Integer
- vel urna in quam viverra dignissim at in orci. Aliquam erat volutpat. Nam vitae neque nibh. In sollicitudin
- felis vitae ex finibus, in eleifend lectus efficitur. Vestibulum enim ex, condimentum nec accumsan ut,
- vestibulum at lacus. Maecenas non vulputate ante. Sed porttitor et eros sit amet venenatis.
-
-
term 3
-
-
-
Nam euismod augue sed tempus imperdiet. Pellentesque ac porta ipsum, sed sodales leo. Suspendisse molestie
- est sit amet est porta, sit amet molestie dolor pharetra. Duis porta mollis sem vel aliquam. Maecenas
- laoreet turpis nunc, vitae mattis urna auctor ac. Donec mattis quis urna nec porta. Sed sit amet viverra
- ligula. Vivamus vitae sem sodales, malesuada dui sit amet, viverra lectus. Integer ullamcorper molestie
- ante, in blandit nunc tempus auctor.
-
-
term 4
-
-
Sed lorem nunc, ultricies nec nibh eu, bibendum sollicitudin arcu. Nullam porttitor condimentum elit ac
- commodo. Aenean ac augue quis arcu congue aliquam vitae in massa. Aliquam erat volutpat. Curabitur lobortis,
- sapien vitae mattis dignissim, risus augue iaculis risus, sed tempus sapien ex nec massa. Integer quis
- maximus nunc. Nunc ultrices sapien erat, at congue augue mattis sit amet. Aliquam condimentum luctus nunc,
- ut euismod augue commodo in.
-
-
-
ยง Demo of example markup in Spec-Up-T and
- Markdown
To be, or not to be, that is the question:
- Whether 'tis nobler in the mind to suffer
- The slings and arrows of outrageous fortune,
- Or to take arms against a sea of troubles
- And by opposing end them. To dieโto sleep,
- No more;
Donec aliquam et ligula id congue. Sed eu urna et tellus placerat viverra. Quisque ut posuere magna, nec accumsan augue. Nullam mauris tortor, semper finibus elementum maximus, imperdiet in felis. Suspendisse quis imperdiet nibh, eget ultrices justo. Pellentesque vitae malesuada justo. Vestibulum quis scelerisque lectus, non rutrum odio. Aenean leo orci, semper non massa sed, facilisis ornare ipsum. Morbi at sem orci. Integer eros mi, faucibus sed lorem id, pharetra imperdiet nisl. Integer viverra enim vel luctus lobortis. Ut turpis tellus, consequat nec lectus et, dictum elementum nunc. Integer rhoncus venenatis molestie. Donec egestas condimentum ligula in porttitor. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos.
+
+
term 2
+
+
Pellentesque suscipit ipsum varius, mattis diam in, elementum nunc Term 1, Term Three, Term 3, Term 4. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Donec placerat, elit sed tempor viverra, magna ligula porttitor tortor, eget suscipit erat enim vel nisl. Integer vel urna in quam viverra dignissim at in orci. Aliquam erat volutpat. Nam vitae neque nibh. In sollicitudin felis vitae ex finibus, in eleifend lectus efficitur. Vestibulum enim ex, condimentum nec accumsan ut, vestibulum at lacus. Maecenas non vulputate ante. Sed porttitor et eros sit amet venenatis.
+
+
term 3
+
+
Nam euismod augue sed tempus imperdiet. Pellentesque ac porta ipsum, sed sodales leo. Suspendisse molestie est sit amet est porta, sit amet molestie dolor pharetra. Duis porta mollis sem vel aliquam. Maecenas laoreet turpis nunc, vitae mattis urna auctor ac. Donec mattis quis urna nec porta. Sed sit amet viverra ligula. Vivamus vitae sem sodales, malesuada dui sit amet, viverra lectus. Integer ullamcorper molestie ante, in blandit nunc tempus auctor.
+
+
term 4
+
+
Sed lorem nunc, ultricies nec nibh eu, bibendum sollicitudin arcu. Nullam porttitor condimentum elit ac commodo. Aenean ac augue quis arcu congue aliquam vitae in massa. Aliquam erat volutpat. Curabitur lobortis, sapien vitae mattis dignissim, risus augue iaculis risus, sed tempus sapien ex nec massa. Integer quis maximus nunc. Nunc ultrices sapien erat, at congue augue mattis sit amet. Aliquam condimentum luctus nunc, ut euismod augue commodo in.
+
+
+
ยง Demo of example markup in Spec-Up-T and Markdown
To be, or not to be, that is the question:
+Whether 'tis nobler in the mind to suffer
+The slings and arrows of outrageous fortune,
+Or to take arms against a sea of troubles
+And by opposing end them. To dieโto sleep,
+No more;
Use the following format to pull in content from other files in your project:
+
This text has been inserted here from another file: [[insert: assets/test.text]]
-
This text has been inserted here from another file: Beam me in, Scotty!
-
You can even insert content within more complex blocks, like the JSON object below which is being pulled in and
- rendered in a syntax-highlighted example block:
-
+
This text has been inserted here from another file: Beam me in, Scotty!
+
You can even insert content within more complex blocks, like the JSON object below which is being pulled in and rendered in a syntax-highlighted example block:
+
::: example Code Example
```json
[[insert: assets/test.json]]
```
:::
- sequenceDiagram
- Alice ->> Bob: Hello Bob, how are you?
- Bob-->>John: How about you John?
- Bob--x Alice: I am good thanks!
- Bob-x John: I am good thanks!
- Note right of John: Bob thinks a long long time, so long that the text does not fit on a row.
+
+sequenceDiagram
+ Alice ->> Bob: Hello Bob, how are you?
+ Bob-->>John: How about you John?
+ Bob--x Alice: I am good thanks!
+ Bob-x John: I am good thanks!
+ Note right of John: Bob thinks a long long time, so long that the text does not fit on a row.
- Bob-->Alice: Checking with John...
- Alice->John: Yes... John, how are you?
-
When the katex option is enabled, the KaTeX math engine is used for TeX rendering. You can find a
- list of supported features and examples here: https://katex.org/docs/supported.html.
-
$$\begin{pmatrix}x_2 \ y_2 \end{pmatrix} =
- \begin{pmatrix} A & B \ C & D \end{pmatrix}\cdot
- \begin{pmatrix} x_1 \ y_1 \end{pmatrix}$$
-
$$\def\arraystretch{1.5}
- \begin{array}{c:c:c}
- a & b & c \ \hline
- d & e & f \
- \hdashline
- g & h & i
- \end{array}$$
-
$$
- \underbrace{a+b+c}_{\text{Note: such math, much wow.}}
- $$
When the katex option is enabled, the KaTeX math engine is used for TeX rendering. You can find a list of supported features and examples here: https://katex.org/docs/supported.html.
+
$$\begin{pmatrix}x_2 \ y_2 \end{pmatrix} =
+\begin{pmatrix} A & B \ C & D \end{pmatrix}\cdot
+\begin{pmatrix} x_1 \ y_1 \end{pmatrix}$$
+
$$\def\arraystretch{1.5}
+\begin{array}{c:c:c}
+a & b & c \ \hline
+d & e & f \
+\hdashline
+g & h & i
+\end{array}$$
+
$$
+\underbrace{a+b+c}_{\text{Note: such math, much wow.}}
+$$
Spec-Up automatically upgrades the links of certain sites, like GitHub. GitHub is the only supported site with
- Fancy Links right now, but weโll be adding more as we go.
Features enable Verifiers to express, and Holders to support,
- extended functionality (relative to the base objects) by defining one or more
- properties on one or more objects.
-
Feature
-
Features enable Verifiers to express, and Holders to support,
- extended functionality (relative to the base objects) by defining one or more
- properties on one or more objects.
Some examples refer to an unfamiliar query protocol, dwn://, as a way of
- storing and querying schemata and other resources. While orthogonal to this
- specification and not yet on a standards track, the concept of โdecentralized web nodesโ
- proposes an architecture that may be of interest or utility to implementers of
- this specification. For more information, see the draft specification
- hosted at the decentralized identity foundation
- here
-
-
Decentralized Web Node
-
Some examples refer to an unfamiliar query protocol, dwn://, as a way of
- storing and querying schemata and other resources. While orthogonal to this
- specification and not yet on a standards track, the concept of โdecentralized web nodesโ
- proposes an architecture that may be of interest or utility to implementers of
- this specification. For more information, see the draft specification
- hosted at the decentralized identity foundation
- here
-
-
Input Descriptor
-
Input Descriptors are used by a Verifier to describe the information required
- of a Holder before an interaction can proceed. See
- Input Descriptor.
-
-
Input Descriptor
-
Input Descriptors are used by a Verifier to describe the information required
- of a Holder before an interaction can proceed. See
- Input Descriptor.
-
-
Input Descriptor
- Object
-
Input Descriptors Objects are populated with properties describing what type
- of input data/Claim, or sub-fields thereof, are required for
- submission
- to the Verifier. See
- Input Descriptor Object.
-
-
Input Descriptor
- Object
-
Input Descriptors Objects are populated with properties describing what type
- of input data/Claim, or sub-fields thereof, are required for
- submission
- to the Verifier. See
- Input Descriptor Object.
-
-
Link Secrets
-
Link Secrets are values held by the Holder but hidden from
- other
- parties. They are typically incorporated into cryptographic signatures used in
- claims to demonstrate correlation while preventing replay attacks. An Issuer
- may ascertain that a Holder possesses a link secret without its disclosure.
- See Link Secrets.
-
Presentation Definition
-
Presentation Definitions are objects that articulate what proofs a Verifier
- requires. These help the Verifier to decide how or whether to interact with a
- Holder. Presentation Definitions are composed of inputs, which
- describe
- the forms and details of the proofs they require, and optional sets of
- selection rules, to allow Holders flexibility in cases where many different
- types of proofs may satisfy an input requirement. See
- Presentation Definition.
-
-
Presentation Request
-
Presentation Requests are transport mechanisms for Presentation. Presentation Requests can take multiple shapes, using a variety
- of protocols and signature schemes not refined in this specification. They are
- sent by a Verifier to a Holder. Defining Presentation Requests
- is outside the scope of this specification. See
- Presentation Request.
-
-
Presentation Submission
-
Presentation Submissions are objects embedded within target claim negotiation
- formats that unify the presentation of proofs to a Verifier
- in
- accordance with the requirements a Verifier specified in a
- Presentation Definition. See
- Presentation Submission.
-
-
Subject
-
Subjects are the entities about which Claims are made. The
- Subject may
- not be the same entity as the Holder
-
Subject
-
Subjects are the entities about which Claims are made. The
- Subject may
- not be the same entity as the Holder
-
Submission
- Requirement
-
Submission Requirements are objects that define what combinations of inputs
- must be submitted to comply with the requirements a Verifier
- has for
- proceeding in a flow (e.g. credential issuance, allowing entry, accepting an
- application). See Submission Requirements.
-
Submission
- Requirement
-
Submission Requirements are objects that define what combinations of inputs
- must be submitted to comply with the requirements a Verifier
- has for
- proceeding in a flow (e.g. credential issuance, allowing entry, accepting an
- application). See Submission Requirements.
Something that is actually done (a โunit of workโ that is executed) by a single actor (on behalf of a given party),
- as a single operation, in a specific context.Source: eSSIF-Lab.
In the context of decentralized digital trust infrastructure, the empowering of a party to act independently of its own accord, and in particular to empower the party
- to employ an agent to act on the partyโs behalf.
-
-
agent:
-
-
An actor that is executing an action on behalf of a party (called
- the principal of that actor). In the context of decentralized digital trust infrastructure, the term
- โagentโ is most frequently used to mean a digital
- agent.
An adjective describing when the identity of a natural person or other actor is unknown.
-
-
anycast:
-
-
Anycast is a network addressing and routing methodology in which a single IP-address is shared by devices (generally servers) in
- multiple locations. Routers direct packets addressed to
- this destination to the location nearest the sender, using their normal decision-making algorithms, typically
- the lowest number of BGP network hops. Anycast routing is
- widely used by content delivery networks such as web and name servers,
- to bring their content closer to end users.
A level of confidence that may be relied on by others. Different types of assurance levels are defined for
- different types of trust assurance mechanisms. Examples include authenticator assurance level, federation
- assurance level, and identity assurance level.
-
-
appropriate friction:
-
-
A user-experience design principle for information systems (such as digital wallets) specifying that the
- level of attention required of the holder for a particular
- transaction should provide a reasonable opportunity for an informed choice by the holder.
-
-
attestation:
-
-
The issue of a statement, based on a decision, that fulfillment of specified requirements has been demonstrated. In the context of decentralized digital
- trust infrastructure, an attestation usually has a digital signature so that it is cryptographically verifiable.
-
-
attribute:
-
-
An identifiable set of data that describes an entity, which
- is the subject of the attribute.
-
-
attribute-based access control:
-
-
An access control approach in which access is
- mediated based on attributes associated with subjects (requesters) and the objects to be accessed. Each
- object and subject has a set of associated attributes, such as location, time of creation, access
- rights, etc. Access to an object is authorized or denied
- depending upon whether the required (e.g., policy-defined) correlation can be made between the attributes of that object and of the requesting subject.
-
-
audit (of system controls):
-
-
Independent review and examination of records and activities to assess the adequacy of system controls, to
- ensure compliance with established policies and
- operational procedures.
-
-
audit log:
-
-
An audit log is a security-relevant chronological record,
- set of records, and/or destination and source of records that provide documentary evidence of the sequence of
- activities that have affected at any time a specific operation, procedure, event, or device.
-
-
auditor (of an entity):
-
-
The party responsible for performing an audit. Typically an auditor must be accredited.
-
-
authentication(of a user; process; or
- device):
-
-
Verifying the identity of a user, process, or device,
- often as a prerequisite to allowing access to resources in an information system.
