The Identity Metasystem is an interoperable architecture for digital identity that enables people to have and employ a collection of digital identities based on multiple underlying technologies, implementations, and providers. As its name implies, the “meta” system is a system of systems. It goes beyond singular identity architecture and provides an architecture that can embrace and abstract multiple identity systems—both legacy and new—and still maintain its core architectural intentions and design.
Using this approach, customers can continue to use their existing identity infrastructure investments, choose the identity technology that works best for them, and more easily immigrate from old technologies to new technologies without sacrificing interoperability.
The Identity Metasystem is made up of three core components:

1. The information card
2. The identity selector
3. Identity Metasystem Services

Identity Metasystem is such an important overarching term for understanding the state of digital identity that some history about the term is appropriate here.
The dual “system of systems” approach that has come to be called the Identity Metasystem has a difficult ontology. The Identity Metasystem term originated from documents published by Microsoft circa 2005. The idea of a “system of systems” has been around for much longer.

Indeed, Novell’s own history in identity development included such ideas as early as 2001 and was referred to as the “identity provider model.”
As one can imagine, there has been a long history of resistance by the identity community to adopt Microsoft originated terminology without trepidation. Two things have occurred that have caused a solid adoption of this term among the core identity vendors.

First, Microsoft has made it clear that it has no intention of using the term to describe just its own products or vision concerning digital identity and that it offers the term for use with not threat of repercussion.

Second, the Information Card Foundation has voted to adopt the use of the term Identity Metasystem to refer to an industry wide and vendor independent digital identity system.

With these two events coming to pass, it seems unnecessary to champion an alternative naming method when this one has been adopted by a large percentage of the digital identity community.

The Information Card

Information cards are digital identity representations that people can use online. There are currently two types of information cards defined by the Identity Metasystem:

1. The personal information card
2. The managed information card

Personal information cards are issued by individuals from within the identity selector. Managed information cards are issued by an identity provider.
Visually, each information card has a credit card shaped picture and a card name associated with it that enables people to organize their digital identities and to easily select one they want to use for any given interaction.

The information card metaphor is implemented by identity selectors like Windows Cardspace, Novell DigitalMe, the Higgins Project and the openinformationcard identity selector.

The Identity Selector

The identity selector is the key abstraction layer for the selector based identity model. The identity selector is a system level application with a user interface and an application program interface (API). As an abstraction layer, the identity selector is the ideal architecture for a “provider” interface that supports of multiple types of identity protocols.
When used by a person, the identity selector is used for three main purposes:

• Submitting information cards to a relying party
• Managing information cards (import, export, send)
• Creation of personal or self issued information cards

A person can access the identity selector from the browser, any application that is identity selector enabled, and from the operating system itself.
To date, identity selector access in the browser is not browser intrinsic. That is to say browsers require a plug-in to use the identity selector.
In the future, the identity selector access will be intrinsic to the browser.

When multiple identity selectors are installed on the local operating system, an identity selector switch is required to allow the user, or an application to “switch” between selectors.
The identity selector is authentication protocol agnostic. This means that the identity selector abstraction layer is capable of interfacing with all of the important identity protocols.
There is more detail about the selector architecture later in this document.

Identity Metasystem Services

There are a variety of specifications associated with Identity Metasystem Services. These are often referred to as simply web services. These specifications are in varying degrees of maturity and are maintained or supported by various standards bodies and entities. Specifications may complement, overlap, and compete with each other. In the past, web service specifications were referred to collectively as “WS-*”. The ICF and Novell—and even Microsoft—have discontinued using “WS-*” as a term or a mechanism to refer to all of the different web services.

Along with adopting the Identity Metasystem as an overarching term, the term Identity Metasystem Services is then used to refer to all of the diverse set of web services emerging that are supported by the Identity Metasystem.