A special case peer-to-peer network. Participants want to establish trusted identities that can be used securely for ongoing, high-value communication among organizations. A trusted, central provider issues identity tokens which are then enrolled independently by each service provider. Service providers are not required to cooperate or accept one another’s enrollments.
Examples: The most common examples are RSA SecurID and SWIFT 3SKey. Hardware tokens are issued by a trusted provider, which are then used to authenticate individual identities.
Each service will require the user to enroll separately, but once the user has registered they can use the token for future interactions.
When the requester wants to use a service, they’re authenticated using the token.
When to use: Strong Authentication across a range of business entities who may have different enrollment requirements.
Advantages: Can provide a high level of identity assurance to institutions spread across legal and national boundaries.
Disadvantages: Can be expensive and complex to implement. Depends upon the existence of a trusted third party who can issue and ensure the security of hardware tokens. Hardware tokens can be lost.
Ability to scale: Can scale to large networks.