-
-
authentication(of a user; process; or
- device):
-
-
Verifying the identity of a user, process, or device,
- often as a prerequisite to allowing access to resources in an information system.
-
-
authenticator
-
-
Something the claimant possesses and controls (typically a cryptographic module or password) that is used to
- authenticate the claimantโs identity.
-
-
authenticator assurance
- level
-
-
A measure of the strength of an authentication
- mechanism and, therefore, the confidence in it.
-
-
authenticator assurance
- level
-
-
A measure of the strength of an authentication
- mechanism and, therefore, the confidence in it.
The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator.
-
-
authorization
-
-
The process of verifying that a requested action or service is approved for a specific entity.
-
-
authorized organizational
- representative
-
-
A person who has the authority to make claims, sign documents or otherwise commit resources on
- behalf of an organization.
A measurable physical characteristic or personal behavioral trait used to recognize the AID, or verify the claimedidentity, of an
- applicant. Facial images, fingerprints, and iris scan samples are all examples of biometrics.
-
-
blockchain:
-
-
A distributed digital ledger of
- cryptographically-signed transactions that are grouped into blocks. Each block is cryptographically linked to
- the previous one (making it tamper evident) after validation and undergoing a consensus decision. As new blocks are added, older
- blocks become more difficult to modify (creating tamper resistance). New blocks are replicated across copies of the ledger
- within the network, and any conflicts are resolved automatically using established rules.
-
-
broadcast:
-
-
In computer networking, telecommunication and information theory, broadcasting is a method of transferring a
- message to all recipients simultaneously. Broadcast
- delivers a message to all nodes in the network using a
- one-to-all association; a single datagram (or packet) from one sender is routed to all of the possibly
- multiple endpoints associated with the broadcast
- address. The network automatically replicates datagrams as needed to reach all the recipients within the scope of the
- broadcast, which is generally an entire network subnet.
-
-
broadcast address:
-
-
A broadcast address is a network address used to
- transmit to all devices connected to a multiple-access communications network. A message sent to a broadcast address may be received by all network-attached hosts. In contrast, a multicast address is used to address a specific group of devices, and a
- unicast address is used to address a single device.
- For network layer communications, a broadcast address may be a specific IP address.
A comprehensive assessment of the management, operational, and technical security controls in an information
- system, made in support of security accreditation, to
- determine the extent to which the controls are implemented correctly, operating as intended, and producing the
- desired outcome with respect to meeting the security requirements for the system.
An assertion about a subject, typically expressed as an attribute or property of the subject. It is
- called a โclaimโ because the assertion is always made by some party, called the issuer of the
- claim, and the validity of the claim must be judged by the
- verifier.
-
-
Coalition for Content Provenance and
- Authenticity:
-
-
C2PA is a Joint Development Foundation project of the Linux Foundation that addresses the prevalence of
- misleading information online through the development of technical standards for certifying the source and
- history (or provenance) of media content.
-
-
communication:
-
-
The transmission of information.
-
-
communication endpoint:
-
-
A type of communication network node. It is an interface exposed by a communicating party or by a communication channel. An example of the
- latter type of a communication endpoint is a publish-subscribe topic or a group in group communication
- systems.
-
-
communication channel:
-
-
A communication channel refers either to a physical transmission medium such as a wire, or to a logical connection over a multiplexed medium such as a radio
- channel in telecommunications and computer networking. A channel is used for information transfer of, for
- example, a digital bit stream, from one or several senders to one or several receivers.
-
-
communication metadata:
-
-
Metadata that describes the sender, receiver, routing, handling, or contents of a communication. Communication metadata is often
- observable even if the contents of the communication
- are encrypted.
-
-
communication session:
-
-
A finite period for which a communication
- channel is instantiated and maintained, during which certain properties of that channel, such as authentication of the participants, are in
- effect. A session has a beginning, called the session initiation, and an ending, called the session
- termination.
-
-
complex password:
-
-
A password that meets certain security requirements, such
- as minimum length, inclusion of different character types, non-repetition of characters, and so on.
-
-
compliance:
-
-
In the context of decentralized digital trust infrastructure, the extent to which a system, actor, or party conforms to the requirements of a governance framework or trust framework that pertains to that particular entity.
-
-
concept:
-
-
An abstract idea that enables the classification of entities, i.e., a mental construct that enables an instance of a class of entities to be distinguished from entities that are not an instance of that class. A concept can be identified with a term.
-
-
confidential computing:
-
-
Hardware-enabled features that isolate and process encrypteddata in memory so that
- the data is at less risk of exposure and compromise from
- concurrent workloads or the underlying system and platform.
The Content Authenticity Initiative (CAI) is an association founded in November 2019 by Adobe, the New York
- Times and Twitter. The CAI promotes an industry
- standard for provenance metadata defined by the C2PA. The CAI cites curbing disinformation as one motivation
- for its activities.
A system, process or set of policies under which a person
- agrees to share personal data for specific usages. A
- consent management system will typically create a record of
- such consent.
In a communications context, a type of privacy
- protection in which messages use encryption, hashes, or other
- privacy-preserving technologies to avoid the use of identifiers or other content that unauthorizedparties may
- use to correlate the sender and/or receiver(s).
-
-
counterparty:
-
-
From the perspective of one party, the other party in a transaction, such as a financial transaction.
-
-
credential:
-
-
A container of claims describing one or more subjects. A credential is generated by the issuer of the credential and given to the holder of the credential. A credential typically includes a
- signature or some other means of proving its authenticity. A credential may be either a physical credential or a digital credential.
In the context of terminology, a written description
- of a concept that anyone can evaluate to determine whether
- or not an entity is an instance or example of that concept. Evaluation leads to a yes/no result.
-
-
cryptographic binding:
-
-
Associating two or more related elements of information using cryptographic techniques.
-
-
cryptographic key:
-
-
A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a
- file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Symmetric cryptography refers to the practice of the same
- key being used for both encryption and decryption.
- Asymmetric cryptography has separate keys for encrypting and decrypting. These keys are known as the public keys and private
- keys, respectively.
-
-
cryptographic trust:
-
-
A specialized type of technical trust that is
- achieved using cryptographic algorithms.
The informal terms or formal legal agreement under which a custodian agrees to provide service to a principal.
-
-
dark pattern:
-
-
A design pattern, mainly in user interfaces, that has the effect of deceiving individuals into making choices
- that are advantageous to the designer.
-
-
data:
-
-
In the pursuit of knowledge, data is a collection of
- discrete values that convey information, describing quantity, quality, fact, statistics, other basic units of
- meaning, or simply sequences of symbols that may be further interpreted. A datum is an individual value in a
- collection of data.
In telecommunications and computer networking, a network packet is a formatted unit of data carried by a packet-switched network such as the Internet.
- A packet consists of control information and user data; the
- latter is also known as the payload. Control information provides data for delivering the payload (e.g.,
- source and destination network addresses, error detection codes, or sequencing information). Typically,
- control information is found in packet headers and trailers.
-
-
data schema:
-
-
A description of the structure of a digital document or object, typically expressed in a machine-readable language in terms of constraints
- on the structure and content of documents or objects of that type. A credential schema is a particular type of
- data schema.
A decentralized personal and application data storage and message relay node, as defined in the DIF
- Decentralized Web Node specification. Users may have multiple nodes that replicate their data between them.
-
In the context of the World Wide Web, deep linking is the use of a hyperlink that links to a specific,
- generally searchable or indexed, piece of web content on a website (e.g. โhttps://example.com/path/pageโ),
- rather than the websiteโs home page (e.g., โhttps://example.comโ). The URL contains all the information needed
- to point to a particular item. Deep linking is different from mobile deep linking, which refers to directly linking to in-app content
- using a non-HTTP URI.
-
-
definition:
-
-
A textual statement defining the meaning of a term by
- specifying criterion that enable the concept identified by the term to be distinguished from all other concepts within the intended scope.
The controller of a device capable of digital communications, e.g., a smartphone, tablet, laptop,
- IoT device, etc.
-
-
dictionary:
-
-
A dictionary is a listing of lexemes (words or terms) from
- the lexicon of one or more specific languages, often arranged alphabetically, which may include information on
- definitions, usage, etymologies, pronunciations,
- translation, etc. It is a lexicographical reference that shows inter-relationships among the data. Unlike a glossary, a dictionary may provide multiple definitions of a term depending
- on its scope or context.
-
-
DID controller:
-
-
An entity that has the capability to make changes to a DID document. A DID might have more than one DID controller. The DID controller(s) can be denoted by
- the optional controller property at the top level of the DID document. Note that a DID controller might be the DID subject.
-
-
DID document:
-
-
A set of data describing the DID subject, including
- mechanisms, such as cryptographic public keys, that the DID
- subject or a DID delegate can use to authenticate itself and prove its association with the DID. A DID document might have one or more different
- representations as defined in section 6 of the W3C Decentralized Identifiers (DIDs) 1.0 specification.
-
-
DID method:
-
-
A definition of how a specific DID method scheme is implemented. A DID method is defined by a DID method
- specification, which specifies the precise operations by which DIDs and DID documents are
- created, resolved, updated, and deactivated.
-
-
DID subject:
-
-
The entity identified by a DID and described by a DID
- document. Anything can be a DID subject: person, group, organization, physical thing, digital thing,
- logical thing, etc.
-
-
DID URL:
-
-
A DID plus any additional syntactic component that conforms to
- the definition in section 3.2 of the W3C Decentralized Identifiers (DIDs) 1.0 specification. This
- includes an optional DID path (with its leading / character), optional DID query (with its leading ?
- character), and optional DID fragment (with its leading # character).
-
-
digital agent:
-
-
In the context of โโdecentralized digital trust infrastructure, an agent (specifically a type of software agent) that operates in conjunction with a digital wallet.
-
-
digital asset:
-
-
A digital asset is anything that exists only in digital form and comes with a distinct usage right. Data that do not possess that right are not considered assets.
-
A digital ecosystem is a distributed, adaptive, open socio-technical system with properties of
- self-organization, scalability and sustainability inspired from natural ecosystems. Digital ecosystem models
- are informed by knowledge of natural ecosystems, especially for aspects related to competition and
- collaboration among diverse entities.
-
-
digital identity:
-
-
An identity expressed in a digital form for the purpose
- representing the identified entity within a computer system
- or digital network.
-
-
digital rights management:
-
-
Digital rights management (DRM) is the management of legal access to digital content. Various tools or
- technological protection measures (TPM) like access
- control technologies, can restrict the use of proprietary hardware and copyrighted works. DRM
- technologies govern the use, modification and distribution of copyrighted works (e.g. software, multimedia
- content) and of systems that enforce these policies within devices.
An information system, network, distributed database, or blockchain designed to provide one or more supporting services to higher level
- components of decentralized digital trust infrastructure. In the ToIP stack, digital trust utilities are at Layer 1. A verifiable data registry is one type of digital trust utility.
-
-
digital signature:
-
-
A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the
- prerequisites are satisfied, gives a recipient very high confidence that the message was created by a known sender (authenticity), and that the
- message was not altered in transit (integrity).
-
-
digital vault:
-
-
A secure container for data whose controller is the principal. A digital vault is most commonly used in conjunction with a digital wallet and a digital agent. A digital vault may be implemented on a local device or in the
- cloud; multiple digital vaults may be used by the same principal across different devices and/or the cloud; if so they may use some type
- of synchronization. If the capability is supported, data may
- flow into or out of the digital vault automatically based on subscriptions approved by the controller.
A distributed ledger (also called a shared ledger or distributed ledger technology or DLT) is the consensus
- of replicated, shared, and synchronized digital data that is
- geographically spread (distributed) across many sites, countries, or institutions. In contrast to a
- centralized database, a distributed ledger does not require a central administrator, and consequently does not
- have a single (central) point-of-failure. In general, a distributed ledger requires a peer-to-peer (P2P) computer network and consensus
- algorithms so that the ledger is reliably replicated across distributed computer nodes (servers, clients, etc.). The most common form of distributed ledger technology
- is the blockchain, which can either be on a public or
- private network.
eIDAS (electronic IDentification, Authentication and trust Services) is an EU regulation with the stated
- purpose of governing โelectronic identification and trust services for electronic transactionsโ. It passed in 2014 and its
- provisions came into effect between 2016-2018.
Cryptographic transformation of data (called plaintext) into a form (called ciphertext) that conceals the dataโs original meaning to prevent it from being known or used. If the
- transformation is reversible, the corresponding reversal process is called decryption, which is a transformation that restores encrypted data to its original state.
The end-to-end principle is a design framework in computer networking. In networks designed according to this
- principle, guaranteeing certain application-specific features, such as reliability and security, requires that
- they reside in the communicating end nodes of the network. Intermediary nodes, such as gateways and routers, that
- exist to establish the network, may implement these to improve efficiency but cannot guarantee end-to-end
- correctness.
A digital identity architecture in which a digital identity established on one computer
- system, network, or trust domain is linked to other
- computer systems, networks, or trust domains for the
- purpose of identifying the same entity across those domains.
-
A category that describes the federation protocol used
- to communicate an assertion containing authentication) and attribute information (if applicable) to a relying party, as defined in NIST SP 800-63-3 in terms of three levels: FAL 1 (Some
- confidence), FAL 2 (High confidence), FAL 3 (Very high confidence).
-
-
fiduciary:
-
-
A fiduciary is a person who holds a legal or ethical relationship of trust with one or more other parties (person or group of persons). Typically, a fiduciary
- prudently takes care of money or other assets for another
- person. One party, for example, a corporate trust company or
- the trust department of a bank, acts in a fiduciary capacity to another party, who, for example, has entrusted funds to the fiduciary for safekeeping or
- investment. In a fiduciary relationship, one person, in a position of vulnerability, justifiably vests
- confidence, good faith, reliance, and trust in another whose aid, advice, or protection is sought in some
- matter.
