Background material – Information Assurance

24th April 202023rd December 2021

Federated vs Self Sovereign Identity

A couple of weeks ago Covid-19 prevented me from flying to Las Vegas for the Know Identity Conference and made me abandon my plan to write a post on what I discovered there.

So, having had a rethink over Easter, I decided to record my perception of the differences between Federated Identity and Self Sovereign Identity and why I think that Federation cannot provide the Internet’s missing identity layer.

Federated identity management (FIM) is a means to enable users to access the systems and applications of multiple organizations using one login credential. Identity federation allows users to maintain login credentials with multiple credential service providers (CSPs) (e.g., email or social media providers) and then choose among them when logging into different online services
NISTIR 8149

To my mind, the principal beneficiaries of federated identity are the business organisation (Identity Provider) not the citizen, through

Increased efficiency and cost savings from not having to manage users’ login information;
Improved risk management through multilateral agreements;
Reduced privacy risks due to limited replication of users’ personal data across the organisation’s infrastructure;
Improved system design criteria based on a defined risk profile that is aligned to the community being served.

But that is not to say that users of federated identity systems do not also derive some benefit, they clearly do:

Improved user convenience and reduction in risk resulting from having fewer sets of usernames & passwords to remember and manage;
Single Sign-On (SSO), enabled by FIM, is an efficient way for employees to access the corporate resources, applications and data they need to do their jobs.
The organisation’s HR department and its associated access control mechanism act as a single source of the truth, preventing users from repeatedly entering personal details when requesting access to shared resources.

The downsides of Federation

But … what about us as Citizens, when we are not at work, when we are managing our online life and when we are using the Internet for our own personal reasons?

To operate effectively FIM needs multilateral and mutual trust between service providers, operating across a clearly identified infrastructure with an understood and consistent risk profile. For example the UK governments Verify solution relied on a common (and crucially) formally assessed risk profile for OFFICIAL information. Once an individual’s identity has been established by the identity providers operating Verify, that identity could be used by the citizen to gain access to various government services, such as benefits, taxes, driving licences, passports etc.

What’s good for the workplace doesn’t necessarily transfer to the wider world…

The Internet does not have the common risk profile and multilateral, mutual trust and governance that Federated Identity Management requires.

But not to worry, that yawning chasm is being filled by GAFAM, the Internet’s Big Five – Google, Apple, Facebook, Amazon and Microsoft!! Each time you come across one of these buttons, you are being offered the opportunity to share your identity with GAFAM.

SSI MEAP v03

So what’s wrong with that, you might ask.

Well lets have a look at the UK Information Commissioner’s 2018 Report to the UK Parliament on their investigation into the use of data analytics in political campaigns. Decide for yourself whether Facebook can be trusted with your identity data.

The ICO –

Found found that between 2007 and 2014, Facebook processed the personal information of users unfairly by allowing application developers access to their information, without sufficiently clear and informed consent, and allowing access even if users had not downloaded the (personality testing) app, but were simply ‘friends’ of people who had. Facebook also failed to keep the personal information secure because it failed to make suitable checks on apps and developers using its platform
Issued Facebook with the maximum monetary penalty of £500,000 available under the 1998 Data protection legislation.
Referred Facebook to the Irish Data Protection Commission regarding their targeting functions and techniques used to monitor individuals’ browsing habits, interactions and behaviour across the internet.
Investigated other organisations linked to Facebook and engaged in buying and selling personal datasets in the UK, so called data brokers, were also subject to substantial monetary penalties.
Concluded that Facebook did not take sufficient steps to prevent apps from collecting data in contravention of data protection law.
Established that the personality test app utilised the Facebook login in order to request permission from the app user to access certain data from their Facebook accounts.
Found that Facebook did not follow up on a request to Cambridge Analytica that personal data from Facebook be deleted

On the basis of evidence produced by the ICO I, for one, don’t trust the the privacy management capabilities of Facebook. I certainly won’t be trusting them with any more of my identity data and I’m disinclined to ask any of the Big 5 to act as arbiter of my identity.

