Tunnistuss

Tunnistuss is a term used in Estonian information technology to denote the process of identifying and authenticating an entity—such as a user or a device—within a computer system. It covers verifying that an entity is who or what it claims to be and is foundational for access control, auditing, and secure service consumption. In practice, tunnistuss is closely related to but distinct from authorization: authentication proves identity, while authorization determines what actions are allowed.

Common components of tunnistuss include credentials (passwords, passkeys), tokens, smart cards, and biometric data, as well as the infrastructures that manage and verify them, such as identity providers and trust frameworks. Implementations rely on established protocols and standards; widely used are OAuth 2.0, OpenID Connect, SAML, and PKI with X.509 certificates. Multi-factor authentication (MFA) is a key security measure within tunnistuss, combining two or more evidence categories (knowledge, possession, inherence).

Privacy and security considerations are central. Password reuse and phishing risk drive the adoption of MFA and phishing-resistant authentication methods. Organizations aim to minimize collected personal data and comply with privacy regulations, e.g., GDPR in the European Union.

Notable real-world implementations of tunnistuss appear in Estonia’s digital identity ecosystem, where ID cards, Mobile-ID, and Smart-ID support national online services and inter-organizational data exchange via the X-Road framework. The term thus encompasses both the technical mechanisms of identity verification and the governance practices that assure trusted digital interactions.