A set of identity data, such as a credential, that is issued not for the purpose of establishing a foundational identity for the subject, but for the purpose of
- establishing other attributes, qualifications, or capabilities of the subject. Loyalty cards, library cards,
- and employee IDs are all examples of functional identities. Foundational identities are often used to provide identity binding for functional identities.
-
-
gateway:
-
-
A gateway is a piece of networking hardware or software used in telecommunications networks that allows data to flow from one discrete network to another. Gateways are
- distinct from routers or switches in that they communicate
- using more than one protocol to connect multiple networks[1][2] and can
- operate at any of the seven layers of the open systems interconnection model (OSI).
The General Data Protection Regulation (Regulation (EU) 2016/679, abbreviated GDPR) is a European Union
- regulation on information privacy in the European Union (EU) and the European Economic Area (EEA). The GDPR is
- an important component of EU privacy law and human rights law, in particular Article 8(1) of the Charter of
- Fundamental Rights of the European Union. It also governs the transfer of personal data outside the EU and EEA. The GDPRโs goals are to enhance
- individualsโ control and rights over their personal information and to simplify the regulations for
- international business.
-
-
glossary:
-
-
A glossary (from Ancient Greek: ฮณฮปแฟถฯฯฮฑ, glossa; language, speech, wording), also known as a
- vocabulary or clavis, is an alphabetical list of terms in a particular domain of knowledge (scope) together with
- the definitions for those terms. Unlike a dictionary, a glossary has only one definition for each term.
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
The party (or set of parties) authoritative for governing a trust community, usually (but not always) by developing, publishing,
- maintaining, and enforcing a governance
- framework. A governing body may be a government, a formal legal entity of any kind, an informal group of
- any kind, or an individual. A governing body may also delegate operational responsibilities to an administering body.
A guardianship arrangement (in a jurisdiction) is the
- specification of a set of rights and duties between legal entities of the jurisdiction that enforces these
- rights and duties, for the purpose of caring for, protecting, guarding, and defending one or more of these entities. At a minimum, the
- entities participating in a guardianship arrangement are the guardian and the dependent.
-
A physical computing device that provides tamper-evident and intrusion-resistant safeguarding and management
- of digital keys and other secrets, as well as
- crypto-processing.
An algorithm that computes a numerical value (called the hash value) on a data file or
- electronic message that is used to represent that file or
- message, and depends on the entire contents of the file or message. A hash function can be considered to be a
- fingerprint of the file or message. Approved hash functions satisfy the following properties: one-way
- (it is computationally infeasible to find any input that maps to any pre-specified output); and collision
- resistant (it is computationally infeasible to find any two distinct inputs that map to the same
- output).
The process of creating and verifying a relationship between the holder of a digital wallet
- and the wallet itself. Holder binding is related to but NOT the same as subject binding.
-
-
host:
-
-
A host is any hardware device that has the capability of permitting access to a network via a user interface,
- specialized software, network address, protocol stack, or any other means. Some examples
- include, but are not limited to, computers, personal electronic devices, thin clients, and multi-functional
- devices.
-
-
hourglass model:
-
-
An architectural model for layered systemsโand specifically for the protocol layers in a protocol stackโin which a diversity of supporting protocols and services at
- the lower layers are able to support a great diversity of protocols and applications at the higher layers
- through the use of a single protocol in the spanning
- layer in the middleโthe โneckโ of the hourglass.
A single attributeโtypically a character stringโthat
- uniquely identifies an entity within a specific context
- (which may be a global context). Examples include the name of a party the URL of an organization, or a serial number for a man-made thing.
A category that conveys the degree of confidence that a personโs claimed identity is their real identity, for example as defined in NIST SP 800-63-3 in
- terms of three levels: IAL 1 (Some confidence), IAL 2 (High confidence), IAL 3 (Very high confidence).
A physical or digital document containing identity
- data. A credential is a specialized form of
- identity document. Birth certificates, bank statements, and utility bills can all be considered identity
- documents.
An identity provider (abbreviated IdP or IDP) is a system entity that creates, maintains, and manages identity information for principals and also provides authentication services to relying applications within a federation or distributed network.
In the context of cybersecurity, impersonation is when an attacker pretends to be another person in order to
- commit fraud or some other digital crime.
-
-
integrity (of a data structure):
-
-
In IT security, data integrity means maintaining and assuring the accuracy and completeness of data over its entire lifecycle. This means that data cannot be modified in an unauthorized or undetected manner.
The Internet Protocol (IP) is the network layer communications protocol in the Internet protocol suite (also known as the TCP/IP suite) for relaying datagrams across network boundaries. Its routing function enables internetworking, and essentially establishes the Internet.
- IP has the task of delivering packets from the source host
- to the destination host solely based on the IP
- addresses in the packet headers. For this purpose, IP defines packet structures that encapsulate the data to be delivered. It also defines
- addressing methods that are used to label the datagram with source and destination information.
-
-
Internet protocol suite:
-
-
The Internet protocol suite, commonly known as TCP/IP, is a
- framework for organizing the set of communication
- protocols used in the Internet and similar computer networks according to functional criteria. The
- foundational protocols in the suite are the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP), and the Internet Protocol (IP).
The composition of: a) a legal system (legislation,
- enforcement thereof, and conflict resolution), b) a party
- that governs that legal system, c) a scope within
- which that legal system is operational, and d) one or
- more objectives for the purpose of which the legal system is operated.
A process that results in the sharing of a key between two or more entities, either by transporting a key
- from one entity to another (key transport) or generating a key from information shared by the entities (key
- agreement).
-
-
key event:
-
-
An event in the history of the usage of a cryptographic key pair. There are multiple types of key events. The
- inception event is when the key pair is first generated. A rotation event is when the key pair is changed to a
- new key pair. In some key management systems
- (such as KERI), key events are tracked in a key event log.
A decentralized permissionless key management
- architecture.
-
-
key management system:
-
-
A system for the management of cryptographic
- keys and their metadata (e.g., generation,
- distribution, storage, backup, archive, recovery, use, revocation, and destruction). An automated key management system may be used to
- oversee, automate, and secure the key management process. A key management is often protected by implementing
- it within the trusted execution
- environment (TEE) of a device. An example is the Secure Enclave on Apple iOS devices.
-
-
keys-at-the-edge:
-
-
A key management architecture in which keys are stored on a userโs local edge devices, such as a
- smartphone, tablet, or laptop, and then used in conjunction with a secure protocol to unlock a key management system (KMS) and/or a digital vault in the cloud. This approach can enable
- the storage and sharing of large data structures that are not
- feasible on edge devices. This architecture can also be used in conjunction with confidential computing to enable cloud-based digital agents to safely carry out โuser not presentโ
- operations.
The (intangible) sum of what is known by a specific party, as well as the familiarity,
- awareness or understanding of someone or something by that party.
-
-
Laws of Identity:
-
-
A set of seven โlawsโ written by Kim Cameron, former Chief Identity Architect of Microsoft (1941-2021), to
- describe the dynamics that cause digital identity systems to succeed or fail in various contexts. His goal was
- to define the requirements for a unifying identity metasystem that can offer the Internet the identity layer
- it needs.
An entity that is not a natural person but is recognized as having legal rights and
- responsibilities. Examples include corporations, partnerships, sole proprietorships, non-profit organizations, associations, and governments. (In some
- cases even natural systems such as rivers are treated as legal entities.)
-
-
Legal Entity Identifier:
-
-
The Legal Entity Identifier (LEI) is a unique global identifier for legal
- entities participating in financial transactions. Also known as an LEI code or LEI number, its purpose
- is to help identify legal entities on a globally
- accessible database. Legal entities are organisations
- such as companies or government entities that participate in financial transactions.
In law, a legal person is any person or โthingโ that can do the things a human person is usually able to do
- in law โ such as enter into contracts, sue and be sued, own property, and so on.[3][4][5] The reason for the
- term โlegal personโ is that some legal persons are not people: companies and corporations are โpersonsโ
- legally speaking (they can legally do most of the things an ordinary person can do), but they are not people
- in a literal sense (human beings).
-
-
legal system:
-
-
A system in which policies and rules are defined, and mechanisms for their enforcement and conflict resolution are
- (implicitly or explicitly) specified. Legal systems are not just defined by governments; they can also be
- defined by a governance framework.
Any technique used to detect a presentation
- attack by determining whether the source of a biometric sample is a live human being or a fake
- representation. This is typically accomplished using algorithms that analyze biometric sensor data to detect
- whether the source is live or reproduced.
Information written in a computer language or expression language so that it can be read and processed by a computing
- device.
-
-
man-made thing:
-
-
Athing generated by human activity of some kind. Man-made
- things include both active things, such as cars or drones, and passive things, such as chairs or trousers.
Information describing the characteristics of data including,
- for example, structural metadata describing data structures (e.g., data format, syntax, and semantics) and
- descriptive metadata describing data contents (e.g., information security labels).
-
-
message:
-
-
A discrete unit of communication intended by the
- source for consumption by some recipient or group of recipients.
-
-
mobile deep link:
-
-
In the context of mobile apps, deep linking consists
- of using a uniform resource identifier (URI) that links to a specific location within a mobile app rather than
- simply launching the app. Deferred deep linking allows users to deep link to content even if the app is not
- already installed. Depending on the mobile device platform, the URI required to trigger the app may be
- different.
In computer networking, multicast is group communication where data
- transmission is addressed (using a multicast
- address) to a group of destination computers simultaneously. Multicast can be one-to-many or
- many-to-many distribution. Multicast should not be confused with physical layer point-to-multipoint
- communication.
-
-
multicast address:
-
-
A multicast address is a logical identifier for a group
- of hosts in a computer network that are available to process
- datagrams or frames intended to be multicast for a designated network service.
-
-
multi-party computation:
-
-
Secure multi-party computation (also known as secure computation, multi-party computation (MPC) or
- privacy-preserving computation) is a subfield of cryptography with the goal of creating methods for parties to jointly compute a function over their inputs
- while keeping those inputs private. Unlike traditional cryptographic tasks, where cryptography assures
- security and integrity of communication or storage and the adversary is outside the system of
- participants (an eavesdropper on the sender and receiver), the cryptography in this model protects
- participantsโ privacy from each other.
-
-
multi-party control:
-
-
A variant of multi-party computation where
- multiple parties must act in concert to meet a control requirement without revealing each otherโs data. All
- parties are privy to the output of the control, but no party learns anything about the others.
-
-
multi-signature:
-
-
A cryptographic signature scheme where the process of
- signing information (e.g., a transaction) is distributed among multiple private keys.
-
-
natural person:
-
-
A person (in legal meaning, i.e., one who has its own legal personality) that is an individual human being,
- distinguished from the broader category of a legal
- person, which may be a private (i.e., business entity or non-governmental organization) or public (i.e., government) organization.
-
-
natural thing:
-
-
A thing that exists in the natural world independently of
- humans. Although natural things may form part of a man-made thing, natural things
- are mutually exclusive with man-made things.
-
-
network address:
-
-
A network address is an identifier for a node or host on
- a telecommunications network. Network addresses are designed to be unique identifiers across the network, although some networks allow for local, private
- addresses, or locally administered addresses that may not be unique. Special network addresses are allocated
- as broadcast or multicast addresses. A network address designed to address a single device is
- called a unicast address.
-
-
node:
-
-
In telecommunications networks, a node (Latin: nodus, โknotโ) is either a redistribution point or a communication endpoint. The definition of a
- node depends on the network and protocol layer
- referred to. A physical network node is an electronic device that is attached to a network, and is capable of
- creating, receiving, or transmitting information over a communication channel.
In the context of privacy protection, this term denotes the context in which privacy trade-off decisions are
- made. It includes the regulatory environment and other non-technical factors that bear on what reasonable
- privacy expectations might be.
A party that consists of a group of parties who agree to be organized into a specific form in
- order to better achieve a common set of objectives.
- Examples include corporations, partnerships, sole proprietorships, non-profit organizations, associations, and
- governments.
A process by which two or more entities exchange VIDs in order to form a cryptographically verifiable
- connection (e.g., a ToIP connection), such as by scanning a QR code (in person or remotely) or clicking a deep
- link.
-
-
out-of-band
- introduction
-
-
A process by which two or more entities exchange VIDs in order to form a cryptographically verifiable
- connection (e.g., a ToIP connection), such as by scanning a QR code (in person or remotely) or clicking a deep
- link.
-
-
owner (of an entity):
-
-
The role that a party performs when it is exercising its legal, rightful or natural title to control
- a specific entity.
A string of characters (letters, numbers and other symbols) that are used to authenticate an identity, verify
- access authorization or derive cryptographic keys.
-
-
peer:
-
-
In the context of digital networks, an actor on the network
- that has the same status, privileges, and communications options as the other actors on the network.
-
-
peer-to-peer:
-
-
Peer-to-peer (P2P) computing or networking is a distributed application architecture that partitions tasks or
- workloads between peers. Peers are equally privileged, equipotent participants in the network. This forms a
- peer-to-peer network of nodes.
Information (any form of data) that can be used to directly
- or indirectly identify or re-identify an individual person
- either singly or in combination within a single record or in
- correlation with other records. This information can be one
- or more attributes/fields/properties in a record (e.g.,
- date-of-birth) or one or more records (e.g., medical
- records).
-
-
physical credential:
-
-
A credential in a physical form such as paper, plastic,
- or metal.
A statement or legal document (in privacy law) that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or
- clientโs data.
Proof of personhood (PoP) is a means of resisting malicious attacks on peer-to-peer networks, particularly, attacks that utilize multiple fake identities, otherwise known as a Sybil attack. Decentralized online platforms are
- particularly vulnerable to such attacks by their very nature, as notionally democratic and responsive to large
- voting blocks. In PoP, each unique human participant obtains one equal unit of voting power, and any
- associated rewards.