There simply must be a better way of enabling single sign on to all manner of Internet services, including banking, medical records, online shopping, social networking, interaction with government services, holiday bookings, clubs and memberships, email, educational & professional qualifications, investments & mortgages etc… etc…

And there is…

Self Sovereign Identity

A number of leading lights in the SSI community have come together to write the definitive study of Self Sovereign Identity, which was published in May this year. I strongly the book because I believe it is an excellent and comprehensive source for all things SSI, VC and DI. It is essential reading for those interested in this intriguing and fast developing area of new technology.

Preukschat and Reed identify a number of reasons why the Federated Identity Model does NOT provide the missing Internet identity layer:

There isn’t one IDP that works with all sites, services, and apps. So users need accounts with multiple IDPs, and pretty soon they start forgetting which IDP they used with which site, service, or app.
Because they have to serve so many sites, IDPs must have “lowest common denominator” security and privacy policies.
Many users—and many sites—are uncomfortable with having a “man in the middle” of all their relationships, particularly being able to surveil users login activity across multiple sites.
Large IDPs represent some of the biggest honeypots for cybercrime ever created.
IDP accounts are no more portable than separate accounts linked to each website (centralised model); if you leave an IDP like Facebook or Twitter, all those account logins are lost.
Lastly, due the security and privacy concerns, IDPs are not in a position to help users securely share some of their most valuable personal data, e.g., passports, government identifiers, health data, financial data, etc.

The most important difference between SSI and FIM, though, is that SSI is no longer account-based. Instead there is a direct secure peer-to-peer relationship between the two parties i.e. a shared connection. Neither party “controls” the relationship and this is true whether the parties are people, organisations or things.

The key to the security of these connections is the underlying decentralized public key infrastructure (DPKI) that is supported by blockchain technology. Together these enable:

The exchange of public keys directly between any two peers;
The exchange of digital identity credentials (aka verifiable credentials) to provide proof of real world identity; and
The storage of public keys on public blockchains specifically designed for the purpose.

In the centralized and federated identity models, the locus of control is with the issuers and verifiers in the network. In the decentralized self-sovereign identity models, the locus of control shifts to the individual identity owner, who can now interact as a full peer with everyone else.

Preukschat and Reed summarise the differences between the FIM and SSI concepts of operation.

FIM Architecture	The user first contacts the Service Provider, is then redirected to the Identity Provider where he/she logs in, and is then redirected back to the SP providing the latter with the user’s identity attributes that the IdP is willing to release.
SSI Architecture using VCs	There is none of this web-based redirection within a defined “federation”—the user as holder obtains VCs from issuers and uses them independently at any verifier that will accept them.

The FIM architecture places the IdP at the centre of the ecosystem, whereas the SSI/VC architecture places the holder at the centre of the ecosystem.

Fundamentally, the SSI/VC philosophy is that users are paramount and it is only they that can decide who to present their VCs to, whilst the FIM philosophy is that IdPs are paramount and they decide who can receive the user’s identity attributes.

Today’s federated identity management infrastructures give issuers (IdPs) great power because they are at the centre of the ecosystem. SSI/VCs turn this model on its head and place users at the centre.

We started out trying to find a solution to the Internet’s missing identity layer; what we ended up discovering was that to solve those problems we needed a shift in control from the centres of the network—the many “powers that be”—to the edges of the network—where all of us exist and interact as peers.
Preukschat & Reed

9th February 202023rd December 2021

Three dimensions to Digital Identity

In his June 2018 webinar as part of the SSIMeetup group, Danial Hardman presents an interesting take on digital identity, calling it multi-dimensional and manifesting itself in three separate planes along three separate axes – Relationships, Data or attributes and Agents or Proxies.

Agents or Proxies axis

These are the devices, software and services that represent me when I use the Internet, they are effectively acting as my agent or proxy. It is in this category that the proposed digital wallet sits, as it’s purpose is to negotiate identity-related transactions and connections on my behalf. Consider eBay, for example, which represents me to the seller and the seller to me, handling necessary financial transactions to an acceptable level of security; there is no direct connection between the seller and I.

