“Who am I?” is an age-old philosophical question, but in the modern information economy it has become a deeply practical one as well. Proving that you are who you say you are is far from straightforward, and the cobbled-together system of third parties holding your private data has some serious issues with efficiency and security. This has made identity management a big target for a blockchain-as-a-service redesign.
Unlike many similar projects, though, blockchain-for-identity is already happening. SecureKey, one of IBM’s partnered identity projects, has already put seven million Canadian banking customers on its blockchain. Its other partner project, Evernym’s Sovrin, is also advancing rapidly. Meanwhile, Microsoft has teamed up with Hyperledger to work on the ID2020 initiative, and uPort is giving identities to a city in Switzerland. Though these and the dozens of other projects in the space have different approaches, they all agree on the basic problem.
The Problem: Siloed Identities
Under the current system, our online identities are “siloed.” Creating a new account is essentially a process of uploading your information to yet another server where you may or may not have some say in what happens to it. Remembering usernames and passwords has gotten easier with “federated” logins from third-party providers like Facebook and Google, but this essentially just makes their siloes even bigger.
Financial services companies in the U.S are mandated by law to implement KYC/AML (Know Your Customer/Anti Money Laundering), which necessitates that they do some research on their customers. Other industries have their own interest in checking up on your claims about certain things as well, and while this is obviously not great for your privacy, it’s not great for them either. Especially in banking, the methods tend to be non-standardized, expensive, and questionably accurate. The best many of them can really do is to locate a silo with your data in it, get access, and copy your information over to their siloes for analysis and storage.
With this many siloes/honeypots of sensitive data sitting around, created both by users directly and by companies indirectly, it’s perhaps unsurprising that 1.1 billion identities worldwide were stolen in 2016. It’s a lot more effective to grab a million credit card numbers at a time than to go after one person’s information.
Cyber Incidents in 2016, Image from Symantec Report
As bad as having to rent your proofs of identity from vulnerable third parties is, yet another 1.1 billion people worldwide have trouble accessing government and financial infrastructure due to lack of identity. While developing nations and refugees have the highest rates of identification issues, millions of people in the U.S also lack government-issued ID.
So, with dozens of leaky siloes, questionable security, and little to no user control over what happens to our identities, what options are there to overhaul this system? It turns out that if you want to do more than patch a few holes, blockchains may be the only practical option.
The Solution: Self-Sovereign Identity
One term that pretty much every blockchain-for-identity startup has adopted is “self-sovereign identity.” A self-sovereign user has complete control over a secure, portable, universally trusted proof that they are who they say. If someone wants to add a piece of information (like a credential or a record) to your identity or access something about you, they should only be able to do so with your explicit consent. Ideally, the same identity would be valid across multiple systems, from your bank to your Steam login.
Multiple Digital Identities, Image from Djuri Baars
Here’s the problem: we’re not exactly reliable witnesses about our own character. If it was up to us, all of our identities would have suspiciously good credit and Ivy League educations. So how do we reconcile the need for third-party confirmation of our identity with the ideals of self-sovereignty?
The big-picture solution: replace the siloes with a blockchain that is publically accessible but individually confidential. Blockchains are public and immutable, and thus can be trusted to keep accurate records that are traceable to the authorities (licensing agency, university, etc.) that issued them. To keep your actual data safe, though, the blockchain only stores proofs—cryptographic hashes that can verify claims about you without giving out any actual names or numbers. You’ll still have access to those names and numbers, and can give them out as necessary, though. Not only does this keep your information more secure, but it makes checking up on you a much less expensive and invasive process—which is probably why some of the pioneering entities in this field are banks.
How Does it Work?
One of the biggest players in this space, Sovrin (as in “self-sovereign”), envisions this as an “identity layer” for the internet. Sovrin wants to replace all the data siloes with a system (blockchain) that lives between your actual data and the services you access. If a business wants to know something about you, it will send a request to the blockchain.
