* A look back at an early identity-based application
Back in the day when personal computers where starting to become commonplace, the various machines (Commodore VIC-20, Atari, TRS-80, Apple I and others) each had its own operating system. Software could only run on one machine, which meant there were few choices and high prices. But what they all had was built-in BASIC, the programming language. Most had a BASIC interpreter, but the IBM PC came with a BASIC compiler (showing, I guess, that it was intended for bigger and better things).
It struck me the other day that it was back then, on my old VIC-20, that I first encountered an identity-based application. It was a game, written in BASIC that had to be typed in to the computer called “Animal.” The game (and you can see the code here) purported to be a “guessing” game where the computer guessed the name of an animal you were thinking of. It did this by asking a series of yes/no questions and following a decision tree to an endpoint. Then it would ask, for example: “Are you thinking of an elephant?” If you answered “No” it would ask what animal you were thinking of (say, a camel) and what question would differentiate it from an elephant (“It lives in the dessert”). It thus built up a series of attributes which — taken together — identified a particular animal.
That’s not so very different from how we identify people.
It’s been a while, so it might be a good time to try — once again — to define “identity”. What follows is my thinking, but as always, I’d like to hear what you have to say.
An “identity” is a description of a thing. That is, a list of descriptors, or “attributes,” one or more of which (when grouped together) constitute a unique identifier for that entity within a given domain. The descriptors may be subjective (name, favorite music, religion and so on) or objective (sex, race, ability to dance, fingerprint and so on). Objective identifiers can be tested for, subjective ones cannot. A disinterested third party, for example, could pick out “everyone with black hair” from a lineup, but could not pick out “everyone who preferred cats to dogs.”
Subjective identifiers (which includes account numbers, usernames, passwords and so on) can be vouched for by third-party identity providers, the basis for so-called user-centric identity schemes. Objective identifiers might be used by those identity providers as a way to validate an entity’s identity.
That doesn’t seem particularly deep, overly simple or lacking in any major way. But, if I’m headed down the wrong path, please enlighten me!
Upcoming conferences from the IdM Journal Event Log:
Feb. 22 – 25: Biometrics Summit Conference (Miami, FL)
March 1 – 5: RSA Conference (San Francisco)
March 1: Smart Cards and Identity Management for Public and Private Enterprises (San Francisco)
