By Arne Rutjes, Filipp Valovich, John Pater
Not your keys, not your data. How do we bring that concept to an industry blockchain?
The first part of this article series explores a concept to securely identify a user, combining the latest developments in Self Sovereign Identity (SSI) and permissioned blockchain solutions.
Introduction
Companies interact with other companies to generate value. The more they can trust in these interactions, the more value everyone gets out of it and the lower the total cost of business. While trust mainly flows from human relations and reputation, processes and technology can provide strong support. One such technology is blockchain or Distributed Ledger Technology (DLT). It enables parties to record proof that the process is followed. Distributed ledgers provide strong confidence in the integrity of data, because the infrastructure is shared and validated by many. They keep a final and immutable registry of timestamped transactions. Additionally, leveraging smart contracts, they provide the means to execute shared business logic in a provably secure way.
For example, on a construction site a foreman can order concrete on behalf of the building contractor. The IT systems of the contractor and the concrete batcher may use a distributed ledger to record the order. They and other stakeholders, like the logistics company and the client, can update each other in real time. Instead of relying on scattered bits of proof in different places like emails and phone calls, they know they all have the same overview. To trust the data however, each involved party needs to know who has performed a particular activity (like attesting that the concrete has been delivered) on behalf of an organization. In other words, the blockchain has to contain proof that a qualified person signed for this transaction.
People in general don’t interact directly with a blockchain; there’s computer systems in between. Especially if the company uses a web-based system that is hosted by a third party (Software-as-a-Service, or SaaS) that provides the interface to the user to do their work, this becomes complicated. How do we make sure that the user and their counterparts can trust the end-to-end process?
We looked into a few existing solutions, but found none of them satisfactory.
- The SaaS provider could store an audit log of who did what. However, having to ask them for the logs when proof is needed defeats the purpose of using a shared ledger.
- Solutions like MetaMask, which let users sign blockchain transactions pseudonymously from their browser, don’t have a privacy-friendly way of identifying users built in.
- Self-Sovereign Identity, which we’ll cover in more detail in the next chapter, is great for proving your identity to one other party, but not for signing data on a blockchain.
- There are companies that offer KYC for decentralized exchanges, linking your Ethereum address to verifiable credentials. The problem with these is that they create a hard link on the blockchain between the account and the credentials, allowing third parties to trivially track a deanonymized user.
If we want strong identification, privacy and trusted signatures, we will have to combine some building blocks.
Identifying the User
Self-Sovereign Identity (SSI) is a new approach to give people control over their own identity. They have a wallet (commonly a mobile app) that holds all their credentials: attestations about who they are, who they work for, which diplomas they have, and any other attribute about their identity that can be verified by someone else. Contrary to other identity solutions, the credentials are stored in the wallet of the user itself; the verifier never has to go to the issuer directly for validation. Compare it to real life, where you show your driver’s license — ‘signed’ with the security features that only the government can create — and then put it back in your wallet. To learn more, check out this excellent demo by animo.id or dive into the rabbit hole with these resources.
Because of its strong privacy, security, and usability features, SSI is likely to become an integral part of the way people and organizations interact. This idea is confirmed by the EU, who will be launching a digital identity for all Europeans based on similar principles.
Most of the current solutions in the SSI world are focused on the consumer or citizen, but let’s not forget about the person in the role of employee (like the foreman in the earlier example). An example of a credential that will be very useful for inter-company use, is the vLEI (verifiable Legal Entity Identifier). It contains a company identity and the person’s name and role. Eventually this will be extended with other personal credentials like diplomas, certifications, licenses, and other official attestations commonly handled in paper right now; bills of lading, access tokens, receipts, approvals, and so on. As long as there are authoritative sources issuing these credentials, they can be used by any relying party.
Contents of the verifiable Legal Entity Identifier (source: GLEIF)
Signing blockchain transactions
Blockchains use digital signatures to ensure the integrity of a message; it can only have been signed by the person controlling the private key and cannot be tampered with. Some permissioned DLT, like Hyperledger Fabric or Corda, combine this with a certificate signed by a Certificate Authority to provide access to the user. In some cases they can even use Zero Knowledge Proofs to allow the user to prove certain attributes (like their role or company) without revealing their full identity.
When the foreman signs for receiving a batch of concrete, how do we prove that:
- It’s really him signing off (authentication)
- He works for the contractor and is allowed to sign off (authorization)
- The message has not been tampered with (integrity)?
It would be ideal if existing SSI wallets could handle the signing for us, but that is not part of their scope. For all kinds of reasons, the schemes used in SSI are different from existing Public Key Infrastructure (PKI). The standard protocols do not provide a way for the SSI user to sign a transaction with the key and certificate they have for the blockchain.
In the second part of this series, we will elaborate on an approach to combine the two paradigms.
At NEXPLORE, we are building technology products to digitize the construction industry. We are always looking for the most innovative technologies in order to move forward on the cutting edge.