Attributes or Data axis

Facebook, for example, gathers information about its users, which it uses for a number of commercial purposes, some beneficial to the user and some beneficial to Facebook. In the current federated identity model Facebook can act as a trusted identity provider by using my authentication data to allow me to sign on to other sites. On the other hand the Cambridge Analytica scandal shows us that Facebook gathers and uses all sorts of other data relating to us for commercial purposes. They are clearly not impartial or independent intermediaries in these transactions and it is questionable the level of trust we should have in them. One could argue that the true home of a social network should be along the relationships axis.

Relationships axis

We are not allowed to take our relationships with us when we opt to extract our personal data from Facebook and other social network providers and store it elsewhere; we are obliged to close down our account. This renders the extracted data useless for maintaining relationships and reinforces the lock-in to provider services. This situation is much like the early days of online banking when the hassle of moving from one bank to another was out of proportion to the benefits achieved; with Open Banking this is no longer the case.

Who knows what about me?

Currently, this question is impossible to answer. In the future I expect my Personal Online Datastore (POD) and digital wallet to keep track of the personal data that I have chosen to share with those I have established personal or commercial relationships.

When they were breached it took Equifax many weeks to disclose the fact and many more to establish what information had been compromised and even longer for them to get round and notify everyone that their information had been stolen. No one knows where that data is now but some commentators suspect that the proximity of the breach to other major data breaches and the fact that this data has not appeared on the dark web suggest that it has been saved in a huge Chines data lake and is being used to support espionage operations against the West.

Knowing who knows what about me is a critical factor in the maintenance of the privacy and security of personal data.

Which agent or proxy can represent me?

Answering this question is, theoretically, a little simpler that knowing who has my data, in that I have a relationship with my agent or proxy and should be able to control the release of personal data. This may not always be the case as the context of the representation is critical. My solicitor may represent me in court but I wouldn’t expect her to speak on my behalf when arranging a holiday. I would expect my doctor to share relevant medical information with a hospital but I’m a little bit more wary if they are seeking to share the same information with big pharma, without the necessary anonymisation controls in place.

Which agent can share what about me?

I don’t expect eBay to share my credit card details with the seller, I don’t expect commercial organisations to share my phone number and address with partner organisations and I certainly do not want metadata from my social media interactions to be shared with advertisers so that they can personalise the adverts I see online.

Greater granularity, detailed configuration and improved contextual analysis is required to maintain continuous control over the sharing of personal information by agents or proxies on my behalf.

1st February 202023rd December 2021

What is Identity, digital or otherwise?

The quality or condition of being a specified person or thing.Concise Oxford Dictionary, 8th ed, 1990

Something I have …

How identity worked in the pre-computer age.

Few of us growing up in the developed world had any choice in the matter. When I was born my parents were legally required to register my birth for which they received a paper birth certificate; a verified credential which, even today, I am occasionally required to produce.

Since then, like most other people in the UK, I have become an avid collector of verified credentials that either enabled me to claim the benefits to which I was entitled or take on the responsibilities they bestow. Registering with the local doctor allowed my parents and I to use the NHS and the issue of a National Insurance number kick started my contribution towards the cost of the welfare state. In 1975 the Met Police confirmed me in the office of Constable and gave me a warrant card which came with the power of arrest; a really powerful credential that acted as both a proof of identity and authority for me to take certain legal actions. On receiving my first pay cheque I opened a bank account and the cheque book I received was another valuable and frequently used credential. Debit cards, credit cards, driving licence, marriage certificates, mortgage certificates, loan agreements, credit rating, insurance certificates, passport, degree certificate, professional qualifications and memberships all followed over the next 45 years. I still have most of these original documents, locked away in a filing cabinet in my office just in case I need to produce them some day.

