Security Specification
This document defines security requirements for PTI v1.0 implementations.
Normative language
The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL are to be interpreted as described in RFC 2119.
Security objectives
PTI implementations MUST protect:
- Confidentiality of subject data, credentials, and entitlements.
- Integrity of events, signals, assertions, and lookup outcomes.
- Availability of ingest and lookup services for entitled parties.
- Accountability through tamper-evident audit trails.
- Non-repudiation of producer attestations where contractually required.
Threat model
Assets
| Asset | Sensitivity |
|---|---|
pti_id and identity graph | High |
| Trust events and evidence | High |
| Lookup outcomes and explainability | High |
| API credentials and tokens | Critical |
| Entitlement and consent records | Critical |
| Audit logs | High |
Threat actors
| Actor | Example threats |
|---|---|
| External attacker | Credential theft, injection, enumeration |
| Malicious producer | Poisoned signals, context spoofing, replay |
| Malicious consumer | Over-collection, unauthorized lookup, data exfiltration |
| Insider | Privilege abuse, covert data export |
| Supply chain | Compromised connector, weak third-party verification |
Implementations MUST document residual risk for each deployment profile.
Authentication and authorization
All API endpoints MUST require authenticated callers except explicitly public verification endpoints (e.g., report QR validation).
- Credential requirements are defined in Authentication Model.
- Scope and tenant enforcement are defined in Authorization Model.
Service-to-service calls MUST use mutually authenticated channels or signed service tokens.
Transport security
- All production API traffic MUST use TLS 1.2 or higher.
- TLS endpoints SHOULD support TLS 1.3.
- Certificate validation MUST NOT be disabled in production integrations.
- HTTP MUST NOT be used for credential-bearing requests outside isolated development sandboxes.
Data protection
Encryption at rest
Subject-identifying data, events, evidence, and lookup artifacts MUST be encrypted at rest using industry-standard algorithms (e.g., AES-256). Key management MUST support rotation without service disruption.
Encryption in transit
Inter-service replication and backup streams MUST use encrypted channels equivalent to external API requirements.
Field-level controls
Implementations SHOULD apply field-level encryption or tokenization for highly sensitive attributes (government identifiers, biometrics references, financial account tokens).
Input validation and abuse resistance
| Control | Requirement |
|---|---|
| Schema validation | All ingest payloads MUST be validated against versioned schemas before persistence. |
| Idempotency | Duplicate event submission MUST NOT double-apply signal effects. |
| Rate limiting | Public and partner endpoints MUST enforce per-tenant rate limits. |
| Payload size limits | Implementations MUST reject oversize payloads with standard error codes. |
| Injection defenses | Query and template layers MUST parameterize inputs. |
Cryptographic signing
Where profiles require signed assertions:
- Signing keys MUST be stored in hardware-backed or HSM-equivalent systems for production.
- Signature algorithms SHOULD use Ed25519 or ECDSA P-256 minimum.
- Verifiers MUST validate
kid, algorithm, and expiration before trusting assertions.
Audit logging
Audit logs MUST capture:
- Authentication successes and failures
- Authorization denials
- Event ingest accept/reject decisions
- Lookup requests with
context_id, tier, and subject reference (not necessarily full PII) - Administrative entitlement changes
- Data-subject rights requests and outcomes
Audit records MUST include correlation_id, actor, timestamp, and source IP or service identity. Logs MUST be append-only from application perspective and SHOULD replicate to immutable storage.
Tenant isolation
Multi-tenant deployments MUST enforce logical isolation at:
- Authentication scope
- Database row-level or schema-level partition
- Cache key namespace
- Background job queue segregation
Cross-tenant data access MUST NOT occur except through governed federation profiles.
Incident response
Operators MUST maintain:
- Documented incident classification and escalation paths.
- Credential revocation procedures with maximum 15-minute propagation for compromised keys.
- Breach notification workflows aligned with Privacy Specification.
- Post-incident review capturing root cause and control gaps.
Secure development lifecycle
- Dependencies SHOULD be scanned continuously for known vulnerabilities.
- Production secrets MUST NOT be committed to source control.
- Penetration testing SHOULD occur at least annually for internet-facing deployments.
Compliance mappings
Implementations MAY map controls to ISO 27001, SOC 2, and regional financial/regulatory frameworks. Such mappings are informative and MUST NOT alter normative requirements in this specification.