Trust Vector

Full Title or Meme

A collection of Authentication results or Attribute Validations presented to an Authorization Service to control access to a resource, typically digital but possibly physical.

Context

Internet Relying Parties need to perform Knowledge-based functions to determine if the current request by a User should result in Authorization of access.

Problems

• Many large ecommerce sites are already performing this function, but for obvious reasons do not like to let that fact be known.
• If attackers where to understand the process in full detail, they would know how to subvert it.

Solutions

The Trust Vector consisting of the following claims is typically sent together with contextual information in a form that can be processed by a Fraud Detection service.

1. User claims
   1. User assertions
   2. User stipulations (typically User Consent to privacy regulations, but also other user preferences)
   3. User Point of Presence claims (such as the FIDO U2F specification details)
   4. Inline Validations (preformed by Trusted Third Parties and included in the submission from the user)
   5. Online Validations (performed by Trusted Third Parties at the request of the Relying Party)
2. Local context
   1. User behavior at the local site now and in the past
   2. Value or risk as determined by the Relying Party