Occasionally I need to carry some of these credentials so that they are immediately available for inspection; international travel and hiring a car are impossible without a passport and driving licence respectively. Knowing that I will need to present them I carry them with me, either on my person, or in my wallet.

The issuing process for each of my credentials had a number of common factors – I needed to engage with a third party issuer and both parties understood the nature and reason for the transaction, on each occasion I needed to assert my identity to a standard acceptable by the other party and finally I needed to back up that assertion with acceptable documentary proof.

During those, sometimes lengthy engagements, both parties trusted the physical modes of communication, whether they be phone calls, face to face meetings, snail mail, registered post for valuable items or simply the physical exchange of signed and witnessed documents.

None of these transactions could not have happened as they did without there being a prevailing sense of TRUST between all parties. In the pre-computer era impersonation, fraud, forgery, false accounting, misrepresentation, disguise and scamming were all pretty hard to get away without specialist skills, knowledge and native cunning. Besides these, the likelihood of capture and threat of a custodial sentence deterred all but the most adventurous, or desperate.

These important physical credentials are a necessary, and in some cases legal, manifestation of my identity; they do not alone amount to my identity as a person. They are perhaps best seen as tools to enable and support my interaction with the various authorities that make up the nation state.

Before computers, issuing authorities had a clear, settled and documented step-by-step manual process for dealing with applications, employing the right number of people to make the process work but there was little or no sense of urgency.

The advent of computerisation brought opportunities to cut costs and improve the services delivered but the automation of ‘something I have‘ has not been without difficulties. Early attempts to computerise the credential issuing business led to incompatible systems running bespoke processes with first generation operating systems hosted on expensive mainframes provided by a handful of approved suppliers.

I would argue that it is only now with the introduction of the Internet, Cloud computing, ubiquitous encryption and various cross-industry working groups that the true benefits of a computerised ‘something I have‘ can be realised

Something I know …

With the rapid expansion of the Internet without an identity layer, web organisations were forced to authenticate users by the only means available to them at the time – username and password. This method of authentication is now the norm but it is a paradigm that has been completely undermined by our inability to manage these credentials securely in the real world. Don’t just take my word for it, look at the guidance produced by the UK’s National Cyber Crime Centre and the writings of Bruce Schneier on the subject.

To address the failings of username and password authentication we are now being forced down the route of the multi-factor authentication. MFA comes under the category of ‘something I know‘ because for a few seconds I need to know a one time passcode sent to me by an out of band channel (usually SMS) before entering it into the browser. This deeply inconvenient and time consuming authentication method treats only the symptoms of the identity-free Internet, not the causes of it.

There are other attributes of my identity that come under the heading of ‘something I know’. I know the dates that are important to me, my favourite teacher and I also know the answer to the ubiquitous mother’s maiden name question. The most significant problem with using these attributes to authenticate my digital identity is that its entirely possible that with a little bit of research a diligent social engineer may be able to discover all of this information and use it to impersonate me.

Something I am …

Should I die without identification on me and without my mobile phone the police have a number of biometric methods available to them to identify me – fingerprints, DNA and dental records are the most commonly used. In my case, I had my dabs taken when I joined the police service and have also recently had some very expensive dental treatment; these are clearly verified credentials that uniquely identify me.

The fundamental concept underpinning the Who.Me? experiment is the conclusion arrived at by Sariyar & Schlunder in their 2016 paper:

Identification of an individual (based on digital data) means to know a globally unique natural identifier (allowing a singling out), which can be a combination of attributes and to associate them with a set of attributes. Both together allow a singling out and the recognition of the individual. The genome and fingerprints are unique identifiers, and they can stand for the individual, but they are not sufficient to identify an individual without further reference information. In general, there is no fixed set of (reference) information that is always sufficient for identificationSariyar M, Schlünder I. Reconsidering Anonymization-Related Concepts and the Term 'Identification' Against the Backdrop of the European Legal Framework. Biopreserv Biobank. 2016;14(5):367–374. doi:10.1089/bio.2015.0100

