Abstract: An identification and authentication system for secure data exchange over a communications network with a controlled name space, the system having a digital credential generation authority, a credential revocation service, multiple computers, each having: an engine for communicating over the communications network; and at least one application communicating with the engine; at least one domain controller having: an engine for communicating over the communications network; an address resolution service to store network addresses of applications; a key distribution service for distributing keys to engines within the communications network; and a time synchronization module for synchronizing time on engines wherein each of the computers receives a credential for one domain controller authorizing each of the computers to communicate in the system, and each computer further communicates with one domain controller to obtain keys for secure data exchange between applications on the system and the location of applica