In the context of digital communication, an attribute of
- a digital object or data structure, such as a DID document or a schema.
-
-
protected data:
-
-
Data that is not publicly available but requires some type of
- access control to gain access.
-
-
protocol layer:
-
-
In modern protocol design, protocols are layered to form a protocol stack. Layering is a design principle that divides the protocol
- design task into smaller steps, each of which accomplishes a specific part, interacting with the other parts
- of the protocol only in a small number of well-defined ways. Layering allows the parts of a protocol to be
- designed and tested without a combinatorial explosion of cases, keeping each design relatively simple.
-
-
protocol stack:
-
-
The protocol stack or network stack is an implementation of a computer networking protocol suite or protocol
- family. Some of these terms are used interchangeably but strictly speaking, the suite is the
- definition of the communication protocols, and the stack is the software implementation of them.
-
-
pseudonym:
-
-
A pseudonym is a fictitious name that a person assumes for
- a particular purpose, which differs from their original or true name (orthonym). This also differs from a new
- name that entirely or legally replaces an individualโs own. Many pseudonym holders use pseudonyms because they wish to remain anonymous, but anonymity is difficult to achieve and often fraught with legal
- issues.
Public key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of
- related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are
- generated with cryptographic algorithms based on mathematical problems termed one-way functions. Security of
- public key cryptography depends on keeping the private
- key secret; the public key can be openly
- distributed without compromising security.
A QR code (short for โquick-response codeโ) is a type of two-dimensional matrix barcodeโa machine-readable optical image that contains
- information specific to the identified item. In practice, QR codes contain data for a locator, an identifier,
- and web tracking.
A term used to describe the opposite of digital identity, i.e., an identity (typically for a person) in the
- physical instead of the digital world.
-
-
recommended:
-
-
A requirement that is not mandatory to implement in order for an implementer to be in compliance, but which should be implemented unless the
- implementer has a good reason. In ToIP
- governance frameworks, a recommendation is expressed using a SHOULD or RECOMMENDED keyword as defined in
- IETF RFC 2119.
-
-
record:
-
-
A uniquely identifiable entry or listing in a database or registry.
The reputation or prestige of a social entity (a person, a
- social group, an organization, or a place) is an
- opinion about that entity โ typically developed as a result of social evaluation on a set of criteria, such as
- behavior or performance.
Reputation systems are programs or algorithms that allow users to rate each other in online communities in
- order to build trust through reputation. Some common uses of these systems can be found on e-commerce
- websites such as eBay, Amazon.com, and Etsy
- as well as online advice communities such as Stack Exchange.
In the context of digital credentials,
- revocation is an event signifying that the issuer no longer
- attests to the validity of a credential they have issued.
- In the context of cryptographic keys, revocation is an event signifying that the controller no longer attests to the validity of a public/private key pair for which the controller is authoritative.
-
-
risk:
-
-
The effects that uncertainty (i.e. a lack of information, understanding or knowledge of events, their consequences or likelihoods) can have on the intended
- realization of an objectiveof a party.
-
-
risk assessment:
-
-
The process of identifying risks to organizational
- operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the overall ecosystem, resulting from the operation of an information
- system. Risk assessment is part of risk management,
- incorporates threat and vulnerability analyses, and considers risk mitigations provided by security controls planned or in place.
The process of managing risks to organizational operations
- (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the
- operation of an information system, and includes: (i) the conduct of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures
- for the continuous monitoring of the security state of the information system.
-
-
risk mitigation:
-
-
Prioritizing, evaluating, and implementing the appropriate risk-reducing controls/countermeasures recommended from the risk management process.
-
-
role:
-
-
A defined set of characteristics that an entity has in some
- context, such as responsibilities it may have, actions
- (behaviors) it may execute, or pieces of knowledge that
- it is expected to have in that context, which are referenced by a specific role name.
-
-
role-based access control:
-
-
Access control based on user roles (i.e., a collection of access authorizations a user receives based on an explicit or implicit assumption
- of a given role). Rolepermissions may be
- inherited through a role hierarchy and typically reflect the
- permissions needed to perform defined functions within
- an organization. A given role may apply to a single individual or to several individuals.
A router is a networking device that forwards data
- packets between computer networks. Routers perform the traffic directing functions between networks and
- on the global Internet. Data sent through a network, such as a web page or email, is in the form of data packets. A packet is typically forwarded from one
- router to another router through the networks that constitute an internetwork (e.g. the Internet) until it
- reaches its destination node. This process is called routing.
-
-
routing:
-
-
Routing is the process of selecting a path for traffic in a network or between or across multiple networks.
- Broadly, routing is performed in many types of networks, including circuit-switched networks, such as the
- public switched telephone network (PSTN), and computer networks, such as the Internet. A router is a computing device that specializes in performing
- routing.
A framework, pattern, or set of rules for enforcing a
- specific structure on a digital object or a set of digital data. There are many types of schemas, e.g., data schema, credential verification
- schema, database schema.
-
-
scope:
-
-
In the context of terminology, scope refers to the set
- of possible concepts within which: a) a specific term is intended to uniquely identify a concept, or b) a specific glossary is intended to identify a set of concepts. In the context of identification, scope refers to the set of possible entities within which a
- specific entity must be uniquely identified. In the context of specifications, scope refers to the set of problems (the problem space)
- within which the specification is intended to specify solutions.
The original transport layer security protocol developed by Netscape and partners. Now deprecated in favor of
- Transport Layer Security (TLS).
-
-
security domain:
-
-
An environment or context that includes a set of system resources and a set of system entities that have the
- right to access the resources as defined by a common security policy, security model, or security architecture.
-
-
security policy:
-
-
A set of policies and rules that governs all aspects of security-relevant system and system element
- behavior.
A subclass of verifiable identifier that is cryptographically verifiable without the need to rely on any
- third party for verification because the identifier is cryptographically bound to the cryptographic keys
- from which it was generated.
- ~ Also known as: autonomous identifier.
-
-
self-certifying
- identifier
-
-
A subclass of verifiable identifier that is cryptographically verifiable without the need to rely on any
- third party for verification because the identifier is cryptographically bound to the cryptographic keys
- from which it was generated.
- ~ Also known as: autonomous identifier.
Personal data that a reasonable person would view from a privacy protection standpoint as
- requiring special care above and beyond other personal
- data.
An approach to complex organizational work design that recognizes the interaction between people and
- technology in workplaces. The term also refers to coherent systems of human relations, technical objects, and
- cybernetic processes that inhere to large, complex infrastructures. Social society, and its constituent
- substructures, qualify as complex sociotechnical systems.
-
-
software agent:
-
-
In computer science, a software agent is a computer program that acts for a user or other program in a
- relationship of agency, which derives from the Latin agere
- (to do): an agreement to act on oneโs behalf. A user
- agent is a specific type of software agent that is used directly by an end-user as the principal.
-
-
Sovrin Foundation:
-
-
A 501 ยฉ(4) nonprofit organization established to administer the governance framework governing the Sovrin Network, a public service
- utility enabling self-sovereign identity on
- the internet. The Sovrin Foundation is an independent organization that is responsible for ensuring the Sovrin identity system is public and globally accessible.
-
-
spanning layer:
-
-
A specific layer within a protocol stack that
- consists of a single protocol explicitly designed to provide interoperability between the protocols layers above it and below it.
In the context of digital communications, and in
- particular streaming media, a flow of data delivered in a continuous manner from a server to a client
- rather than in discrete messages.
-
-
streaming media:
-
-
Streaming media is multimedia for playback using an offline or online media player. Technically, the stream
- is delivered and consumed in a continuous manner from a client, with little or no intermediate storage in
- network elements. Streaming refers to the delivery method of content, rather than the content itself.
In the context of decentralized digital trust infrastructure, a subscription is an agreement between a first
- digital agentโthe publisherโto automatically send a
- second digital agentโthe subscriberโa message when a specific type of event happens in the wallet or vault managed by the first digital agent.
A Sybil attack is a type of attack on a computer network service in which an attacker subverts the serviceโs
- reputation system by creating a large number of
- pseudonymousidentities and uses them to gain a disproportionately large influence. It is
- named after the subject of the book Sybil, a case study of a woman diagnosed with dissociative
- identity disorder.
-
-
system of record:
-
-
A system of record (SOR) or source system of record (SSoR) is a data management term for an information
- storage system (commonly implemented on a computer system running a database management system) that is the authoritative data source for a given data
- element or piece of information.
-
-
tamper resistant:
-
-
A process which makes alterations to the data difficult (hard
- to perform), costly (expensive to perform), or both.
A requirement for a hardware or software component or
- system. In the context of decentralized digital trust infrastructure, technical requirements are a subset of
- governance requirements. Technical
- requirements are often specified in a technical
- specification.
-
-
technical specification:
-
-
A document that specifies, in a complete, precise, verifiable manner, the requirements, design, behavior, or other characteristics of a system or
- component and often the procedures for determining whether these provisions have been satisfied.
-
-
technical trust:
-
-
A level of assurance in a trust relationship that can be achieved only via
- technical means such as hardware, software, network protocols, and cryptography. Cryptographic trust is a specialized type of
- technical trust.
A unit of text (i.e., a word or phrase) that is used in a particular context or scope to refer to a concept (or a relation between concepts, or a property of a
- concept).
-
-
terminology:
-
-
Terminology is a group of specialized words and respective meanings in a particular field, and also the study
- of such terms and their use; the latter meaning is also known
- as terminology science. A term is a word, compound word, or multi-word expressions that in specific contexts
- is given specific meaningsโthese may deviate from the meanings the same words have in other contexts and in
- everyday language.[2] Terminology is a discipline
- that studies, among other things, the development of such terms and their interrelationships within a specialized domain. Terminology differs
- from lexicography, as it involves the study of concepts,
- conceptual systems and their labels (terms), whereas lexicography studies words and their meanings.
A wiki website used by a terms community to input,
- maintain, and publish its terminology. The ToIP
- Foundation Concepts and Terminology Working Group has established a simple template for GitHub-based terms
- wikis.
A party that is not directly involved in the trust
- relationship between a first party and a second party, but provides supporting services to
- either or both of them.
A token or packet of information that is used to provide assurance of timeliness; the timestamp contains
- timestamped data, including a time, and a signature generated by a trusted timestamp authority (TTA).
A non-profit project of the Linux Foundation chartered to define an overall architecture for
- decentralized digital trust infrastructure known as the ToIP
- stack.
A specification published by the ToIP Foundation.
- Specifications may be in one of three states: Draft Deliverable, Working Group Approved Deliverable, or ToIP
- Approved Deliverables
The ToIP Layer 2 protocol for verifiable
- messaging that implements the trust spanning
- layer of the ToIP stack. The ToIP Trust
- Spanning Protocol enables actors in different digital trust domains to interact in a similar way to how the
- Internet Protocol (IP) enables devices on different local area networks to exchange data.
-
-
transaction:
-
-
A discrete event between a user and a system that supports a business or programmatic purpose. A digital
- system may have multiple categories or types of transactions, which may require separate analysis within the
- overall digital identity risk assessment.
The Transmission Control Protocol (TCP) is one of the main protocols of the Internet protocol suite. It originated in the initial network
- implementation in which it complemented the Internet
- Protocol (IP). Therefore, the entire suite is commonly referred to as TCP/IP. TCP provides reliable, ordered, and error-checked delivery of a stream of
- octets (bytes) between applications running on hosts communicating via an IP network. Major internet
- applications such as the World Wide Web, email, remote administration, and file transfer rely on TCP, which is
- part of the Transport Layer of the TCP/IP suite. SSL/TLS
- often runs on top of TCP.
-
-
Transport Layer Security:
-
-
Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. The protocol is widely used
- in applications such as email, instant messaging, and Voice over IP, but its use in securing HTTPS remains the most publicly
- visible. The TLS protocol aims primarily to provide security, including privacy (confidentiality), integrity, and authenticity through the use of cryptography, such as the use of certificates, between two or more communicating
- computer applications.
-
-
tribal knowledge:
-
-
Knowledge that is known within an โin-groupโ of people
- but unknown outside of it. A tribe, in this sense, is a group of people that share such a
- common knowledge.
-
-
trust:
-
-
A belief that an entity will behave in a predictable manner
- in specified circumstances. The entity may be a person, process, object or any combination of such components.
- The entity can be of any size from a single hardware component or software module, to a piece of equipment
- identified by make and model, to a site or location, to an organization, to a nation-state. Trust, while
- inherently a subjective determination, can be based on objective evidence and subjective elements. The
- objective grounds for trust can include for example, the results of information technology product testing and
- evaluation. Subjective belief, level of comfort, and experience may supplement (or even replace) objective
- evidence, or substitute for such evidence when it is unavailable. Trust is usually relative to a specific
- circumstance or situation (e.g., the amount of money involved in a transaction, the sensitivity or criticality
- of information, or whether safety is an issue with human lives at stake). Trust is generally not transitive
- (e.g., you trust a friend but not necessarily a friend of a friend). Finally, trust is generally earned, based
- on experience or measurement.
The context in which a specific party makes a specific trust decision. Many different factors may be
- involved in establishing a trust context, such as: the relevant interaction or transaction; the presence or
- absence of existing trust relationships; the
- applicability of one or more governance
- frameworks; and the location, time, network, and/or devices involved. A trust context may be implicit or
- explicit; if explicit, it may be identified using an identifier. A ToIP governance framework an example of an explicit trust context
- identified by a ToIP identifier.
-
-
trust decision:
-
-
A decision that a party needs to make about whether to
- engage in a specific interaction or transaction with
- another entity that involves real or perceived risks.
A term coined by John Jordan to describe the decentralized digital trust infrastructure made possible by the
- ToIP stack. A play on the term Voice over IP
- (abbreviated VoIP).