The Who.Me? experiment will demonstrate whether it is possible for me, as a standard Internet user, to collect, collate and control my own personal data when using the Internet. As I plan to use my own unique natural identifiers to underpin my digital identity there are a number of key factors I need to take into account:

Information storage – How secure is the Personal Online Datastore (POD) in which I will store my biometric data? How will the POD integrate with my digital wallet so that these verified credentials can be made available securely?
Information exposure – What information is appended to the ledger and how do I ensure that my biometric data is not exposed?
Proportionality – What control do I have over my data being released, how can I ensure only the correct and appropriate information is disclosed?
Information format – What is the format of these biometric files and how can a limited and constrained amount of information be released?

16th January 202026th November 2021

Who’s setting the standards?

The World Wide Web Consortium is an international community where Member organizations, a full-time staff, and the public work together to develop Web standards. Led by Web inventor and Director Tim Berners-Lee and CEO Jeffrey Jaffe, W3C’s mission is to lead the Web to its full potential.

The FIDO Alliance is an open industry association with a focused mission: authentication standards to help reduce the world’s over-reliance on passwords. It is working to change the nature of authentication with open standards that are more secure than passwords and SMS OTPs, simpler for consumers to use, and easier for service providers to deploy and manage.

Arising out of the UN’s Sustainable Development Goal (SDG 16.9) that recognises legal identity as a fundamental human right, the ID2020 Alliance is a global public-private partnership with a manifesto to improve lives and accelerate access to digital ID by underserved and vulnerable populations. It is a multi-stakeholder collaboration that advocates the adoption of ethically-grounded digital ID solutions, the definition of individual-centred functional requirements and funds projects to deploy promising solutions.

Formed in 2010, OIX is a technology agnostic, non-profit trade organisation of leaders from competing business sectors focused on building the volume and velocity of trusted transactions online. OIX’s mission is twofold: a) to be the leading industry body driving the digital identity industry; and b) to be a centre of excellence that aligns to open, interoperable standards across the UK and Europe. The organisation operates the OIXnet trust registry, a global, authoritative registry of business, legal and technical requirements needed to ensure market adoption and global interoperability.

Established 2016 as an independent non-profit organization the Sovrin Foundation administers the Sovrin Network, an open source, public service utility based on distributed ledger technology (blockchain) that enables self-sovereign identity on the internet. Charged with administering the publicly created Governance Framework for the Sovrin Network, the Foundation is responsible for ensuring the Sovrin identity system is public and globally accessible and is committed to transparency and neutrality.

Created in March 2019 by the Sovrin Foundation, the Sovrin Alliance is a community of developers, enterprises, business and government leaders, NGOs, Sovrin Foundation staff, and volunteers that ensures the future of self-sovereign identity.

DIF is an engineering-driven organisation focused on developing the foundational elements necessary to establish an open ecosystem for decentralised identity and ensure interoperation between all participants. DIF Working Groups develop specifications and emerging standards for protocols, components, and data formats that inform development. Beyond specifications, DIF members develop open source reference implementations of the technical components and protocols they create and work to align industry participants to advance common interests.

Headquartered in Brussels, EEMA is a leading independent, not for profit, European Think Tank including topics on identification, authentication, privacy, risk management, cyber security, the Internet of Things, Artificial Intelligence and mobile applications. EEMA is a strong supporter of the European Electronic Identification, Authentication and Trust Services , eIDAS and the Go.eIDAS initiative.

