Introduction

Binding Assurance is about the degree to which an entity claiming information is the actual subject of that information (does the information belong to or relate to someone or something else).

If binding is not done or insufficiently done, it increases the likelihood of identity theft and service takeover. This is covered in the Binding Assurance Standard.

Binding Assurance does not make any judgement as to whether the Entity Information is accurate or not, this is covered as part of the Information Assurance Standard.

Definitions for key terms used in this guidance can be found in Identification terminology.

This is living guidance and will be evolved and expanded over time to meet the needs of users.

Guidance for Entity Binding

Entity binding is the process of confirming to a level of assurance, the information collected about the Entity is related to that Entity.

Objective 1: Binding risk is understood

Applying a risk-based approach to binding assurance helps to identify the aspects of binding that drive the level of risk. Understanding this enables the development of a wide range of mitigation strategies.

BA1.01 Guidance — risk assessment

Any robust risk assessment process may be used to identify the binding risk posed. The guidance provided in Assessing identification risk has been developed to improve the quality of this assessment.

A workbook has also been developed to help with undertaking an identification risk assessment and to provide the optimum level of assurance as an output. 

For a copy, email identity@dia.govt.nz.

Objective 2: Entity can claim an instance of Entity Information

During an enrolment process, the Entity remains linked to the Entity Information they have provided, if it is carried out in a single session.

If there is a break in the enrolment process or when the Entity returns to the service in the future, without an Authenticator, they need to be able to claim (connect) to their instance of Entity Information. Instances of Entity Information that are not currently bound to an Entity or Authenticator are deemed to be orphaned.

There are some contexts where Entity Information may be received by a Relying Party outside an enrolment process. This is unclaimed Entity Information in the context of that Relying Party. For example, a hospital provides the Registrar of Births, Deaths and Marriages, information about the birth of a child. Or the Electoral Commission provides a Local Body, information about eligible voters for an upcoming election.

Both the Registrar and the Local Body now hold Entity Information that an Entity has yet to claim.

An instance of Entity Information is often referred to as an ‘account’ or a ‘record’. When stored in a system, Entity Information may not be in one place. How and where Entity Information is stored is outside the scope of Identification Management.

BA2.01 Guidance — identify instance of Entity Information

Depending on the context, individual attributes within Entity Information can be similar or the same.

If the Relying Party does not collect enough information to identify the right instance, multiple instances of Entity Information can be found and there is an increased likelihood the incorrect instance might be used.

Additional information should be requested until it is certain the correct instance has been identified, before beginning any binding processes.

BA2.02 Guidance — instances are known to be claimed

Not recording any information about an attempt to claim an instance of Entity Information, successful or not, can increase the likelihood that the Entity Information becomes vulnerable to being taken over by an Entity who is not the rightful claimant.

The recording or registering of Authenticators is the easiest way in which to do this.

If a subsequent claim occurs to Entity Information that has already been recorded as having been bound, this should raise concern.

An investigation should occur to determine the rightful claimant. Where the Entity Information has either been orphaned or unclaimed for any period, it should never be assumed that the first Entity to claim the instance is the correct one.

Objective 3: Entity is the subject of Entity Information

Failure to identify the correct Entity Information is an avenue for identity theft. Failure to carry out sufficient binding of an Entity to Entity Information is another. These controls cannot be replaced by relying on or increasing the level of information assurance.

BA3.01 Guidance — establish binding level

The Identification risk assessment process can be used to determine the level of binding assurance (BA) required, for linking or binding the Entity to their information.

Alternatively, use an analytical assessment considering the following:

• the key business drivers and outcomes
• risk of financial loss or liability
• risk to the privacy, standing, reputation or safety of people
• harm to agency programmes or the public interest
• any direct downstream effects, this could include other parties that will rely on the outcome (for example, a credential).

BA3.02 Guidance — binding process

Binding is most often done using a Credential established in another context.

All binding relies on the ability of the Entity to respond to challenges using 1 or more of the following factor types:

• Knowledge factors that are not publicly known, easily determined or predictable.
• Possession factors that contain enough features to assess as genuine.
• Biometric factors with appropriate measures to detect spoofing attempts.

For more information on the factor types and the forms they can take, refer to Authenticator types.

The more critical the risk associated with incorrect binding, the higher the level needed and therefore the number of factors that need to be successfully responded to.

It’s difficult to use knowledge factors for binding, when they are not part of an existing Credential or Authenticator.

It requires access to enough Entity Information that the responses to challenges are unlikely to be known by others, including family, close friends and social media contacts.

