§ Identity & Security
@dosfi.ai — Unified Secure Identity
A single, cryptographically-hardened identity layer spanning DOSFI.ai, MeshInfer.ai, DOSFI Academy, DOSFI University, mesh-native apps, agents, and enterprise nodes. Not a separate email website — the identity fabric woven into every DOSFI system.
Live · Ecosystem Sync
0Active nodes
0%Cost saved
0msAvg latency
0Tasks done
I.1
Identity architecture overview
Every principal in the DOSFI ecosystem — users, agents, devices, mesh nodes, and enterprise organizations — is rooted in a single DOSFI Identity Service at identity.dosfi.ai. No external identity provider is trusted. No passwords are entered on third-party pages.
| User identity | username@dosfi.ai · issued automatically on account creation |
| Agent identity | homeagent@dosfi.ai, caracAgent@dosfi.ai, financeagent@dosfi.ai, … |
| Enterprise identity | admin@company.dosfi.ai · team@company.dosfi.ai · architects@company.dosfi.ai |
| Node identity | Mesh NodeID bound to UserID and DeviceID via signed certificate |
| Protocol | OAuth 2.0 + OpenID Connect · DOSFI Identity Service as sole authority |
| Login origin | All login screens served exclusively from identity.dosfi.ai |
I.2
Anti-phishing architecture
Phishing is defeated at the protocol level — users never type passwords on any page other than the identity origin, and every authentication token is cryptographically domain-locked.
Domain enforcement
| Valid login origin | identity.dosfi.ai only · all other origins rejected |
| Valid email domain | @dosfi.ai strict match · no subaddressing tricks accepted |
| Signed login tokens | JWT signed with Ed25519 · audience = requesting origin · expires 5 min |
| Deep link binding | All auth-flow links contain HMAC-signed, expiring domain-locked tokens |
| Inbound spoofing | SPF hard-fail · DKIM-signed (RSA-2048 / Ed25519) · DMARC p=reject |
| Outbound mail | All system mail sent via authenticated SMTP relay · TLS enforced · DKIM signed |
Email security records (DNS)
dns
# SPF — only authorized senders may send @dosfi.ai mail
dosfi.ai. TXT "v=spf1 include:amazonses.com ~all"
# DKIM — signing key published at selector._domainkey
selector._domainkey.dosfi.ai. TXT "v=DKIM1; k=ed25519; p=<public_key>"
# DMARC — reject unauthenticated mail, aggregate reports to security@
_dmarc.dosfi.ai. TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@dosfi.ai; adkim=s; aspf=s"No-password external pages policy
Login links in all system emails use signed, single-use tokens. Clicking a link proves domain ownership and session intent — no password is ever requested outside identity.dosfi.ai. Attempts to replicate the login flow from any other origin will fail token validation.
I.3
Cross-platform login protection
| Protocol | OAuth 2.0 Authorization Code + PKCE · OpenID Connect ID token |
| Token binding | Device-bound access tokens (DPoP — RFC 9449) · replay on different device = 401 |
| Session lifetime | Access token: 15 min · Refresh token: 30 days · Rotated on every use |
| High-risk logins | Mesh-native challenge/response added for new device or new region logins |
| Credential replay prevention | DPoP proof required on every API call · bound to device keypair |
| Token storage | Browser: HttpOnly Secure SameSite=Strict cookie · Native: OS Keychain / Keystore |
Mesh-native challenge / response (high-risk logins)
protocol
1. User logs in from new device or unfamiliar region
2. Identity Service issues a signed 256-bit challenge nonce (TTL: 90s)
3. Client signs challenge with device-bound Ed25519 private key (OS Keystore / Keychain / WebCrypto)
4. Identity Service verifies signature against registered device public key
5. On success: issues DPoP-bound access token + registers new DeviceID
6. On failure: event logged to AuditLog · account owner notified · login blockedI.4
Secure provisioning
Every new user automatically receives a username@dosfi.ai identity. The provisioning pipeline binds identity to every system principal at creation time.
| Step 1 | Account created → username@dosfi.ai generated · UserID issued |
| Step 2 | Device registered → DeviceID bound to UserID via signed certificate |
| Step 3 | Mesh node joined → NodeID bound to UserID + DeviceID · Ed25519+Kyber768 node cert issued (24h TTL) |
| Step 4 | MFA enrolled → TOTP or WebAuthn passkey required for high-risk operations |
MFA required operations
| New device linking | WebAuthn passkey or TOTP + device challenge |
| Agent deployment | Identity-signed deployment token · MFA gate before signing |
| Enterprise node access | Hardware-bound MFA (YubiKey / platform authenticator) required |
| API key creation | MFA confirmation required · key scoped to requesting DeviceID |
I.5
MeshInfer.AI identity integration
The DOSFI identity token is the single authorization credential for all MeshInfer.AI operations. Routing permissions, node participation, privacy mode, and inference privileges are all derived from the verified identity and subscription tier.
| Routing permissions | Derived from subscription tier in verified identity token claims |
| Node participation | NodeID must match identity-bound cert · mismatched certs rejected |
| Privacy mode enforcement | Identity token carries privacy policy claim · router enforces before dispatch |
| Inference privileges | Model access scoped to tier (developer/startup/growth/enterprise) via token claim |
| Routing policy signing | All routing policies signed with user identity key · unsigned policies rejected |
| Multi-node inference | Pipeline tokens contain identity-bound signatures for every participating node |
Identity-signed routing decisions
Every routing decision in MeshInfer.AI is countersigned by the requesting identity's key. This means a routing log is cryptographically attributable to a specific UserID → DeviceID → NodeID chain. Unauthorized node access requires forging an Ed25519 signature — computationally infeasible.