In May 2016 the UK Government’s Digital Service launched GOV.UK Verify, an identity assurance scheme intended to provide a single trusted login across all Government Digital Services, verifying the user’s identity in 15 minutes. Although take-up by UK citizens has not been as swift as originally projected there are currently almost 5 million people who have signed up to the service. Five Identity Providers (also called ‘certified companies’) are contracted to verify an individual’s identity by reference to existing government issued credentials e.g. driving licence and passport. The UK’s newly appointed Director of Digital Identity, Lisa Barrett stated in a recent blog that “Digital identity is a vital issue not only for government transformation – as has often been our focus – but also for users who benefit from a safe, effective and functioning digital economy underpinned by strong digital identity solutions.“

NIST has produced a range of Special Publications (SP) on Digital Identity:

SP800-63-3 -Digital Identity Guidelines
SP800-63A – Enrolment and Identity Proofing
SP800-63B – Authentication and Lifecycle Management
SP800-63C – Federation and Assertions

SP800-63 contains a useful overarching diagram that describes the Digital Identity Model:

In October 2018 NIST produced an excellent Technology Overview document on Blockchain, concluding that the technology is still new and organisations should treat blockchain technology like they would any other technological solution at their disposal–use it only in appropriate situations

Social Linked Data (Solid) is the technology that underpins a movement led by Sir Tim Berners-Lee to re-orient the web to its original vision of a collaborative/re-writeable/editable web. The removal of editing capability in original browsers spawned an effort to get the write functionality back; dubbed the ‘read-write web’ this effort led to Richard McManus’ seminal article published in 2003.

The issue with writing data, as Wikipedia and others have learned, is that there needs to be a degree of control over who can write what so a process of obtaining and using permissions is needed. To enable these permissions there needs to be a system for identity – a way of uniquely confirming that an individual is who they purport to be; hence Solid’s relevance to the subject of digital identity.

Solid also provides a Personal Online Datastore (POD) within which an individual’s personal data can be stored and managed, and from which can be shared with approved partners.

OWI is a market intelligence and strategy firm focused on digital identity, trust, and the data economy. Through advisory services, events, and research, OWI helps a wide range of public and privately held companies, investors, and governments stay ahead of market trends, so they can build sustainable, forward-looking products and strategies. Since 2017 OWI has been the official host of the KNOW Identity Conference and KNOW Forums.

RAND Europe was commissioned by the British Standards Institution (BSI) in January 2017 to carry out a rapid scoping study to examine the potential role of standards in supporting Distributed Ledger Technologies (DLT)/Blockchain. The resulting report, entitled Distributed Ledger Technologies/Blockchain: Challenges, opportunities and the prospects for standards serves as an overview of the 6-week study and concludes that there is scope for standards to play a role in supporting the technology.

ISO has produced a terminology document for DLT as a first of a range of standards documents that are currently under development.

Hyperledger Indy provides tools, libraries, and reusable components for providing digital identities rooted on blockchains or other distributed ledgers so that they are interoperable across administrative domains, applications, and any other silo. Indy is interoperable with other blockchains or can be used standalone powering the decentralisation of identity.

Hyperledger Aries provides a shared, reusable, interoperable tool kit designed for initiatives and solutions focused on creating, transmitting and storing verifiable digital credentials. It is infrastructure for blockchain-rooted, peer-to-peer interactions. This project consumes the cryptographic support provided by Hyperledger Ursa, to provide secure secret management and decentralised key management functionality.

