Identity Trust System

This document defines an *identity trust system*, which is a digital identity authentication system based on a symmetric exchange of authentication messages that does not require federation of authentication domains. The main components are: 1. *Symmetric authentication protocol* - A protocol for the mutual recognition of entities based on a symmetric exchange of authentication messages through the mediation of Identity Providers (IdPs). It builds on and extends the OAuth Authorization Framework RFC6749. 2. *Trustees network* - A IdPs network infrastructure that provides a secure environment for exchanging authentication messages. 3. *Custodian concept* - A special category of IdPs to protect physical identity and personal data. The generic IdP is called "*_trustee_*" and is only responsible for digital authentication, while the special IdP called "*_custodian_*" has the legal right to process the individual's real data and maintain the relationship with the digital identity. The *_custodian_* acts under the direct control of the legal authorities of the individual's country.