Identity & Attestation Management

This building block ensures that every participant, whether a legal entity, service provider, or natural person, can be uniquely identified, verified, and trusted across data ecosystems. It provides the foundation for a secure and interoperable identity and attestation management by enabling identities and credentials to be issued, stored, exchanged, and verified in a consistent and secure way. This supports the onboarding, secure interactions, authorisation, and accountability within the data space.

The data space can follow iSHARE’s principles on digital identity management:

• iSHARE-ID: Each participant is assigned a globally unique identifier, improving interoperability between data spaces and enabling cross-ecosystem recognition. See more here.
• Multiple Identifiers: Participants can be recognised by multiple identifiers (EORI or chamber of commerce numbers), which can be linked to a common identifier, iSHARE ID, supporting portable and verifiable identity across ecosystems. See more here.
• Accredited Identity Providers: Certified Identity Providers issue and manage identities for both legal entities and their human representatives. They act as trust anchors within the ecosystem.
• eIDAS and W3C Compliance: The iSHARE identity model recognises European eIDAS standards and global Verifiable Credential formats to ensure compatibility and legal validity.
• Alternative Onboarding Routes: Service consumers without PKI certificates can now onboard securely using approved alternative verification flows.

Attestations

Attestations are verifiable proofs about an entity, such as its identity, membership, role, certification, or compliance status. In a data space, they help prove not only who or what entity is, but also whether it is allowed to participate and under which conditions.

At a minimum, this can include a data space membership credential, but in iSHARE this is typically reflected through a broader set of claims and attestations, such as data space membership, data space agreement, data space role, framework agreement, framework compliance, framework role, IDP assertions, or X.509 certificates, depending on the use case and trust requirements. See more here.

Using W3C Verifiable Credentials and eIDAS alignment, attestations enable trust from the first interaction and support role-based authorisation, compliance monitoring, and automated onboarding within the Participant Registry.

Implementation in the Data Space

Implementation in the data space typically involves both federation-level trust services and participant-level credential management.

• Trust services are responsible for issuing and verifying Verifiable Credentials and supporting trust or rights delegation,
• Participant-controlled credential stores allow participants to store, manage, present, and exchange credentials securely under their own control.

To ensure interoperability, compatible credential exchange protocols or credential store implementations should be used across the data space.

The Data Space Governance Body

Selects and oversees accredited Identity Providers within the iSHARE governance model. Also, it defines the requirements and governs the process of onboarding of participants into data space.

Identity Providers

Issue, manage, and verify participant identities following the Framework specifications.

Human representatives of organisations

Authenticate via their verified identity credentials.

The Participant Registry

Maintains up-to-date information on all data-space participants—including their assurance level, services, and roles—and manages the processes and criteria for onboarding, updating, reviewing, and confirming their membership, aligned with the Data Space Governance Body.

Credential exchange is an important part of this building block. Depending on the use case, this can be supported through protocols from the OpenID for Verifiable Credentials family, such as OID4VCI for credential issuance and OID4VP for credential presentation, or through other compatible approaches such as DCP. These protocols help participants issue, present, and verify credentials securely while keeping control over what they share and with whom.

With the introduction of iSHARE-ID and DID-based verification, participants can engage across ecosystems with confidence, knowing that every entity they interact with has been verified according to transparent, globally recognised standards.

These enhanced mechanisms create a distributed yet cohesive trust layer, one that supports secure data sharing, smooth onboarding, and scalable governance across interconnected data spaces.

Identity & Attestation Management connects closely with other building blocks:

• Trust Framework: Works with Identity & Attestation Management to establish overall trust and define trusted entities.
• Access & Usage Policies Enforcement: Depends on verified participant identities to control access and usage.
• Participation Management: Relies on identity verification for onboarding, offboarding, and attesting participation.
• Regulatory Compliance: Translates rules into digital mechanisms for validation and verification.

The guiding questions can help in the co-creation process and in defining this building block, so please see the next section.