14th January 202026th November 2021

Now let’s define a few terms…

Claims: According to the Sovrin Foundation Glossary v3 a claim is an assertion about an Attribute of a Subject. Examples of a Claim include date of birth, height, government ID number, or postal address—all of which are possible Attributes of an Individual.
Credentials: A Credential is comprised of a set of Claims and is a digital assertion made by an Entity about itself or another Entity. Credentials are a subset of Identity Data and must be based on a Credential Definition. Examples of Credentials include college transcripts, driver licenses, health insurance cards, and building permits.
Credential – Agent: Once issued, a Credential is typically stored by an Agent.
Credential – Holder: The Entity holding the issued Credential.
Credential – Issuer: The Entity creating and issuing the Credential.
Credential – Relying Party: The Entity to whom a Credential is presented.
Credential – Subject: The Entity described by the Claims is called the Subject of the Credential.
Credential – Verifier
: The Entity to whom a Credential is presented for verification.
De-centralized Key Management System (DKMS): Public key infrastructure based on decentralized identifiers and identity records (for example, DID documents) containing verifiable public key descriptions.
Digital Identity: According to Wikipedia digital identity is information on an entity used by computer systems to represent an external agent. That agent may be a person, organisation, application, or device. ISO/IEC 24760-1 defines identity as “set of attributes related to an entity”.
Digital Wallet: A software module, and optionally an associated hardware module, for securely storing and accessing Private Keys, Link Secrets, other sensitive cryptographic key material, and other Private Data used by an Entity. A Wallet [Wallet Storage] is accessed by an Agent. In Sovrin infrastructure, Wallets [Wallet Storage] implement the emerging DKMS standards for interoperable decentralised cryptographic key management. Darrell O’Donnell’s 2019 paper entitled The Current and Future State of Digital Wallets provides a guide to help understand where the Digital Wallet market is and where it is heading for business and personal use.
Distributed Ledger Technology (DLT) or Blockchain: A distributed database in which the various nodes use a consensus protocol to maintain a shared ledger in which each transaction is cryptographically signed and chained to the previous transaction.
Personal (Online) Data Store (POD): A personal data store, vault or data locker is a service that lets an individual store, manage and deploy their personal data in a highly secure and structured way. PODs are like secure USB sticks for the Web that can be accessed from anywhere. When others are given access to parts of the POD, they can react to the the content but the data owner decides which things can be accessed by applications and people. A Personal Data Store is NOT a Digital Wallet, it is more like a personal, domestic filing cabinet that stores persoanl data. Solid and Mydex are just two examples of personal data stores.
Self-sovereign Identity (SSI): Lifetime portable identity for any person, organisation, or thing that does not depend on any centralised authority and cannot be taken away. Also describes the digital movement that recognises an individual should own and control their identity without the intervening administrative authorities. Christopher Allen’s excellent post from 2016 provides another useful overview of the subject.
Trust Framework: A generic term often used to describe a legally enforceable set of specifications, rules, and agreements that govern a multi-party system established for a common purpose, designed for conducting specific types of transactions among a community of participants, and bound by a common set of requirements.
Web of Trust: Phil Zimmerman originated the phrase “Web of Trust” in PGP 2.0 (1992), however, his ‘Web’ had a very limited meaning, focused on peer validation of public keys.
Verifiable Credentials: A digital attestation of one Identity Owner about another, also called Attestations or Claims.
WebID: A way to uniquely identify a person, company, organisation, or other agent using a URI, defined by the W3C WebID 1.0 specification.
WebID-TLS: Enables secure, efficient and maximally user friendly authentication on the Web by authentication onto any site by simply choosing one of the certificates proposed to them by their browser. These certificates can be created by any Web Site for their users.

As a good primer on the subject I highly recommend Sovrin’s White Paper entitled “Sovrin: A Protocol and Token for Self-Sovereign Identity and Decentralised Trust“.

13th January 202026th November 2021

Background & Use Cases …

Just Imagine ...

The vast amount of Personal Data that is currently obtained processed, stored, managed, retained and eventually deleted under our existing centralised model in which personal data is inextricably linked to the application that uses it.

Just Imagine ...

The service improvements, the improved efficiencies, the reduction in fraud potential, the enhanced customer relationships, the cost savings, design improvements and reduction in compliance overhead that could be achieved by the widespread introduction of decentralised identities and the personal management of personal data.

In February 2019 TechUK issued a white paper entitled ‘The Case for Digital IDs‘, which made a number of recommendations to the UK Government, the most important of which being:

the UK Government to facilitate the creation of a fully functioning digital identity ecosystem, which operates across public and private sectors

The white paper includes a list of potential Use Cases for Digital Identities and several of these are described in this post.

