GCRI · Registry

Digital identity for registries

Digital identity is how a registry knows who is who: the people who contribute, the organisations that issue records and the stewards who may change them. It covers persistent identifiers, authentication of the people editing records, proofing of issuers, separation of identity from authority, and the privacy that keeps identity data from becoming a harm in itself.

Make an enquiry Back to STEM foundation of Registry
01Register

Digital identity for registries on the record.

Method recordSTEM method
  1. MethodDigital identity and public digital systems
  3. Applied inRegistry
  6. Canonical pageSTEM Commons
02Application

What digital identity and public digital systems does here.

Digital identity and public digital systems provide the means for people and organisations to prove who they are and access services online. They underpin social protection, financial inclusion and emergency assistance. In governance and institutions and research and evidence, digital identity systems determine how quickly aid and payments reach people after shocks. Their failure or misuse can amplify social and economic harm. The canonical description is on the STEM Commons.

Issuer authentication and authority

Before an assertion is accepted, the issuer signs in through federated authentication and the registry checks the role they hold for that programme. Authentication shows who they are; a separate authority check decides what they may assert.

Contributor disambiguation by the person

Contributors are linked to ORCID iDs through the identifier holder’s own authenticated permission, so a link is made by the person rather than inferred from a name, and the person can correct it.

Verifiable attestations

Status or participation attestations are issued as signed credentials that a third party can check against the issuer’s public key without contacting the registry, while revealing only the fields needed.

03Methods and evidence

How digital identity for registries is modelled, measured and tested.

The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.

Datasets and provenance

The data classes behind digital identity for registries and what is recorded about each before it is used.

Data classProvenance recordedResolution statedLicence checked
Satellite imagery, optical and radarsensor, processing level, acquisition datepixel size and revisitper scene
Reanalysis and climate model outputmodel, experiment, member, versiongrid and time stepper release
In-situ sensors and gaugesstation, instrument, calibration recordpoint and sampling rateper network
Population and asset exposuremethod, vintage, input sourcescell size and unitper release
Boundaries and reference geographyproducer, edition, datescaleper edition
Lineage
W3C PROV record from source to figure
Principles
FAIR: findable, accessible, interoperable, reusable
Gaps
shown as missing, never filled silently
Data classes and the provenance fields recorded for each; a dataset is listed by name only once its licence admits the use.
FAIR guiding principles · GO FAIR and FORCE11W3C PROV · World Wide Web ConsortiumGuidance on consistent treatment of uncertainties · IPCCCEOS Analysis Ready Data · Committee on Earth Observation Satellites
04Data

What the method consumes.

Datasets and records used by digital identity and public digital systems on this platform, with the role each plays and the label its values carry. Sources are listed in the source register.

DataRoleLabel
ORCID authenticated linksContributor identity confirmed by the personDECLARED
GLEIF Legal Entity IdentifiersLegal identity and parent relationships of organisationsPublished statistics
ROR registryResearch organisation identity and name variantsREPORTED
Role and delegation registersWho holds authority over each programme recordDECLARED
Authentication and access logsWho changed which record, and under which roleOBSERVED
05Process

How the process runs.

Process

Digital identity for registries: Incident handling, CSF 2.0

CSF 2.0 has six Functions to address concurrently, in no implied order; this walk-through picks outcomes from Detect, Respond, Recover, Identify and Govern.

  1. 01 Detect

    1. 01Detect: adverse event analysis (DE.AE)DatasetPotentially adverse events are analysed to detect cybersecurity incidents. Information is correlated from multiple sources.
    2. 02Declare and triage (DE.AE-08, RS.MA-02)GateIncidents are declared when adverse events meet the defined incident criteria. Incident reports are triaged and validated.

  2. 02 Respond

    1. 03Respond: incident analysis (RS.AN)ModelInvestigations establish what has taken place and the root cause. Records of the investigation keep their integrity and provenance.
    2. 04Respond: incident mitigation (RS.MI)Step · Independent auditorActivities prevent expansion of an event and mitigate its effects. Incidents are contained and eradicated.
    3. 05Respond: reporting and communication (RS.CO)StepResponse is coordinated with internal and external stakeholders as laws, regulations or policies require. Stakeholders are notified.

  3. 03 Recover

    1. 06Recover: incident recovery plan execution (RC.RP)StepRestoration is performed to restore availability. The integrity of backups and other restoration assets is verified before use.

  4. 04 Improve and govern

    1. 07Identify: improvement (ID.IM)StepImprovements come from evaluations, tests, exercises and operations. Incident response plans are set, shared, maintained and improved.
    2. 08Govern: oversight (GV.OV)Decision · Independent auditorRisk management results inform and adjust the risk strategy. Leadership is responsible and accountable for cybersecurity risk.

Neutral outline of a published external standard or method, from its issuing body. Not a record of operation. Nexus does not perform, certify or approve any step shown. A gate or decision belongs to the party the source names. The six Functions are Govern, Identify, Protect, Detect, Respond and Recover.

06Validation

How results are checked.

Systems are tested for accuracy of matching, resistance to fraud and accessibility. Independent audits review privacy and security controls.

CheckHow it is done
Match accuracy testingName-to-identifier matching is scored against a hand-checked sample, with false merges and false splits reported separately
Authority separationTests confirm that an authenticated user without the required role cannot change a record they do not own
Privacy impact assessmentIdentity data collected, published and retained is reviewed against data protection requirements before release
Exclusion reviewContributors without identifiers or institutional accounts are checked to have a working route to be recorded and to correct their record

Exclusion errors can deny services to vulnerable groups. Centralised systems create attractive targets and single points of failure.

07Connections

Topics that rely on this method.

08Stewardship

Who maintains the method.

Digital Public Infrastructure stewards digital identity and public digital systems for the Consortium and reviews how it is applied across platforms.

Canonical page: Digital identity and public digital systems

09Connected

Where this page leads across the Consortium.

10Questions

Questions and answers.

What are the limits of digital identity and public digital systems in this field?
Exclusion errors can deny services to vulnerable groups. Centralised systems create attractive targets and single points of failure.
How are results checked?
Systems are tested for accuracy of matching, resistance to fraud and accessibility. Independent audits review privacy and security controls.
Are the values on this page real?
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method’s use, not a run; no result is reported here.
Where else is this method applied?
The canonical method page lists every platform that applies it.
ReportsContribute

Contribute evidence from this page.

Reports is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

GCRIRegistryMethods and Technical

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

Registry

Bring a method, a dataset or a question.

Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.

Propose a method See all contact routes
Legal

Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.

The Global Centre for Risk and Innovation

Science · evidence · measurement

Not for profit

Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.

Partner with us

Who funds us

GCRI is a not-for-profit institution. To ask who funds a piece of work, use the funding questions form.

Independence

Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.

Corrections policy

Licence

Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through the permissions form.

Privacy choices