In the context of specific digital trust
- ecosystems, such as the European Unionโs eIDAS regulations, a trust service provider (TSP) is a legal
- entity that provides specific trust support services
- as required by legal regulations, trust
- frameworks, or governance frameworks.
- In the larger context of ToIP infrastructure, a TSP is a
- provider of services based on the ToIP stack. Most
- generally, a TSP is to the trust layer for the Internet what an Internet service provider (ISP) is to the
- Internet layer.
A trusted execution environment (TEE) is a secure area of a main processor. It helps code and data loaded
- inside it to be protected with respect to confidentiality and integrity. Data integrity
- prevents unauthorizedentities from outside the TEE from altering data, while code integrity prevents code in the TEE from being replaced or modified by
- unauthorizedentities, which may also be the computer owner itself as in certain DRM
- schemes.
In cryptography, a trusted third party (TTP) is an entity which facilitates interactions between two parties who both trust the third party; the third party
- reviews all critical transaction communications between the parties, based on the ease of creating fraudulent
- digital content. In TTP models, the relying parties
- use this trust to secure their own interactions. TTPs are common in any number of commercial transactions and
- in cryptographic digital transactions as well as cryptographic protocols, for example, a certificate authority (CA) would issue a digital certificate to one of the two parties in
- the next example. The CA then becomes the TTP to that certificateโs issuance. Likewise transactions that need
- a third party recordation would also need a third-party repository service of some kind.
-
-
trusted timestamp authority:
-
-
An authority that is trusted to provide accurate time
- information in the form of a timestamp.
An attribute of a person or organization that
- provides confidence to others of the qualifications, capabilities, and reliability of that entity to perform specific tasks and fulfill assigned
- responsibilities. Trustworthiness is also a characteristic of information technology products and systems. The
- attribute of trustworthiness, whether applied to people, processes, or technologies, can be measured, at least
- in relative terms if not quantitatively. The determination of trustworthiness plays a key role in establishing
- trust relationships among persons and organizations. The trust relationships are key factors in risk decisions made by senior leaders/executives.
A software agent that is used directly by the
- end-user as the principal. Browsers, email clients, and
- digital wallets are all examples of user agents.
-
Voice over Internet Protocol (VoIP), also called IP telephony, is a method and group of technologies for
- voice calls for the delivery of voice communication
- sessions over Internet Protocol (IP) networks,
- such as the Internet.
The set of software components that form the core of a digital wallet, but which by themselves are not sufficient to deliver a
- fully functional wallet for use by a digital agent
- (of a principal). A wallet engine is to a digital wallet what a browser engine
- is to a web browser.
A specific kind of cryptographic proof that proves facts
- about data to a verifier without revealing the underlying data itself. A common example is proving that a person is over or under a specific age
- without revealing the personโs exact birthdate.
-
-
zero-knowledge service:
-
-
In cloud computing, the term โzero-knowledgeโ refers to an online service that stores, transfers or
- manipulates data in a way that maintains a high level of confidentiality, where the data is only accessible
- to the data'sowner (the client), and not to the service provider. This is achieved by encrypting the raw data at the clientโs side or end-to-end (in case there is more than one client),
- without disclosing the password to the service provider. This means that neither the service provider, nor any
- third party that might intercept the data, can decrypt and access the data without
- prior permission, allowing the client a higher degree of privacy than would otherwise be possible. In
- addition, zero-knowledge services often strive to hold as little metadata as possible, holding only that data that is functionally needed by the service.
A network security architecture based on the core design principle โnever trust, always verifyโ, so that all
- actors are denied access to resources pending verification.
An adjective describing when the identity of a natural person or other actor is unknown.
-
-
assurance level
-
-
A level of confidence that may be relied on by others. Different types of assurance levels are defined for
- different types of trust assurance mechanisms. Examples include authenticator assurance level, federation
- assurance level, and identity assurance level.
-
-
authorization
-
-
The process of verifying that a requested action or service is approved for a specific entity.
-
-
out-of-band introduction
-
-
-
A process by which two or more entities exchange VIDs in order to form a cryptographically verifiable
- connection (e.g., a ToIP connection), such as by scanning a QR code (in person or remotely) or clicking a deep
- link.
-
-
out-of-band
- introduction
-
-
A process by which two or more entities exchange VIDs in order to form a cryptographically verifiable
- connection (e.g., a ToIP connection), such as by scanning a QR code (in person or remotely) or clicking a deep
- link.
-
-
permission
-
-
Authorization to perform some action on a system.
-
-
policy
-
-
Statements, rules or assertions that specify the correct or expected behavior of an entity.
-
-
real world identity
-
-
A term used to describe the opposite of digital identity, i.e., an identity (typically for a person) in the
- physical instead of the digital world.
-
-
self-certifying
- identifier
-
-
A subclass of verifiable identifier that is cryptographically verifiable without the need to rely on any
- third party for verification because the identifier is cryptographically bound to the cryptographic keys
- from which it was generated.
- ~ Also known as: autonomous identifier.
-
-
self-certifying
- identifier
-
-
A subclass of verifiable identifier that is cryptographically verifiable without the need to rely on any
- third party for verification because the identifier is cryptographically bound to the cryptographic keys
- from which it was generated.
- ~ Also known as: autonomous identifier.
Something that is actually done (a โunit of workโ that is executed) by a single actor (on behalf of a given party),
- as a single operation, in a specific context.Source: eSSIF-Lab.
In the context of decentralized digital trust infrastructure, the empowering of a party to act independently of its own accord, and in particular to empower the party
- to employ an agent to act on the partyโs behalf.
-
-
agent:
-
-
An actor that is executing an action on behalf of a party (called
- the principal of that actor). In the context of decentralized digital trust infrastructure, the term
- โagentโ is most frequently used to mean a digital
- agent.
An adjective describing when the identity of a natural person or other actor is unknown.
-
-
anycast:
-
-
Anycast is a network addressing and routing methodology in which a single IP-address is shared by devices (generally servers) in
- multiple locations. Routers direct packets addressed to
- this destination to the location nearest the sender, using their normal decision-making algorithms, typically
- the lowest number of BGP network hops. Anycast routing is
- widely used by content delivery networks such as web and name servers,
- to bring their content closer to end users.
A level of confidence that may be relied on by others. Different types of assurance levels are defined for
- different types of trust assurance mechanisms. Examples include authenticator assurance level, federation
- assurance level, and identity assurance level.
-
-
appropriate friction:
-
-
A user-experience design principle for information systems (such as digital wallets) specifying that the
- level of attention required of the holder for a particular
- transaction should provide a reasonable opportunity for an informed choice by the holder.
-
-
attestation:
-
-
The issue of a statement, based on a decision, that fulfillment of specified requirements has been demonstrated. In the context of decentralized digital
- trust infrastructure, an attestation usually has a digital signature so that it is cryptographically verifiable.
-
-
attribute:
-
-
An identifiable set of data that describes an entity, which
- is the subject of the attribute.
-
-
attribute-based access control:
-
-
An access control approach in which access is
- mediated based on attributes associated with subjects (requesters) and the objects to be accessed. Each
- object and subject has a set of associated attributes, such as location, time of creation, access
- rights, etc. Access to an object is authorized or denied
- depending upon whether the required (e.g., policy-defined) correlation can be made between the attributes of that object and of the requesting subject.
-
-
audit (of system controls):
-
-
Independent review and examination of records and activities to assess the adequacy of system controls, to
- ensure compliance with established policies and
- operational procedures.
-
-
audit log:
-
-
An audit log is a security-relevant chronological record,
- set of records, and/or destination and source of records that provide documentary evidence of the sequence of
- activities that have affected at any time a specific operation, procedure, event, or device.
-
-
auditor (of an entity):
-
-
The party responsible for performing an audit. Typically an auditor must be accredited.
-
-
authentication(of a user; process; or
- device):
-
-
Verifying the identity of a user, process, or device,
- often as a prerequisite to allowing access to resources in an information system.
-
-
authentication(of a user; process; or
- device):
-
-
Verifying the identity of a user, process, or device,
- often as a prerequisite to allowing access to resources in an information system.
-
-
authenticator
-
-
Something the claimant possesses and controls (typically a cryptographic module or password) that is used to
- authenticate the claimantโs identity.
-
-
authenticator assurance
- level
-
-
A measure of the strength of an authentication
- mechanism and, therefore, the confidence in it.
-
-
authenticator assurance
- level
-
-
A measure of the strength of an authentication
- mechanism and, therefore, the confidence in it.
The property of being genuine and being able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator.
-
-
authorization
-
-
The process of verifying that a requested action or service is approved for a specific entity.
-
-
authorized organizational
- representative
-
-
A person who has the authority to make claims, sign documents or otherwise commit resources on
- behalf of an organization.
A measurable physical characteristic or personal behavioral trait used to recognize the AID, or verify the claimedidentity, of an
- applicant. Facial images, fingerprints, and iris scan samples are all examples of biometrics.
-
-
blockchain:
-
-
A distributed digital ledger of
- cryptographically-signed transactions that are grouped into blocks. Each block is cryptographically linked to
- the previous one (making it tamper evident) after validation and undergoing a consensus decision. As new blocks are added, older
- blocks become more difficult to modify (creating tamper resistance). New blocks are replicated across copies of the ledger
- within the network, and any conflicts are resolved automatically using established rules.
-
-
broadcast:
-
-
In computer networking, telecommunication and information theory, broadcasting is a method of transferring a
- message to all recipients simultaneously. Broadcast
- delivers a message to all nodes in the network using a
- one-to-all association; a single datagram (or packet) from one sender is routed to all of the possibly
- multiple endpoints associated with the broadcast
- address. The network automatically replicates datagrams as needed to reach all the recipients within the scope of the
- broadcast, which is generally an entire network subnet.
-
-
broadcast address:
-
-
A broadcast address is a network address used to
- transmit to all devices connected to a multiple-access communications network. A message sent to a broadcast address may be received by all network-attached hosts. In contrast, a multicast address is used to address a specific group of devices, and a
- unicast address is used to address a single device.
- For network layer communications, a broadcast address may be a specific IP address.
A comprehensive assessment of the management, operational, and technical security controls in an information
- system, made in support of security accreditation, to
- determine the extent to which the controls are implemented correctly, operating as intended, and producing the
- desired outcome with respect to meeting the security requirements for the system.
An assertion about a subject, typically expressed as an attribute or property of the subject. It is
- called a โclaimโ because the assertion is always made by some party, called the issuer of the
- claim, and the validity of the claim must be judged by the
- verifier.
-
-
Coalition for Content Provenance and
- Authenticity:
-
-
C2PA is a Joint Development Foundation project of the Linux Foundation that addresses the prevalence of
- misleading information online through the development of technical standards for certifying the source and
- history (or provenance) of media content.
-
-
communication:
-
-
The transmission of information.
-
-
communication endpoint:
-
-
A type of communication network node. It is an interface exposed by a communicating party or by a communication channel. An example of the
- latter type of a communication endpoint is a publish-subscribe topic or a group in group communication
- systems.
-
-
communication channel:
-
-
A communication channel refers either to a physical transmission medium such as a wire, or to a logical connection over a multiplexed medium such as a radio
- channel in telecommunications and computer networking. A channel is used for information transfer of, for
- example, a digital bit stream, from one or several senders to one or several receivers.
-
-
communication metadata:
-
-
Metadata that describes the sender, receiver, routing, handling, or contents of a communication. Communication metadata is often
- observable even if the contents of the communication
- are encrypted.
-
-
communication session:
-
-
A finite period for which a communication
- channel is instantiated and maintained, during which certain properties of that channel, such as authentication of the participants, are in
- effect. A session has a beginning, called the session initiation, and an ending, called the session
- termination.
-
-
complex password:
-
-
A password that meets certain security requirements, such
- as minimum length, inclusion of different character types, non-repetition of characters, and so on.
-
-
compliance:
-
-
In the context of decentralized digital trust infrastructure, the extent to which a system, actor, or party conforms to the requirements of a governance framework or trust framework that pertains to that particular entity.
-
-
concept:
-
-
An abstract idea that enables the classification of entities, i.e., a mental construct that enables an instance of a class of entities to be distinguished from entities that are not an instance of that class. A concept can be identified with a term.
-
-
confidential computing:
-
-
Hardware-enabled features that isolate and process encrypteddata in memory so that
- the data is at less risk of exposure and compromise from
- concurrent workloads or the underlying system and platform.
The Content Authenticity Initiative (CAI) is an association founded in November 2019 by Adobe, the New York
- Times and Twitter. The CAI promotes an industry
- standard for provenance metadata defined by the C2PA. The CAI cites curbing disinformation as one motivation
- for its activities.
A system, process or set of policies under which a person
- agrees to share personal data for specific usages. A
- consent management system will typically create a record of
- such consent.
In a communications context, a type of privacy
- protection in which messages use encryption, hashes, or other
- privacy-preserving technologies to avoid the use of identifiers or other content that unauthorizedparties may
- use to correlate the sender and/or receiver(s).
-
-
counterparty:
-
-
From the perspective of one party, the other party in a transaction, such as a financial transaction.
-
-
credential:
-
-
A container of claims describing one or more subjects. A credential is generated by the issuer of the credential and given to the holder of the credential. A credential typically includes a
- signature or some other means of proving its authenticity. A credential may be either a physical credential or a digital credential.
In the context of terminology, a written description
- of a concept that anyone can evaluate to determine whether
- or not an entity is an instance or example of that concept. Evaluation leads to a yes/no result.
-
-
cryptographic binding:
-
-
Associating two or more related elements of information using cryptographic techniques.
-
-
cryptographic key:
-
-
A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a
- file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Symmetric cryptography refers to the practice of the same
- key being used for both encryption and decryption.
