PROMINENT BLOCKCHAIN APPLICATIONS ARE:

 

Secure sharing of medical data

NFT marketplaces

Music royalties tracking

Cross-border payments

Real-time IoT operating systems

Personal identity security

Anti-money laundering tracking system

Supply chain and logistics monitoring

Voting mechanism

Advertising insights

Original content creation

Cryptocurrency exchange

Real estate processing platform

What is Identity Management?

Back To Home

 

·      Also known as “identity and access management”, or IAM, identity management includes all the processes and technologies within an organisation that are used to identify, authenticate and authorize someone to access services or systems in that said organisation or other associated ones.

·      Examples of this would range from customers and/or employees accessing software or hardware inside a company/enterprise – and the level of access, privileges, and restrictions each user has while doing so – or, in a governmental setting, the issuing and verification of birth certificates, national id cards, passports or driver’s licenses (that allow a user/citizen to not only prove his identity but also access services from the government and other organisations).

 

The problem with current Identity Management Systems

 

·      Identity has a problem. If it is paper-based, such as birth certificates sitting idly in a basement of a town hall, it’s subject to loss, theft of fraud.

·      A digital identity reduces the level of paperwork and increases the speed of processes within organisations by allowing for a greater interoperability between departments and other institutions. But if this digital identity is stored on a centralised server, it becomes a target for hackers.

·         Since 2017 alone, more than 600 million personal details – such as addresses or credit card numbers – have been hacked, leaked or breached from organisations.

 

Most of the current identity management systems are weak and outdated.

 

Identities need to be portable and verifiable everywhere, any time, and digitization can enable that. But being digital is not enough. Identities also need to be private and secure.

Several industries suffer the problems of current identity management systems:

• Government: The lack of interoperability between departments and government levels takes a toll in the form of excess bureaucracy. Which, in turn, increases processes’ times and costs.

• Healthcare: half of the world’s population does not have access to quality healthcare. The lack of interoperability between actors in the healthcare space (Hospitals, clinics, insurance companies, doctors, pharmacies, etc) leads to inefficient healthcare and delayed care and frustration for patients.

• Education: It is estimated that two hundred thousand fake academic certificates are sold each year in the USA alone. The difficulty in verifying the authenticity of these credentials leads to hiring of unqualified professionals, brand damage to the universities and the hiring companies.

• Banking: the need for login details such as passwords decreases the security of banking for users. 

• Businesses in general: the current need to store clients’ and employees’ personal data is a source of liability for companies. A personal data violation may result in huge fines due to GDPR infringement – such as the British Airways case – or simply due to customer trust loss and consequential damage to the organisation’s brand.

 

Cryptography in Identity Management

 

·      Whenever we need to prove something about our identity – either our name, address or passport number – there is a process of authentication.

·      A verifying entity confirms that the data we are claiming about ourselves is true or false. This is usually done through the verification of our identifying documents.

·      These identity verification and authentication processes make privacy concerns arise.

·      Should a verifying entity requesting me to prove my name with my passport have access to the remaining information contained in my document while they are looking at it to verify that information?

·      Does an entity that request a proof of my age need to know the day and month I was born?

 

A blockchain identity management system that uses Zero-Knowledge Proofs

·      A Zero-Knowledge Proof is a method of authentication that, through the use of cryptography, allows one entity to prove to another entity that they know a certain information or meet a certain requirement without having to disclose any of the actual information that supports that proof.

·      The entity that verifies the proof has thus “zero knowledge” about the information supporting the proof but is “convinced” of its validity. This is especially useful when and where the prover entity does not trust the verifying entity but still has to prove to them that he knows a specific information.

·      In an identity management with blockchain scenario, this allows a person to prove that their personal details fulfil certain requirements without disclosing the actual details.

·      For example, one could prove that she is over 21, without showing her exact date of birth.

 

A Blockchain based Identity Management Solution

In identity management, a distributed ledger (a “blockchain”) enables everyone in the network to have the same source of truth about which credentials are valid and who attested to the validity of the data inside the credential, without revealing the actual data.

