The concept of identity is core to the protection of data. Data and other computing resources exist to be used by individuals, each of whom has an identity that is used to grant of deny access to such resources. However, identity is not limited to humans. Computer services also have an identity that allows them to interact with other services and data.
As humans, we understand identity as all the characteristics that are representative and unique of an individual, and our method of validating identity comes naturally in the course of interaction. We recognize and associate these characteristics with a unique person, and our ability to associate characteristics with a person increases with our exposure to the individual. Exposure does not need to be direct, such as spending time with them, but can be gained indirectly through activities such as reading or talking about them, or seeing them on TV. This is why some people are more easily recognizable than others. Consider how you recognize the touch of a loved one or the voice of your mother, whereas a former acquaintance’s name may be unfamiliar to you, even when encountering them face to face. Similarly, popular personalities such as actors or politicians are easily recognized by each of us, even if we have never met them personally. Similar methods are used to build trust. You wouldn’t let a stranger borrow your car, but this might change as strangers become friends.
Computers, likewise, can use a variety of characteristics to validate a claimed identity, but the methods of recognizing that identity differ from humans. Users validate their identity to a computer by claiming an identity and then providing credentials to back up that claim in a process called authentication. For example, a username claims an identity while the correct corresponding password validates it.
However, there are several important distinctions between the identification that occurs on a computer system and identification between persons. Computers have an advantage over humans in that they do not forget user identities over time, but their methods of identifying a person are much more limited. Whereas a human can use hundreds of characteristics to make an identity, and they can associate a different set of characteristics with different people, a computer system typically only supports a few very structured methods of identification. The most familiar method of authenticating to a computer system is the traditional username and password, but other methods such as fingerprints, facial recognition, proximity cards, and secret questions can also be used.