- Asymmetric cryptography has separate keys for encrypting and decrypting. These keys are known as the public keys and private
- keys, respectively.
-
-
cryptographic trust:
-
-
A specialized type of technical trust that is
- achieved using cryptographic algorithms.
The informal terms or formal legal agreement under which a custodian agrees to provide service to a principal.
-
-
dark pattern:
-
-
A design pattern, mainly in user interfaces, that has the effect of deceiving individuals into making choices
- that are advantageous to the designer.
-
-
data:
-
-
In the pursuit of knowledge, data is a collection of
- discrete values that convey information, describing quantity, quality, fact, statistics, other basic units of
- meaning, or simply sequences of symbols that may be further interpreted. A datum is an individual value in a
- collection of data.
In telecommunications and computer networking, a network packet is a formatted unit of data carried by a packet-switched network such as the Internet.
- A packet consists of control information and user data; the
- latter is also known as the payload. Control information provides data for delivering the payload (e.g.,
- source and destination network addresses, error detection codes, or sequencing information). Typically,
- control information is found in packet headers and trailers.
-
-
data schema:
-
-
A description of the structure of a digital document or object, typically expressed in a machine-readable language in terms of constraints
- on the structure and content of documents or objects of that type. A credential schema is a particular type of
- data schema.
A decentralized personal and application data storage and message relay node, as defined in the DIF
- Decentralized Web Node specification. Users may have multiple nodes that replicate their data between them.
-
In the context of the World Wide Web, deep linking is the use of a hyperlink that links to a specific,
- generally searchable or indexed, piece of web content on a website (e.g. โhttps://example.com/path/pageโ),
- rather than the websiteโs home page (e.g., โhttps://example.comโ). The URL contains all the information needed
- to point to a particular item. Deep linking is different from mobile deep linking, which refers to directly linking to in-app content
- using a non-HTTP URI.
-
-
definition:
-
-
A textual statement defining the meaning of a term by
- specifying criterion that enable the concept identified by the term to be distinguished from all other concepts within the intended scope.
The controller of a device capable of digital communications, e.g., a smartphone, tablet, laptop,
- IoT device, etc.
-
-
dictionary:
-
-
A dictionary is a listing of lexemes (words or terms) from
- the lexicon of one or more specific languages, often arranged alphabetically, which may include information on
- definitions, usage, etymologies, pronunciations,
- translation, etc. It is a lexicographical reference that shows inter-relationships among the data. Unlike a glossary, a dictionary may provide multiple definitions of a term depending
- on its scope or context.
-
-
DID controller:
-
-
An entity that has the capability to make changes to a DID document. A DID might have more than one DID controller. The DID controller(s) can be denoted by
- the optional controller property at the top level of the DID document. Note that a DID controller might be the DID subject.
-
-
DID document:
-
-
A set of data describing the DID subject, including
- mechanisms, such as cryptographic public keys, that the DID
- subject or a DID delegate can use to authenticate itself and prove its association with the DID. A DID document might have one or more different
- representations as defined in section 6 of the W3C Decentralized Identifiers (DIDs) 1.0 specification.
-
-
DID method:
-
-
A definition of how a specific DID method scheme is implemented. A DID method is defined by a DID method
- specification, which specifies the precise operations by which DIDs and DID documents are
- created, resolved, updated, and deactivated.
-
-
DID subject:
-
-
The entity identified by a DID and described by a DID
- document. Anything can be a DID subject: person, group, organization, physical thing, digital thing,
- logical thing, etc.
-
-
DID URL:
-
-
A DID plus any additional syntactic component that conforms to
- the definition in section 3.2 of the W3C Decentralized Identifiers (DIDs) 1.0 specification. This
- includes an optional DID path (with its leading / character), optional DID query (with its leading ?
- character), and optional DID fragment (with its leading # character).
-
-
digital agent:
-
-
In the context of โโdecentralized digital trust infrastructure, an agent (specifically a type of software agent) that operates in conjunction with a digital wallet.
-
-
digital asset:
-
-
A digital asset is anything that exists only in digital form and comes with a distinct usage right. Data that do not possess that right are not considered assets.
-
A digital ecosystem is a distributed, adaptive, open socio-technical system with properties of
- self-organization, scalability and sustainability inspired from natural ecosystems. Digital ecosystem models
- are informed by knowledge of natural ecosystems, especially for aspects related to competition and
- collaboration among diverse entities.
-
-
digital identity:
-
-
An identity expressed in a digital form for the purpose
- representing the identified entity within a computer system
- or digital network.
-
-
digital rights management:
-
-
Digital rights management (DRM) is the management of legal access to digital content. Various tools or
- technological protection measures (TPM) like access
- control technologies, can restrict the use of proprietary hardware and copyrighted works. DRM
- technologies govern the use, modification and distribution of copyrighted works (e.g. software, multimedia
- content) and of systems that enforce these policies within devices.
An information system, network, distributed database, or blockchain designed to provide one or more supporting services to higher level
- components of decentralized digital trust infrastructure. In the ToIP stack, digital trust utilities are at Layer 1. A verifiable data registry is one type of digital trust utility.
-
-
digital signature:
-
-
A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the
- prerequisites are satisfied, gives a recipient very high confidence that the message was created by a known sender (authenticity), and that the
- message was not altered in transit (integrity).
-
-
digital vault:
-
-
A secure container for data whose controller is the principal. A digital vault is most commonly used in conjunction with a digital wallet and a digital agent. A digital vault may be implemented on a local device or in the
- cloud; multiple digital vaults may be used by the same principal across different devices and/or the cloud; if so they may use some type
- of synchronization. If the capability is supported, data may
- flow into or out of the digital vault automatically based on subscriptions approved by the controller.
A distributed ledger (also called a shared ledger or distributed ledger technology or DLT) is the consensus
- of replicated, shared, and synchronized digital data that is
- geographically spread (distributed) across many sites, countries, or institutions. In contrast to a
- centralized database, a distributed ledger does not require a central administrator, and consequently does not
- have a single (central) point-of-failure. In general, a distributed ledger requires a peer-to-peer (P2P) computer network and consensus
- algorithms so that the ledger is reliably replicated across distributed computer nodes (servers, clients, etc.). The most common form of distributed ledger technology
- is the blockchain, which can either be on a public or
- private network.
eIDAS (electronic IDentification, Authentication and trust Services) is an EU regulation with the stated
- purpose of governing โelectronic identification and trust services for electronic transactionsโ. It passed in 2014 and its
- provisions came into effect between 2016-2018.
Cryptographic transformation of data (called plaintext) into a form (called ciphertext) that conceals the dataโs original meaning to prevent it from being known or used. If the
- transformation is reversible, the corresponding reversal process is called decryption, which is a transformation that restores encrypted data to its original state.
The end-to-end principle is a design framework in computer networking. In networks designed according to this
- principle, guaranteeing certain application-specific features, such as reliability and security, requires that
- they reside in the communicating end nodes of the network. Intermediary nodes, such as gateways and routers, that
- exist to establish the network, may implement these to improve efficiency but cannot guarantee end-to-end
- correctness.
A digital identity architecture in which a digital identity established on one computer
- system, network, or trust domain is linked to other
- computer systems, networks, or trust domains for the
- purpose of identifying the same entity across those domains.
-
A category that describes the federation protocol used
- to communicate an assertion containing authentication) and attribute information (if applicable) to a relying party, as defined in NIST SP 800-63-3 in terms of three levels: FAL 1 (Some
- confidence), FAL 2 (High confidence), FAL 3 (Very high confidence).
-
-
fiduciary:
-
-
A fiduciary is a person who holds a legal or ethical relationship of trust with one or more other parties (person or group of persons). Typically, a fiduciary
- prudently takes care of money or other assets for another
- person. One party, for example, a corporate trust company or
- the trust department of a bank, acts in a fiduciary capacity to another party, who, for example, has entrusted funds to the fiduciary for safekeeping or
- investment. In a fiduciary relationship, one person, in a position of vulnerability, justifiably vests
- confidence, good faith, reliance, and trust in another whose aid, advice, or protection is sought in some
- matter.
A set of identity data, such as a credential, that is issued not for the purpose of establishing a foundational identity for the subject, but for the purpose of
- establishing other attributes, qualifications, or capabilities of the subject. Loyalty cards, library cards,
- and employee IDs are all examples of functional identities. Foundational identities are often used to provide identity binding for functional identities.
-
-
gateway:
-
-
A gateway is a piece of networking hardware or software used in telecommunications networks that allows data to flow from one discrete network to another. Gateways are
- distinct from routers or switches in that they communicate
- using more than one protocol to connect multiple networks[1][2] and can
- operate at any of the seven layers of the open systems interconnection model (OSI).
The General Data Protection Regulation (Regulation (EU) 2016/679, abbreviated GDPR) is a European Union
- regulation on information privacy in the European Union (EU) and the European Economic Area (EEA). The GDPR is
- an important component of EU privacy law and human rights law, in particular Article 8(1) of the Charter of
- Fundamental Rights of the European Union. It also governs the transfer of personal data outside the EU and EEA. The GDPRโs goals are to enhance
- individualsโ control and rights over their personal information and to simplify the regulations for
- international business.
-
-
glossary:
-
-
A glossary (from Ancient Greek: ฮณฮปแฟถฯฯฮฑ, glossa; language, speech, wording), also known as a
- vocabulary or clavis, is an alphabetical list of terms in a particular domain of knowledge (scope) together with
- the definitions for those terms. Unlike a dictionary, a glossary has only one definition for each term.
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
-
-
Governance:
-
-
Governance, risk management, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with
- integrity. Governance is the combination of processes
- established and executed by the directors (or the board of directors) that are reflected in the organization's structure and how it is managed and
- led toward achieving goals. Risk management is
- predicting and managing risks that could hinder the organization from reliably achieving its objectives under uncertainty. Compliance refers to adhering with the mandated boundaries (laws and
- regulations) and voluntary boundaries (companyโs policies, procedures, etc.)
The party (or set of parties) authoritative for governing a trust community, usually (but not always) by developing, publishing,
- maintaining, and enforcing a governance
- framework. A governing body may be a government, a formal legal entity of any kind, an informal group of
- any kind, or an individual. A governing body may also delegate operational responsibilities to an administering body.
A guardianship arrangement (in a jurisdiction) is the
- specification of a set of rights and duties between legal entities of the jurisdiction that enforces these
- rights and duties, for the purpose of caring for, protecting, guarding, and defending one or more of these entities. At a minimum, the
- entities participating in a guardianship arrangement are the guardian and the dependent.
-
A physical computing device that provides tamper-evident and intrusion-resistant safeguarding and management
- of digital keys and other secrets, as well as
- crypto-processing.
An algorithm that computes a numerical value (called the hash value) on a data file or
- electronic message that is used to represent that file or
- message, and depends on the entire contents of the file or message. A hash function can be considered to be a
- fingerprint of the file or message. Approved hash functions satisfy the following properties: one-way
- (it is computationally infeasible to find any input that maps to any pre-specified output); and collision
- resistant (it is computationally infeasible to find any two distinct inputs that map to the same
- output).
The process of creating and verifying a relationship between the holder of a digital wallet
- and the wallet itself. Holder binding is related to but NOT the same as subject binding.
-
-
host:
-
-
A host is any hardware device that has the capability of permitting access to a network via a user interface,
- specialized software, network address, protocol stack, or any other means. Some examples
- include, but are not limited to, computers, personal electronic devices, thin clients, and multi-functional
- devices.
-
-
hourglass model:
-
-
An architectural model for layered systemsโand specifically for the protocol layers in a protocol stackโin which a diversity of supporting protocols and services at
- the lower layers are able to support a great diversity of protocols and applications at the higher layers
- through the use of a single protocol in the spanning
- layer in the middleโthe โneckโ of the hourglass.
A single attributeโtypically a character stringโthat
- uniquely identifies an entity within a specific context
- (which may be a global context). Examples include the name of a party the URL of an organization, or a serial number for a man-made thing.
A category that conveys the degree of confidence that a personโs claimed identity is their real identity, for example as defined in NIST SP 800-63-3 in
- terms of three levels: IAL 1 (Some confidence), IAL 2 (High confidence), IAL 3 (Very high confidence).
A physical or digital document containing identity
- data. A credential is a specialized form of
- identity document. Birth certificates, bank statements, and utility bills can all be considered identity
- documents.
An identity provider (abbreviated IdP or IDP) is a system entity that creates, maintains, and manages identity information for principals and also provides authentication services to relying applications within a federation or distributed network.
In the context of cybersecurity, impersonation is when an attacker pretends to be another person in order to
- commit fraud or some other digital crime.
-
-
integrity (of a data structure):
-
-
In IT security, data integrity means maintaining and assuring the accuracy and completeness of data over its entire lifecycle. This means that data cannot be modified in an unauthorized or undetected manner.
The Internet Protocol (IP) is the network layer communications protocol in the Internet protocol suite (also known as the TCP/IP suite) for relaying datagrams across network boundaries. Its routing function enables internetworking, and essentially establishes the Internet.
- IP has the task of delivering packets from the source host
- to the destination host solely based on the IP
- addresses in the packet headers. For this purpose, IP defines packet structures that encapsulate the data to be delivered. It also defines
- addressing methods that are used to label the datagram with source and destination information.
-
-
Internet protocol suite:
-
-
The Internet protocol suite, commonly known as TCP/IP, is a
- framework for organizing the set of communication
- protocols used in the Internet and similar computer networks according to functional criteria. The
- foundational protocols in the suite are the Transmission Control Protocol (TCP), the User Datagram Protocol (UDP), and the Internet Protocol (IP).
The composition of: a) a legal system (legislation,
- enforcement thereof, and conflict resolution), b) a party
- that governs that legal system, c) a scope within
- which that legal system is operational, and d) one or
- more objectives for the purpose of which the legal system is operated.