 

The 3 actors in Identity Management with Blockchain:

1. Owners,

2. issuers and

3. verifiers

 

·      When talking about leveraging blockchain technology for identity management, it is important to note that there are three different actors in play:

identity owners,

identity issuers and

identity verifiers.

·      The identity issuer, a trusted party such as local government, can issue personal credentials for an identity owner (the user).

·      By issuing a credential, the identity issuer attests to the validity of the personal data in that credential (e.g. last name and date of birth).

·      The identity owner can store those credentials in their personal identity wallet and use them later to prove statements about his or her identity to a third party (the verifier).

·      A Credential is a set of multiple identity attributes and an identity attribute is a piece of information about an identity (a name, an age, a date of birth). 

·         Credentials are issued by second parties whom attest to the validity of the data inside the credential. The usefulness and reliability of a credential fully depends on the reputation / trustworthiness of the issuer.

 

How Blockchain brings privacy and security to Identity Management

·      Through the infrastructure of a blockchain, the verifying parties do not need to check the validity of the actual data in the provided proof but can rather use the blockchain to check the validity of the attestation and attesting party (such as the government) from which they can determine whether to validate the proof.

·      For example, when an identity owner presents a proof of their date-of-birth, rather than actually checking the truth of the date of birth itself, the verifying party will validate the government’s signature who issued and attested to this credential to then decide whether he trusts the government’s assessment about the accuracy of the data.

·      Hence, the validation of a proof is based on the verifier’s judgement of the reliability of the attestor.

·      Leveraging blockchain technology, like Tykn’s digital identity management system does, establishes trust between the parties and guarantees the authenticity of the data and attestations, without actually storing any personal data on the blockchain.

·      This is crucial as a distributed ledger is immutable, meaning anything that is put on the ledger can never be altered nor deleted, and thus no personal data should ever be put on the ledger.

 

Blockchain Identity Management Red Flag: Does personal data go on a Blockchain?

 

1. Putting personal data on the ledger puts the privacy of the users in danger (as it will constantly be subject to hacking and data breaches). It could always be hacked (if not now, probably at some point in the future)

2. It violates current privacy regulation (e.g. GDPR; right to be forgotten);

3. it is also not efficient as an identity is dynamic (attributes can change over time e.g. house address or number of children).

 

When working in digital identity and identity management with blockchain, it’s extremely important to always keep in mind that:

 

No personal data should ever be put on a blockchain.

When using a Blockchain Identity Management system what exactly goes on the Blockchain?

 

Only references and the associated attestation of a user’s verified credential are put on the ledger.

 

Privacy can be ensured through non-correlation principles via pseudonymisation. So, instead of storing actual private information, the only things stored on the ledger (for the purpose of verification) are:

 

1. Public Decentralised Identifiers (Public DIDs) and associated DID Descriptor Objects (DDOs) with verification keys and endpoints. 

o    DIDs are a new type of unique identifiers for verifying digital identities, and are entirely controlled by the identity owner. DIDs are independent of centralised registries, authorities or identity providers.

2. Schemas. 

o    The formal description for the structure of a credential.

3. Credential definitions. 

o    The different (often tangible) proofs of identity or qualification issued by authorities; such as drivers licenses, passports, identification cards, credit cards, etc. Hence, credential definitions are — as the name suggests — merely the definitions of these different credentials to be stored on the ledger.

4. Revocation registries. 

o    An option for issuers to be able to revoke the claim. The revocation registry is what tells the rest of the world how the issuer will publish the revocation information.

5. Proofs of consent for data sharing. 

o    In order to prove consent or reception of data (basically saying the data has been received and checks have been executed on it), these consent receipts (i.e. proofs of consent) let people do so.

 

Decentralized Identifiers:

The next big thing in Identity Management with Blockchain.

 

·      DIDs are a new type of unique identifiers for verifying digital identities, and are entirely controlled by the identity owner. DIDs are independent of centralised registries, authorities or identity providers.