I.6
Agent identity security
Agents are first-class identity principals. Each agent has a dedicated @dosfi.ai identity and signs all its outbound communications.
| homeagent@dosfi.ai | Personal assistant agent · scoped to owner UserID |
| caracAgent@dosfi.ai | Autonomous car / routing agent · device-bound identity |
| financeagent@dosfi.ai | Financial analysis agent · audit-logged all operations |
| enterprise-agents@company.dosfi.ai | Org-scoped · enterprise routing policies enforced |
Agent communication security
| Signed messages | Every alert, summary, and inference result signed with agent Ed25519 key |
| Routing | All agent inference routes through MeshInfer.AI with identity verification header |
| Recipient verification | Recipients can verify agent signature offline using published agent pubkey |
| Anomaly detection | Identity Service monitors for unusual agent activity · rate-limits · alerts owner |
| Revocation | Agent identity can be instantly revoked by owner or platform · takes effect in <5s |
I.7
Transport layer security
| Email transport | TLS 1.3 required on all SMTP connections · STARTTLS enforced · no plaintext fallback |
| Email provider | Amazon SES or equivalent (SendGrid / Mailgun) · authenticated relay only |
| Rate limiting | 5 auth emails per hour per address · 100 per day per IP · automatic block on anomaly |
| Anomaly detection | Unusual login-email volume triggers security alert + temporary IP block |
| Link expiry | All magic links expire in 15 min · single-use · revoked on first click |
| SPF/DKIM/DMARC | All outbound mail authenticated · see §I.2 for DNS records |
I.8
DOSFI Academy & University
DOSFI Academy and University use the same @dosfi.ai identity for all academic functions — no separate login system.
| Course access | Identity token claim: enrolled_courses[] · enforced at content gateway |
| Certification exams | Identity-bound exam token · one token per identity per exam · prevents impersonation |
| Architect tiers | Tier claim in identity token · unlocked on exam pass · cryptographically signed certificate |
| App purchases | Purchase bound to UserID · cannot be transferred or replayed on another identity |
| Exam anti-impersonation | Token includes DeviceID + browser fingerprint hash · anomaly = exam invalidated |
I.9
Enterprise identity security
Enterprise organizations get org-scoped identity namespaces under company.dosfi.ai. These map directly to enterprise mesh nodes, routing policies, and agent permissions.
| admin@company.dosfi.ai | Full org admin · can provision sub-identities · hardware MFA required |
| team@company.dosfi.ai | Team member · standard MFA · scoped to org routing policies |
| architects@company.dosfi.ai | Certified DOSFI architects · elevated inference and node privileges |
Enterprise permission mapping
| Enterprise mesh nodes | NodeID scoped to org identity namespace · cross-org routing blocked |
| Routing policies | Policies signed with org admin identity · apply to all org members |
| Agent permissions | Enterprise agents scoped to org · cannot access external org resources |
| Hardware MFA | YubiKey or platform authenticator required for node access · software TOTP insufficient |
| Audit trail | 7-year audit log · every action attributed to specific org identity · exportable |
Org identity provisioning flow
provisioning
1. Enterprise admin authenticates with hardware MFA at identity.dosfi.ai
2. Org namespace company.dosfi.ai provisioned · admin@company.dosfi.ai created
3. Admin invites team members → auto-provisioned @company.dosfi.ai identities
4. Each identity bound to: OrgID → UserID → DeviceID → NodeID chain
5. Enterprise mesh nodes register with org-scoped certs (24h TTL, Ed25519+Kyber768)
6. All routing decisions within org signed by org routing policy key
7. Cross-org requests blocked at router · org boundary is cryptographically enforcedI.10
Identity binding summary
identity-chain
User registers
└─ username@dosfi.ai issued (UserID)
└─ Device linked (DeviceID bound via signed cert)
└─ Mesh node joined (NodeID bound to UserID + DeviceID)
└─ Agent deployed (AgentID signed by UserID)
└─ Enterprise org joined (OrgID namespace scoped)
└─ All principals cryptographically linked · revocable at any layerSingle revocation point
Revoking a UserID cascades instantly through the entire chain: DeviceIDs, NodeIDs, AgentIDs, and org memberships are all invalidated within 5 seconds via the Identity Service revocation broadcast. No orphaned credentials remain active.
What this is not
This is not a standalone email hosting product. @dosfi.ai addresses are identity tokens — they authenticate principals across DOSFI systems. There is no webmail interface, no IMAP/POP3, and no general-purpose inbox. System notifications are outbound-only from authenticated DOSFI services.