A process that results in the sharing of a key between two or more entities, either by transporting a key
- from one entity to another (key transport) or generating a key from information shared by the entities (key
- agreement).
-
-
key event:
-
-
An event in the history of the usage of a cryptographic key pair. There are multiple types of key events. The
- inception event is when the key pair is first generated. A rotation event is when the key pair is changed to a
- new key pair. In some key management systems
- (such as KERI), key events are tracked in a key event log.
A decentralized permissionless key management
- architecture.
-
-
key management system:
-
-
A system for the management of cryptographic
- keys and their metadata (e.g., generation,
- distribution, storage, backup, archive, recovery, use, revocation, and destruction). An automated key management system may be used to
- oversee, automate, and secure the key management process. A key management is often protected by implementing
- it within the trusted execution
- environment (TEE) of a device. An example is the Secure Enclave on Apple iOS devices.
-
-
keys-at-the-edge:
-
-
A key management architecture in which keys are stored on a userโs local edge devices, such as a
- smartphone, tablet, or laptop, and then used in conjunction with a secure protocol to unlock a key management system (KMS) and/or a digital vault in the cloud. This approach can enable
- the storage and sharing of large data structures that are not
- feasible on edge devices. This architecture can also be used in conjunction with confidential computing to enable cloud-based digital agents to safely carry out โuser not presentโ
- operations.
The (intangible) sum of what is known by a specific party, as well as the familiarity,
- awareness or understanding of someone or something by that party.
-
-
Laws of Identity:
-
-
A set of seven โlawsโ written by Kim Cameron, former Chief Identity Architect of Microsoft (1941-2021), to
- describe the dynamics that cause digital identity systems to succeed or fail in various contexts. His goal was
- to define the requirements for a unifying identity metasystem that can offer the Internet the identity layer
- it needs.
An entity that is not a natural person but is recognized as having legal rights and
- responsibilities. Examples include corporations, partnerships, sole proprietorships, non-profit organizations, associations, and governments. (In some
- cases even natural systems such as rivers are treated as legal entities.)
-
-
Legal Entity Identifier:
-
-
The Legal Entity Identifier (LEI) is a unique global identifier for legal
- entities participating in financial transactions. Also known as an LEI code or LEI number, its purpose
- is to help identify legal entities on a globally
- accessible database. Legal entities are organisations
- such as companies or government entities that participate in financial transactions.
In law, a legal person is any person or โthingโ that can do the things a human person is usually able to do
- in law โ such as enter into contracts, sue and be sued, own property, and so on.[3][4][5] The reason for the
- term โlegal personโ is that some legal persons are not people: companies and corporations are โpersonsโ
- legally speaking (they can legally do most of the things an ordinary person can do), but they are not people
- in a literal sense (human beings).
-
-
legal system:
-
-
A system in which policies and rules are defined, and mechanisms for their enforcement and conflict resolution are
- (implicitly or explicitly) specified. Legal systems are not just defined by governments; they can also be
- defined by a governance framework.
Any technique used to detect a presentation
- attack by determining whether the source of a biometric sample is a live human being or a fake
- representation. This is typically accomplished using algorithms that analyze biometric sensor data to detect
- whether the source is live or reproduced.
Information written in a computer language or expression language so that it can be read and processed by a computing
- device.
-
-
man-made thing:
-
-
Athing generated by human activity of some kind. Man-made
- things include both active things, such as cars or drones, and passive things, such as chairs or trousers.
Information describing the characteristics of data including,
- for example, structural metadata describing data structures (e.g., data format, syntax, and semantics) and
- descriptive metadata describing data contents (e.g., information security labels).
-
-
message:
-
-
A discrete unit of communication intended by the
- source for consumption by some recipient or group of recipients.
-
-
mobile deep link:
-
-
In the context of mobile apps, deep linking consists
- of using a uniform resource identifier (URI) that links to a specific location within a mobile app rather than
- simply launching the app. Deferred deep linking allows users to deep link to content even if the app is not
- already installed. Depending on the mobile device platform, the URI required to trigger the app may be
- different.
In computer networking, multicast is group communication where data
- transmission is addressed (using a multicast
- address) to a group of destination computers simultaneously. Multicast can be one-to-many or
- many-to-many distribution. Multicast should not be confused with physical layer point-to-multipoint
- communication.
-
-
multicast address:
-
-
A multicast address is a logical identifier for a group
- of hosts in a computer network that are available to process
- datagrams or frames intended to be multicast for a designated network service.
-
-
multi-party computation:
-
-
Secure multi-party computation (also known as secure computation, multi-party computation (MPC) or
- privacy-preserving computation) is a subfield of cryptography with the goal of creating methods for parties to jointly compute a function over their inputs
- while keeping those inputs private. Unlike traditional cryptographic tasks, where cryptography assures
- security and integrity of communication or storage and the adversary is outside the system of
- participants (an eavesdropper on the sender and receiver), the cryptography in this model protects
- participantsโ privacy from each other.
-
-
multi-party control:
-
-
A variant of multi-party computation where
- multiple parties must act in concert to meet a control requirement without revealing each otherโs data. All
- parties are privy to the output of the control, but no party learns anything about the others.
-
-
multi-signature:
-
-
A cryptographic signature scheme where the process of
- signing information (e.g., a transaction) is distributed among multiple private keys.
-
-
natural person:
-
-
A person (in legal meaning, i.e., one who has its own legal personality) that is an individual human being,
- distinguished from the broader category of a legal
- person, which may be a private (i.e., business entity or non-governmental organization) or public (i.e., government) organization.
-
-
natural thing:
-
-
A thing that exists in the natural world independently of
- humans. Although natural things may form part of a man-made thing, natural things
- are mutually exclusive with man-made things.
-
-
network address:
-
-
A network address is an identifier for a node or host on
- a telecommunications network. Network addresses are designed to be unique identifiers across the network, although some networks allow for local, private
- addresses, or locally administered addresses that may not be unique. Special network addresses are allocated
- as broadcast or multicast addresses. A network address designed to address a single device is
- called a unicast address.
-
-
node:
-
-
In telecommunications networks, a node (Latin: nodus, โknotโ) is either a redistribution point or a communication endpoint. The definition of a
- node depends on the network and protocol layer
- referred to. A physical network node is an electronic device that is attached to a network, and is capable of
- creating, receiving, or transmitting information over a communication channel.
In the context of privacy protection, this term denotes the context in which privacy trade-off decisions are
- made. It includes the regulatory environment and other non-technical factors that bear on what reasonable
- privacy expectations might be.
A party that consists of a group of parties who agree to be organized into a specific form in
- order to better achieve a common set of objectives.
- Examples include corporations, partnerships, sole proprietorships, non-profit organizations, associations, and
- governments.
A process by which two or more entities exchange VIDs in order to form a cryptographically verifiable
- connection (e.g., a ToIP connection), such as by scanning a QR code (in person or remotely) or clicking a deep
- link.
-
-
out-of-band
- introduction
-
-
A process by which two or more entities exchange VIDs in order to form a cryptographically verifiable
- connection (e.g., a ToIP connection), such as by scanning a QR code (in person or remotely) or clicking a deep
- link.
-
-
owner (of an entity):
-
-
The role that a party performs when it is exercising its legal, rightful or natural title to control
- a specific entity.
A string of characters (letters, numbers and other symbols) that are used to authenticate an identity, verify
- access authorization or derive cryptographic keys.
-
-
peer:
-
-
In the context of digital networks, an actor on the network
- that has the same status, privileges, and communications options as the other actors on the network.
-
-
peer-to-peer:
-
-
Peer-to-peer (P2P) computing or networking is a distributed application architecture that partitions tasks or
- workloads between peers. Peers are equally privileged, equipotent participants in the network. This forms a
- peer-to-peer network of nodes.
Information (any form of data) that can be used to directly
- or indirectly identify or re-identify an individual person
- either singly or in combination within a single record or in
- correlation with other records. This information can be one
- or more attributes/fields/properties in a record (e.g.,
- date-of-birth) or one or more records (e.g., medical
- records).
-
-
physical credential:
-
-
A credential in a physical form such as paper, plastic,
- or metal.
A statement or legal document (in privacy law) that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or
- clientโs data.
Proof of personhood (PoP) is a means of resisting malicious attacks on peer-to-peer networks, particularly, attacks that utilize multiple fake identities, otherwise known as a Sybil attack. Decentralized online platforms are
- particularly vulnerable to such attacks by their very nature, as notionally democratic and responsive to large
- voting blocks. In PoP, each unique human participant obtains one equal unit of voting power, and any
- associated rewards.
In the context of digital communication, an attribute of
- a digital object or data structure, such as a DID document or a schema.
-
-
protected data:
-
-
Data that is not publicly available but requires some type of
- access control to gain access.
-
-
protocol layer:
-
-
In modern protocol design, protocols are layered to form a protocol stack. Layering is a design principle that divides the protocol
- design task into smaller steps, each of which accomplishes a specific part, interacting with the other parts
- of the protocol only in a small number of well-defined ways. Layering allows the parts of a protocol to be
- designed and tested without a combinatorial explosion of cases, keeping each design relatively simple.
-
-
protocol stack:
-
-
The protocol stack or network stack is an implementation of a computer networking protocol suite or protocol
- family. Some of these terms are used interchangeably but strictly speaking, the suite is the
- definition of the communication protocols, and the stack is the software implementation of them.
-
-
pseudonym:
-
-
A pseudonym is a fictitious name that a person assumes for
- a particular purpose, which differs from their original or true name (orthonym). This also differs from a new
- name that entirely or legally replaces an individualโs own. Many pseudonym holders use pseudonyms because they wish to remain anonymous, but anonymity is difficult to achieve and often fraught with legal
- issues.
Public key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of
- related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are
- generated with cryptographic algorithms based on mathematical problems termed one-way functions. Security of
- public key cryptography depends on keeping the private
- key secret; the public key can be openly
- distributed without compromising security.
A QR code (short for โquick-response codeโ) is a type of two-dimensional matrix barcodeโa machine-readable optical image that contains
- information specific to the identified item. In practice, QR codes contain data for a locator, an identifier,
- and web tracking.
A term used to describe the opposite of digital identity, i.e., an identity (typically for a person) in the
- physical instead of the digital world.
-
-
recommended:
-
-
A requirement that is not mandatory to implement in order for an implementer to be in compliance, but which should be implemented unless the
- implementer has a good reason. In ToIP
- governance frameworks, a recommendation is expressed using a SHOULD or RECOMMENDED keyword as defined in
- IETF RFC 2119.
-
-
record:
-
-
A uniquely identifiable entry or listing in a database or registry.
The reputation or prestige of a social entity (a person, a
- social group, an organization, or a place) is an
- opinion about that entity โ typically developed as a result of social evaluation on a set of criteria, such as
- behavior or performance.
Reputation systems are programs or algorithms that allow users to rate each other in online communities in
- order to build trust through reputation. Some common uses of these systems can be found on e-commerce
- websites such as eBay, Amazon.com, and Etsy
- as well as online advice communities such as Stack Exchange.
In the context of digital credentials,
- revocation is an event signifying that the issuer no longer
- attests to the validity of a credential they have issued.
- In the context of cryptographic keys, revocation is an event signifying that the controller no longer attests to the validity of a public/private key pair for which the controller is authoritative.
-
-
risk:
-
-
The effects that uncertainty (i.e. a lack of information, understanding or knowledge of events, their consequences or likelihoods) can have on the intended
- realization of an objectiveof a party.
-
-
risk assessment:
-
-
The process of identifying risks to organizational
- operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the overall ecosystem, resulting from the operation of an information
- system. Risk assessment is part of risk management,
- incorporates threat and vulnerability analyses, and considers risk mitigations provided by security controls planned or in place.
The process of managing risks to organizational operations
- (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the
- operation of an information system, and includes: (i) the conduct of a risk assessment; (ii) the implementation of a risk mitigation strategy; and (iii) employment of techniques and procedures
- for the continuous monitoring of the security state of the information system.
-
-
risk mitigation:
-
-
Prioritizing, evaluating, and implementing the appropriate risk-reducing controls/countermeasures recommended from the risk management process.
-
-
role:
-
-
A defined set of characteristics that an entity has in some
- context, such as responsibilities it may have, actions
- (behaviors) it may execute, or pieces of knowledge that
- it is expected to have in that context, which are referenced by a specific role name.
-
-
role-based access control:
-
-
Access control based on user roles (i.e., a collection of access authorizations a user receives based on an explicit or implicit assumption
- of a given role). Rolepermissions may be
- inherited through a role hierarchy and typically reflect the
- permissions needed to perform defined functions within
- an organization. A given role may apply to a single individual or to several individuals.
A router is a networking device that forwards data
- packets between computer networks. Routers perform the traffic directing functions between networks and
- on the global Internet. Data sent through a network, such as a web page or email, is in the form of data packets. A packet is typically forwarded from one
- router to another router through the networks that constitute an internetwork (e.g. the Internet) until it
- reaches its destination node. This process is called routing.
-
-
routing:
-
-
Routing is the process of selecting a path for traffic in a network or between or across multiple networks.
- Broadly, routing is performed in many types of networks, including circuit-switched networks, such as the
- public switched telephone network (PSTN), and computer networks, such as the Internet. A router is a computing device that specializes in performing
- routing.
A framework, pattern, or set of rules for enforcing a
- specific structure on a digital object or a set of digital data. There are many types of schemas, e.g., data schema, credential verification
- schema, database schema.
-
-
scope:
-
-
In the context of terminology, scope refers to the set
- of possible concepts within which: a) a specific term is intended to uniquely identify a concept, or b) a specific glossary is intended to identify a set of concepts. In the context of identification, scope refers to the set of possible entities within which a
- specific entity must be uniquely identified. In the context of specifications, scope refers to the set of problems (the problem space)
- within which the specification is intended to specify solutions.
