Let’s start with a quick explanation of self-sovereign identity (SSI) for those not already familiar.
Well, as the name would indicate, SSI a philosophy for managing personal data which puts control into the hands of the individual. It has been embraced by standards bodies, such as w3c with Decentralized Identifiers (DIDs) and Verifiable Credentials, and open source projects, such as Hyperledger Indy (a blockchain ledger specifically designed for identity) and Hyperledger Aries (for exchange of credentials). Adoption has been steady over the last few years and we are now at a stage where the technology is catching up with our needs, with a live Indy ledger, The Sovrin Network, administered by The Sovrin Foundation, a non-profit that was founded in 2016 with 70+ stewards at last count.
There is lots that is unique about the Hyperledger implementation of SSI, but I’ll touch on a couple of aspects that make it particularly well suited to the implementation of privacy protecting and ethical data exchange. Firstly, the ledger (Indy) does not contain any personal data, not even hashes of personal data. Secondly, the exchange of credentials is peer-to-peer through an encrypted channel (pairwise DIDs), constrained (e.g. time-bound), minimized through zero-knowledge proofs, with credentials under my control in my digital wallet.
A couple of weeks ago I was reading an Irish Times article by Dr. Karlin Lillington who was talking about the Irish Public Services Card, which by all accounts has been a complete nightmare for the Irish government. This problem of data collection is not unique, and highlights a more systemic challenge for corporations and governments across the globe, one that I happen to believe self-sovereign identity has the potential to resolve, at least in part.
So what is the issue?
Consumers have come to expect convenience above all else, where we expect everything we need to manage our lives to be no more than a click away. However, if we want solutions that are smart, easy to use, provide quick access to what we need, when we need it, then data exchange is a fact of life. The problem is not that organizations need our data in order to deliver these improved user experiences, but rather how they acquire the data, what they do with it, our level of control and (most importantly) visibility. To quote Louis Brandeis, US Supreme Court Justice (1916-1939), “sunlight is the best disinfectant” and the more transparent the data processor, the better for all of us.
So we’ve got these conflicting forces; consumer convenience pushing for more data collection and consumer privacy pushing for less. However, we’ve also got another hurdle for organizations that are trying to implement smart, efficient, data-driven business processes and user experiences. Over the last 30 years, the relational database has led the way in managing data, allowing organizations to consolidate all sorts of customer (or citizen) data for use by business processes. This model has made solutions lazy, addicted to data that they may not actually need, at least not all the time, and tightly tied to this concept of a single consolidated data service with everything they need in one place, and available all the time. Until such time as we upend this world view we are going to continue to see many variations of the Public Services Card debacle across corporations and governments around the world.
We need to challenge business processes and solutions to explore other ways of engaging with personal data, including leveraging data at the edges of the network (my Digital Wallet). We also need corporations to see SSI as an opportunity instead of a hurdle, as I believe it will actually result in increased access to data and greater business efficiencies, just in a way that engages the data subject in the exchange instead of excluding them.
And how does self-sovereign help?
With Self-sovereign Identity a citizen doesn’t need a single identifier, such as a Public Services Card, in order for a government department to have access to the data it needs to deliver it’s service. My data (credentials) sit at the edge of the network in my Digital Wallet; cryptographically verifiable so that it can be trusted, even if its not sitting in a government database. I can choose when to share, with whom, and for how long, for physical or digital interactions. Business processes will still have data requirements which will need to be met, however I now have visibility on what’s being requested and for what purpose. SSI will also drive greater data minimization, as the trust network matures, where use cases could be satisfied with zero-knowledge proofs that tell you a proof is true and not the details of the underlying data.
So if I want to buy a car, which requires getting my drivers license, road tax, and car insurance, I might…
- Go to the NDLS website and start the application process. This would setup the encrypted channel between myself and NDLS, which will show up in my Digital Wallet. NDLS will request proofs to complete the process, such as proof of address. I will present the requested proofs (possibly time-bound), which will be automatically verified on the blockchain (if they are generated by a trusted credential issuer, such as An Post). NDLS will issue me a driving license credential that will show up in my Digital Wallet.
- Then I go to the insurance website, start the process, exchange proofs (such as proof of driving license), … I pay, and they issue me an insurance credential.
- Then I got to the motor tax website, start the process, exchange proofs, … I pay and they issue me a motor tax credential, with a barcode for my car.
This is clearly an over-simplification and there are many more challenges that need to be considered when redesigning business processes around this model of decentralized identity, not the least of all being able to wean organizations off their current data architecture and approaches to personal data. However, SSI shows lots of promise and benefits both individual and organization, in that it facilitates greater flow of data, just in a way that is more secure, controlled, privacy-protecting, and transparent.
On a final note, while SSI isn’t the answer to all the requirements that may have driven the Public Services Card, I do believe that the SSI philosophy can help forge a path forward that meets the sometimes conflicting requirements of consumer privacy, consumer convenience, and process efficiency.
Marie's Ramblings & Ruminations 
Leave a Reply