Sovrin, Blockchain-Based Personal Identities
When you receive the request, you can choose to approve it or deny it. If approved, you can send either a transparent proof (access to the relevant part of your actual data), or a zero-knowledge proof, which tells the business whether or not you meet its criteria, but doesn’t say why. For example, if you need to show proof that you are over eighteen, a business can request your age. You receive the request, approve it, and send back a zero-knowledge proof from your government-issued ID, stating only that your age is something greater than eighteen. This may also work as a login system—the site requests confirmation from the blockchain, receives a zero-knowledge proof, and gives you access.
The Civic project, like Sovrin, relies on a system of verifying authorities that put their stamps of approval on the blockchain. If you get a driver’s license, for example, the driver’s license center will put a proof of it on the blockchain, which can in turn be used to prove your ownership of the license without revealing the license itself. Civic also plans, at least in the beginning, to have the actual data encrypted on the user’s device, protected by biometrics. Ultimately, with more widespread adoption, this storage could be decentralized, but keeping the documents close to the proofs in the beginning could make it easier to scale up slowly.
Permissioned Ledgers
A common thread in many of these startups (Sovrin and Civic included) is the idea of a public permissioned distributed ledger. “Public” means that everyone can see it; “permissioned” means that only certain entities can act as authorities on it; and “distributed” means it doesn’t depend on any one node to stay functional. Like a normal blockchain there is no central administrator, but unlike most other blockchains, you have to be approved in order to take part in running it. Hyperledger Fabric is one of the best implementations of permissioned ledgers out there, which is why you might see a lot of these projects building on it.
The biggest benefit of a permissioned ledger is that it may be regarded as more trustworthy since all the nodes are known and have an interest in staying honest. A nice side effect of this, though, is speed: because all the nodes are public and trusted, they don’t have to dedicate many resources to keeping out bad actors, meaning that the workload of confirming transactions can be much more efficiently handled.
Read more about Hyperledger Fabric in our Practical Byzantine Fault Tolerance article.
The downside is obvious: permissioned ledgers seem quite centralized. Hopefully, widespread adoption would lead to a diverse enough ecosystem of trusted authorities that it would be effectively decentralized, but in the meantime, crypto-libertarians may have to settle for what they can get.
SecureKey is a good example of this in action. It is already being used to identify around seven million customers across several major Canadian banks, and it’s been working very well. The ledger is managed by just a few trusted entities, and is a little more similar to a traditional back-end system. However, the company is planning to expand its offerings beyond the banking sector, at which point they might start growing towards a more self-sovereign model. Regardless, though, it’s hard to overstate the importance of SecureKey as a test case: it proves that not only can the system work, but it can work in a high-pressure environment at a large scale.
If this rubs you the wrong way, you may prefer the solution offered by uPort, which runs on the Ethereum blockchain. A uPort identity is simply an Ethereum address that acts as an identifier across multiple apps and services. It bears many similarities to the other systems—verified claims, complete user control, KYC capabilities, and so on—but opts for a more decentralized approach to the ecosystem, giving developers the tools they need to integrate their systems with the uPort standard. Their first experiment in the Swiss city of Zug is under way, with citizens being registered on the Ethereum blockchain and using it to access certain government services.
What needs to happen?
There are actually so many different companies vying for position that it might make one of the most important aspects of self-sovereign identity a little more difficult: a universal standard that can benefit from network effects. Beyond that, we’ll need something that is user-friendly enough that the average identity-holder won’t even have to know what a blockchain is in order to have an identity, and it will need to stay private by default, without relying on human input.
Luckily, pretty much every company mentioned above (Sovrin, SecureKey, Hyperledger Indy, Civic, and uPort) are aware of these issues and are working on them. SecureKey’s implementation in Canada has proved that the tech can work and be user-friendly, and many others are working on building out other aspects of the idea. An almost-complete list can be found on this GitHub page dedicated to cataloging blockchain identity projects. Whether the future is multiple standards for multiple applications, cross-compatibility, or one chain to rule them all, this is a sector that’s likely to be taking off soon.