Possession factors used on their own are the weakest form of binding because they can be transferred to another Entity, either with or without the Entity’s knowledge.

Usually a possession factor will be a Credential produced from another context and will often be combined with another factor. For example, it may have an image of the Entity embedded in it.

Biometric factors used for binding can be implemented using manual or automated comparison processes.

Biometric characteristics will be non-existent or difficult to establish for non-human Entities, so are unlikely to be used for these entity types. 

When using a Credential of equal or greater assurance level, the Credential will need to contain some information matching the Entity Information to be bound.

The number of binding factors in the Credential’s authentication mechanism will need to be equal to or greater than those of the level being met.

Using an Authenticator of equal or greater strength only applies when the context has an existing Authenticator in place, for another delivery channel. For example, using an Authenticator for the phone channel to confirm the Entity Binding for an interaction online or in-person.

BA3.03 Guidance — level assumptions

If the Credential Provider has not indicated the level(s) of assurance of their credential, it can be dangerous to assume what these might be. Ideally, the Credentials should be treated as level 1. However, until declaration of levels of assurance becomes embedded, a pragmatic approach to accepting Credentials as having higher levels will need to be taken.

Estimation of levels of assurance, when not declared, will need to be done in conjunction with the Credential Provider and expertise in the application of the Identification standards.

BA3.04 Guidance — limit unsuccessful attempts

Allowing an Entity to continue to attempt to bind to a record can indicate an attempt to associate with another Entity’s information. This can be for the intention of undertaking fraud or just to cause nuisance.

Letting this continue unchecked increases the likelihood that an unauthorised Entity will eventually be successful.

The number of allowable attempts will be proportional to the risk of incorrect binding, which has been established and the other mitigation which are in place.

Objective 4: Entity uniqueness in a context

There is a substantial difference between ensuring that each instance of Entity Information in a context is unique and ensuring that each Entity participating in a context has only 1 instance of Entity Information.

A single Entity associating themselves with multiple instances of Entity Information can have negative outcomes in certain contexts. For example, passports, justice or certain entitlements.

BA4.01 Guidance — 1 and only 1

Currently the most effective way to ensure an Entity is only enrolled once in a context is to use a biometric characteristic in which any new Entity entering the context is compared to all existing Entities in the context to reduce duplication.

As this is a costly exercise to do, the risk being mitigated and the benefits of doing so need to be considered.

Objective 5: Entity Binding integrity is maintained

Once an Entity has been bound to Entity Information, it will only last for the length of that interaction. When the Entity leaves it is broken. The essence of the binding can be held through the registering of an Authenticator at the equivalent level. However, if this Authenticator does not have a biometric component, there is a risk that over time it may come into the possession of another Entity. Possession by another Entity means that the binding between the Entity and Entity Information is also compromised.

To mitigate against misappropriated and misused Authenticators, retest at Entity Binding at regular intervals. Retesting also ensures that Entity Information not used on a regular basis is appropriately managed if the Entity it relates to is deceased or otherwise inactive.

This also provides an opportunity to increase the binding level if additional risk is present.

Changes to the risk profile for the service or transaction and increases in binding level, are also opportunities to proactively retest Entity Binding.

BA5.01 Guidance — retest binding

Retesting Entity Binding involves carrying out an event that does not rely solely on the Authenticator, unless it contains a biometric factor as part of the authentication process.

These events should involve direct contact with the Entity but do not necessarily have to take place face-to-face. For example, it could be by phone.

If the Entity has an Authenticator with a biometric element but it is not the primary method of authentication this could be used to facilitate the process of retesting the Entity Binding.

BA5.02 Guidance – counter fraud

Counter fraud techniques are activities that contribute to binding assurance after the decision to bind and to complete the enrolment of the Entity.

For more information refer to Counter fraud techniques in Guidance.
Counter fraud techniques

BA5.03 Guidance - investigation

It is important to keep good records, regardless of the way in which binding assurance is carried out. The ability to investigate the processes, is a contributing element to building trust in those processes. 

What and how much information is recorded about the processes undertaken will depend on the risk behind the need for enrolling the Entity plus any requirements under legislation, such as the Public Records Act 2005.

Public Records Act 2005 — New Zealand Legislation

Related advice

If there is an intention to provide binding assurance or other identification services to other parties, the requirements and guidance for Federation Assurance should also be applied.

The following resources are also related to this topic:

• Factsheets on commonly used documents
• Authenticator types

Contact

Te Tari Taiwhenua Department of Internal Affairs
Email: identity@dia.govt.nz