This document discusses different types of electronic identities and attributes used for authentication, authorization, and access across systems. It covers: - Basic username/password and file permission models for direct local access - More advanced directory services like LDAP, Kerberos, and PKI for system-level access across networks - How public key infrastructure uses certificates to authenticate parties, authorize access, and broker digital assets between organizations in a verifiable way similar to state-issued IDs - The use of certificates to establish unique identities, security features, context, and limitations for both people and systems seeking to collaborate or provide access to resources.

1. A linked electronic identity and attributes used across
distinct access systems

3. Authentication – Username / Password
Authorization – open or simple permissions
Access – direct, local resources

4. Authentication – shared/replicated credentials
Authorization – file permissions, Owner ID, GroupID
Access – system accessible resources, SAN

5. Authentication – LDAP/AD, OTP, RADIUS/TACACS,
SSO/RSO, PKI
Authorization – LDAP, GPO, NFS, Kerberos, IAM
Access – NFS, Kerberos, SMB, NAS

6. Authentication – by service provider, LDAP/AD export,
Public Key Infrastructure (PKI)
Authorization – brokered Digital Asset Management,
Higgins trust framework, Bandit,
Security Assertion Markup Language (SAML),
OpenID, PKI
Access – via API, HADOOP, SPARK, S3, SOAP, REST,
FASP, OpenStack

8. Issued by regional / delegated authority – state government
Recognized by other agencies - governments, businesses
Contains embedded security features – hologram, magnetic
strip, UV seal, smartchip, barcodes
Contains unique attributes – photo, fingerprint,
signature, license number, street address
Establishes context and limitations – operating class,
expiration date, physical restrictions

9. Issued by regional / delegated authority – Certificate Authority (CA)
Recognized by other agencies – validated by other CAs, and
filed to use during collaboration
Embedded security features – digital fingerprint , encryption key,
and RSA hash
Contains unique attributes – email address, private key hash,
digital signature, project ID, business
affiliations, organizational roles,
any relevant attribute
Establishes context and limitations – issuing authority, expiration
times, revocation authority

10. Identities and attributes are embedded in certificates.
Relationships and authorizations can be made using
certificates.
Certificates are created and validated through Certificate
Authority and exchanged between appropriate parties.
Storage vendor uses certificates for authentication,
authorization, and access to objects.

11. Any data file, object storage or not, can contain value, so
use of encryption is highly desirable.
The further away from direct control, the more
important encryption becomes.
Encryption keys are much more easily exchanged using
certificates, especially if based on public/private key
pairs, like PGP.