The original transport layer security protocol developed by Netscape and partners. Now deprecated in favor of
- Transport Layer Security (TLS).
-
-
security domain:
-
-
An environment or context that includes a set of system resources and a set of system entities that have the
- right to access the resources as defined by a common security policy, security model, or security architecture.
-
-
security policy:
-
-
A set of policies and rules that governs all aspects of security-relevant system and system element
- behavior.
A subclass of verifiable identifier that is cryptographically verifiable without the need to rely on any
- third party for verification because the identifier is cryptographically bound to the cryptographic keys
- from which it was generated.
- ~ Also known as: autonomous identifier.
-
-
self-certifying
- identifier
-
-
A subclass of verifiable identifier that is cryptographically verifiable without the need to rely on any
- third party for verification because the identifier is cryptographically bound to the cryptographic keys
- from which it was generated.
- ~ Also known as: autonomous identifier.
Personal data that a reasonable person would view from a privacy protection standpoint as
- requiring special care above and beyond other personal
- data.
An approach to complex organizational work design that recognizes the interaction between people and
- technology in workplaces. The term also refers to coherent systems of human relations, technical objects, and
- cybernetic processes that inhere to large, complex infrastructures. Social society, and its constituent
- substructures, qualify as complex sociotechnical systems.
-
-
software agent:
-
-
In computer science, a software agent is a computer program that acts for a user or other program in a
- relationship of agency, which derives from the Latin agere
- (to do): an agreement to act on oneโs behalf. A user
- agent is a specific type of software agent that is used directly by an end-user as the principal.
-
-
Sovrin Foundation:
-
-
A 501 ยฉ(4) nonprofit organization established to administer the governance framework governing the Sovrin Network, a public service
- utility enabling self-sovereign identity on
- the internet. The Sovrin Foundation is an independent organization that is responsible for ensuring the Sovrin identity system is public and globally accessible.
-
-
spanning layer:
-
-
A specific layer within a protocol stack that
- consists of a single protocol explicitly designed to provide interoperability between the protocols layers above it and below it.
In the context of digital communications, and in
- particular streaming media, a flow of data delivered in a continuous manner from a server to a client
- rather than in discrete messages.
-
-
streaming media:
-
-
Streaming media is multimedia for playback using an offline or online media player. Technically, the stream
- is delivered and consumed in a continuous manner from a client, with little or no intermediate storage in
- network elements. Streaming refers to the delivery method of content, rather than the content itself.
In the context of decentralized digital trust infrastructure, a subscription is an agreement between a first
- digital agentโthe publisherโto automatically send a
- second digital agentโthe subscriberโa message when a specific type of event happens in the wallet or vault managed by the first digital agent.
A Sybil attack is a type of attack on a computer network service in which an attacker subverts the serviceโs
- reputation system by creating a large number of
- pseudonymousidentities and uses them to gain a disproportionately large influence. It is
- named after the subject of the book Sybil, a case study of a woman diagnosed with dissociative
- identity disorder.
-
-
system of record:
-
-
A system of record (SOR) or source system of record (SSoR) is a data management term for an information
- storage system (commonly implemented on a computer system running a database management system) that is the authoritative data source for a given data
- element or piece of information.
-
-
tamper resistant:
-
-
A process which makes alterations to the data difficult (hard
- to perform), costly (expensive to perform), or both.
A requirement for a hardware or software component or
- system. In the context of decentralized digital trust infrastructure, technical requirements are a subset of
- governance requirements. Technical
- requirements are often specified in a technical
- specification.
-
-
technical specification:
-
-
A document that specifies, in a complete, precise, verifiable manner, the requirements, design, behavior, or other characteristics of a system or
- component and often the procedures for determining whether these provisions have been satisfied.
-
-
technical trust:
-
-
A level of assurance in a trust relationship that can be achieved only via
- technical means such as hardware, software, network protocols, and cryptography. Cryptographic trust is a specialized type of
- technical trust.
A unit of text (i.e., a word or phrase) that is used in a particular context or scope to refer to a concept (or a relation between concepts, or a property of a
- concept).
-
-
terminology:
-
-
Terminology is a group of specialized words and respective meanings in a particular field, and also the study
- of such terms and their use; the latter meaning is also known
- as terminology science. A term is a word, compound word, or multi-word expressions that in specific contexts
- is given specific meaningsโthese may deviate from the meanings the same words have in other contexts and in
- everyday language.[2] Terminology is a discipline
- that studies, among other things, the development of such terms and their interrelationships within a specialized domain. Terminology differs
- from lexicography, as it involves the study of concepts,
- conceptual systems and their labels (terms), whereas lexicography studies words and their meanings.
A wiki website used by a terms community to input,
- maintain, and publish its terminology. The ToIP
- Foundation Concepts and Terminology Working Group has established a simple template for GitHub-based terms
- wikis.
A party that is not directly involved in the trust
- relationship between a first party and a second party, but provides supporting services to
- either or both of them.
A token or packet of information that is used to provide assurance of timeliness; the timestamp contains
- timestamped data, including a time, and a signature generated by a trusted timestamp authority (TTA).
A non-profit project of the Linux Foundation chartered to define an overall architecture for
- decentralized digital trust infrastructure known as the ToIP
- stack.
A specification published by the ToIP Foundation.
- Specifications may be in one of three states: Draft Deliverable, Working Group Approved Deliverable, or ToIP
- Approved Deliverables
The ToIP Layer 2 protocol for verifiable
- messaging that implements the trust spanning
- layer of the ToIP stack. The ToIP Trust
- Spanning Protocol enables actors in different digital trust domains to interact in a similar way to how the
- Internet Protocol (IP) enables devices on different local area networks to exchange data.
-
-
transaction:
-
-
A discrete event between a user and a system that supports a business or programmatic purpose. A digital
- system may have multiple categories or types of transactions, which may require separate analysis within the
- overall digital identity risk assessment.
The Transmission Control Protocol (TCP) is one of the main protocols of the Internet protocol suite. It originated in the initial network
- implementation in which it complemented the Internet
- Protocol (IP). Therefore, the entire suite is commonly referred to as TCP/IP. TCP provides reliable, ordered, and error-checked delivery of a stream of
- octets (bytes) between applications running on hosts communicating via an IP network. Major internet
- applications such as the World Wide Web, email, remote administration, and file transfer rely on TCP, which is
- part of the Transport Layer of the TCP/IP suite. SSL/TLS
- often runs on top of TCP.
-
-
Transport Layer Security:
-
-
Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a computer network. The protocol is widely used
- in applications such as email, instant messaging, and Voice over IP, but its use in securing HTTPS remains the most publicly
- visible. The TLS protocol aims primarily to provide security, including privacy (confidentiality), integrity, and authenticity through the use of cryptography, such as the use of certificates, between two or more communicating
- computer applications.
-
-
tribal knowledge:
-
-
Knowledge that is known within an โin-groupโ of people
- but unknown outside of it. A tribe, in this sense, is a group of people that share such a
- common knowledge.
-
-
trust:
-
-
A belief that an entity will behave in a predictable manner
- in specified circumstances. The entity may be a person, process, object or any combination of such components.
- The entity can be of any size from a single hardware component or software module, to a piece of equipment
- identified by make and model, to a site or location, to an organization, to a nation-state. Trust, while
- inherently a subjective determination, can be based on objective evidence and subjective elements. The
- objective grounds for trust can include for example, the results of information technology product testing and
- evaluation. Subjective belief, level of comfort, and experience may supplement (or even replace) objective
- evidence, or substitute for such evidence when it is unavailable. Trust is usually relative to a specific
- circumstance or situation (e.g., the amount of money involved in a transaction, the sensitivity or criticality
- of information, or whether safety is an issue with human lives at stake). Trust is generally not transitive
- (e.g., you trust a friend but not necessarily a friend of a friend). Finally, trust is generally earned, based
- on experience or measurement.
The context in which a specific party makes a specific trust decision. Many different factors may be
- involved in establishing a trust context, such as: the relevant interaction or transaction; the presence or
- absence of existing trust relationships; the
- applicability of one or more governance
- frameworks; and the location, time, network, and/or devices involved. A trust context may be implicit or
- explicit; if explicit, it may be identified using an identifier. A ToIP governance framework an example of an explicit trust context
- identified by a ToIP identifier.
-
-
trust decision:
-
-
A decision that a party needs to make about whether to
- engage in a specific interaction or transaction with
- another entity that involves real or perceived risks.
A term coined by John Jordan to describe the decentralized digital trust infrastructure made possible by the
- ToIP stack. A play on the term Voice over IP
- (abbreviated VoIP).
In the context of specific digital trust
- ecosystems, such as the European Unionโs eIDAS regulations, a trust service provider (TSP) is a legal
- entity that provides specific trust support services
- as required by legal regulations, trust
- frameworks, or governance frameworks.
- In the larger context of ToIP infrastructure, a TSP is a
- provider of services based on the ToIP stack. Most
- generally, a TSP is to the trust layer for the Internet what an Internet service provider (ISP) is to the
- Internet layer.
A trusted execution environment (TEE) is a secure area of a main processor. It helps code and data loaded
- inside it to be protected with respect to confidentiality and integrity. Data integrity
- prevents unauthorizedentities from outside the TEE from altering data, while code integrity prevents code in the TEE from being replaced or modified by
- unauthorizedentities, which may also be the computer owner itself as in certain DRM
- schemes.
In cryptography, a trusted third party (TTP) is an entity which facilitates interactions between two parties who both trust the third party; the third party
- reviews all critical transaction communications between the parties, based on the ease of creating fraudulent
- digital content. In TTP models, the relying parties
- use this trust to secure their own interactions. TTPs are common in any number of commercial transactions and
- in cryptographic digital transactions as well as cryptographic protocols, for example, a certificate authority (CA) would issue a digital certificate to one of the two parties in
- the next example. The CA then becomes the TTP to that certificateโs issuance. Likewise transactions that need
- a third party recordation would also need a third-party repository service of some kind.
-
-
trusted timestamp authority:
-
-
An authority that is trusted to provide accurate time
- information in the form of a timestamp.
An attribute of a person or organization that
- provides confidence to others of the qualifications, capabilities, and reliability of that entity to perform specific tasks and fulfill assigned
- responsibilities. Trustworthiness is also a characteristic of information technology products and systems. The
- attribute of trustworthiness, whether applied to people, processes, or technologies, can be measured, at least
- in relative terms if not quantitatively. The determination of trustworthiness plays a key role in establishing
- trust relationships among persons and organizations. The trust relationships are key factors in risk decisions made by senior leaders/executives.
A software agent that is used directly by the
- end-user as the principal. Browsers, email clients, and
- digital wallets are all examples of user agents.
-
Voice over Internet Protocol (VoIP), also called IP telephony, is a method and group of technologies for
- voice calls for the delivery of voice communication
- sessions over Internet Protocol (IP) networks,
- such as the Internet.
The set of software components that form the core of a digital wallet, but which by themselves are not sufficient to deliver a
- fully functional wallet for use by a digital agent
- (of a principal). A wallet engine is to a digital wallet what a browser engine
- is to a web browser.
A specific kind of cryptographic proof that proves facts
- about data to a verifier without revealing the underlying data itself. A common example is proving that a person is over or under a specific age
- without revealing the personโs exact birthdate.
-
-
zero-knowledge service:
-
-
In cloud computing, the term โzero-knowledgeโ refers to an online service that stores, transfers or
- manipulates data in a way that maintains a high level of confidentiality, where the data is only accessible
- to the data'sowner (the client), and not to the service provider. This is achieved by encrypting the raw data at the clientโs side or end-to-end (in case there is more than one client),
- without disclosing the password to the service provider. This means that neither the service provider, nor any
- third party that might intercept the data, can decrypt and access the data without
- prior permission, allowing the client a higher degree of privacy than would otherwise be possible. In
- addition, zero-knowledge services often strive to hold as little metadata as possible, holding only that data that is functionally needed by the service.
A network security architecture based on the core design principle โnever trust, always verifyโ, so that all
- actors are denied access to resources pending verification.
An adjective describing when the identity of a natural person or other actor is unknown.
-
-
assurance level
-
-
A level of confidence that may be relied on by others. Different types of assurance levels are defined for
- different types of trust assurance mechanisms. Examples include authenticator assurance level, federation
- assurance level, and identity assurance level.
-
-
authorization
-
-
The process of verifying that a requested action or service is approved for a specific entity.
-
-
out-of-band introduction
-
-
-
A process by which two or more entities exchange VIDs in order to form a cryptographically verifiable
- connection (e.g., a ToIP connection), such as by scanning a QR code (in person or remotely) or clicking a deep
- link.
-
-
out-of-band
- introduction
-
-
A process by which two or more entities exchange VIDs in order to form a cryptographically verifiable
- connection (e.g., a ToIP connection), such as by scanning a QR code (in person or remotely) or clicking a deep
- link.
-
-
permission
-
-
Authorization to perform some action on a system.
-
-
policy
-
-
Statements, rules or assertions that specify the correct or expected behavior of an entity.
-
-
real world identity
-
-
A term used to describe the opposite of digital identity, i.e., an identity (typically for a person) in the
- physical instead of the digital world.
-
-
self-certifying
- identifier
-
-
A subclass of verifiable identifier that is cryptographically verifiable without the need to rely on any
- third party for verification because the identifier is cryptographically bound to the cryptographic keys
- from which it was generated.
- ~ Also known as: autonomous identifier.
-
-
self-certifying
- identifier
-
-
A subclass of verifiable identifier that is cryptographically verifiable without the need to rely on any
- third party for verification because the identifier is cryptographically bound to the cryptographic keys
- from which it was generated.
- ~ Also known as: autonomous identifier.
+
+
+
+
+