Recognising the importance of the subject in July 2019 the Department for Culture Media & Sport issued a Digital Identity: A Call for Evidence, confirming that

We are committed to enabling a digital identity system fit for the UK’s growing digital economy without the need for identity cards by working in partnership across government, the private and voluntary sectors, academia, and civil society.Quote

Potential Use Cases

Digital birth certificates: How about issuing new born babies with a Digital Identity as their very first verifiable credential; one that they could use throughout their life. Issuing at birth would be a great first step in safeguarding youngsters online but issuing to school age children would be a game-changer in restricting access to harmful content.
DBS or criminal record checks: Non-standardised application process across the UK introduces inefficiency,is poor for labour mobility and requires the processing of a considerable amount of personal data in multiple centres.
ID checks at bars, nightclubs & public places: Controlled access to identity verification data via a mobile device limits the exposure of personal data to that which is appropriate to meet the check being carried out e.g. club doorman verifying an individual as being 18+ or a police officer requiring a date of birth and current address.
Right to rent checks: A landlord or letting agent is legally obliged to see original acceptable docs, review prospective tenants face-to-face and make copies of documentation. This is expensive and inefficient for all parties, and carries significant data protection risks. From a consumer standpoint it would be preferable to be able to transfer reference checks to different landlords and letting agents.
Age verification for access to age restricted online content: Support certification against PAS1296:2018 for online age checking presents a model for age verification for age-verified goods and services.
Voter registration, polling and e-voting: Digital identity and one-to-one facial recognition software can be used as a means of citizen verification for voter registration, identification at polling stations, remote e-voting and polling.
Qualification screening checks: Verify that a huge range of regulated professionals, such as doctors, dentists, accountants, security consultants, architects etc have the qualifications and specialisms that they purport to have.
Licensing checks: To work in the UK private security industry an individual must be licensed by the Security Industry Authority, a lengthy process that requires the sharing of copious amounts of personal data.
Proof of address for utility bills and banking: By providing a customer with an attribute stating that they have been a customer for a certain period of time a bank or utility company could dispense with existing slow, inconvenient and potentially fraudulent manual processes.

12th January 202023rd December 2021

Personal Digital Identity, where to begin?

Lets’ start with a good old fashioned Problem Statement:

The problem of –: being required to share multiple items of personal information as a pre-condition to being granted access to resources on a website
Affects –: my ability to manage and maintain control over my personal information;
The impact of which is –: that I no longer know who has my information, what they are doing with it and how securely it is being maintained.
An ideal solution would be …: A system whereby my personal information is securely stored and decoupled from their application. This would enable me to take back control of my personal information by managing when and how third parties are able to view and use my personal information.

Now, I’ve got that off my chest, let’s have a look at an important piece of background material on the subject.

In 2005 Kim Cameron, Architect of Identity at Microsoft wrote The Laws of Identity‘, a blog in which he produced a problem statement, far more succinct than mine – “The Internet was built without a way to know who and what you are connecting to.”

Cameron argues that it’s hard to introduce an identity layer into the Internet because there is no agreement on what digital identity should be or how it should be run. This comes about because digital identity is related to context and each one of the billions of Internet users has many hundreds of reasons, or contexts, for using the Internet.

According to Cameron, the emergence of a single simplistic digital identity solution as a universal panacea is not realistic, what is needed is a unifying identity metasystem that can protect applications from the internal complexities of specific implementations and allow digital identity to become loosely coupled.

Cameron proposes 7 laws of identity:

User Control & Consent – technical identity systems must only reveal information identifying a user with the user’s consent.
Minimal disclosure for a constrained use – the solution which discloses the least amount of identifying information and best limits its use is the most stable long term solution.
Justifiable parties – digital identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.
Directed identity – a universal identity system must support both “omni-directional” identifiers for use by public entities and “unidirectional” identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles.
Pluralism of Operators & Technologies – a universal identity system must channel and enable the inter-working of multiple identity technologies run by multiple identity providers.
Human integration – the universal identity metasystem must define the human user to be a component of the distributed system integrated through unambiguous human-machine communication mechanisms offering protection against identity attacks.
Consistent experience across contexts – the unifying identity metasystem must guarantee its users a simple, consistent experience while enabling separation of contexts through multiple operators and technologies.