·      According to Phil Windley, Chairman at Sovrin, DIDs should have the following properties:

·      Decentralized identifiers should be non-reassignable. They should be permanent. Other identifiers, such as IP address or email address, can be reassigned to other entities by whomever is in control. This reduces privacy and security.

·      Decentralized identifiers should be resolvable. Each DID resolves to a DID Document that states the “public keys, authentication protocols, and service endpoints necessary to initiate trustworthy interactions with the identified entity” (source). Through the DID Document, an entity should understand how to use that DID.

·      Decentralized identifiers should be cryptographically verifiable. Through the use of cryptographic keys, a DID owner can prove their ownership of the DID. The public key contained in the DID Document can also be used to attest to the authenticity of the issuing authority’s signature associated with a credential.

·      Decentralized identifiers should be decentralized. Current identity management systems rely on centralized registries. Each of these registries ensures trust. DIDs do not depend on a central authority. Distributed ledger technology ensures trust as it allows everyone to have the same source of truth about the data in the credentials.

What if I need to change something?

Revocation (Cancellation) in Blockchain Identity Management.

·       Next to checking the attesting party, verification of a credential also includes checking the validity of the attestation itself. The validity of the attestation, meaning the accuracy and can be validated through a so called revocation registry.

·       The registry contains the status of each credential, whether it has been revoked (deleted or updated) and hence whether this specific credential is still valid.

·       In other words, the ledger enables everyone in the network to have the same source of truth about which credentials are still valid and who attested to the validity of the data inside the credential, without revealing the actual data.

The scenario

>“This is my drivers licence”

>> “Says who?”

>“Says them”

>> “Who are they and do I know I can trust them?”

+

>> “Do they still agree/attest to this or have they changed their judgement?”

>“Yes they have not revoked their attestation up to now”

·       Revocation means deleting or updating a credential. The possibility for an issuer to revoke a credential is crucial to an identity infrastructure for the main reason that identities are dynamic.

·       Attributes can change over time e.g. house address or number of children, and some credentials should have a expiry date for example a passport or drivers licence. The fact is, however, that in order to ensure trustworthiness of the system and eliminate the possibility to defraud, credentials are immutable.

·       After issuing, no one (not even the issuer) can change the information inside the credential. Hence, when attributes change, a new credential needs to be issued and the old one needs to be announced invalid. Thus, at each proof the users needs to proof that the credentials used in the proof are still valid. The revocation registry allows him to prove this without contacting the issuing party.

 

How to prevent identity fraud and identity theft if I am doing Identity Management with Blockchain

·       Through identity management with blockchain technology, each user stores their digital identity credentials on a digital identity wallet on his devices (like his mobile phone). Which begs the question: what if his phone is lost or stolen?

·       According to Sovrin, there are two steps to be taken.

·       The first one is to revoke the device’s authorization to use credentials. Digital Identity credentials are only valid if used from a device that was authorized to do so. If a user’s phone is lost or stolen, that user could use another authorized device, like his laptop, to write on the blockchain that his mobile phone’s authorization is now revoked. 

·       This would take immediate effect and stop anyone from using the digital identity credentials on the phone. The thief would not be able to impersonate the user even if he has her passwords, biometrics or phone because the blockchain, immutable and secure, would contain a revocation registry for the phone.

·       Revocation of the device’s authorization impedes the thief to impersonate the user to create new relationships. The second step impedes the thief to explore the existing relationships between the device and other people or organisations. The second step thus is to revoke the existing relationship keys (pairwise connections where each of them has a unique key).

·       These two steps stop an identity thief to use digital identity credentials to access new services or explore relationships with existing ones. While conveniently letting the user still use his credentials on another device.

·       In many current cases, if users wished to cancel a stolen identity card, they would have to physically go to the municipality or governmental department, cancel that card and make a new one from scratch. Which would take time and still would not impede an identity thief from using your data. In the case of a stolen credit card, users will call the bank (which still takes considerable time) and won’t be able to use the card until a new one is issued and sent to him.

·       Sovrin have published a pdf with a thorough explanation on the technical aspects of device loss of theft that we recommend.