Self-sovereign Identities Research Articles

Selbstbestimmte Identitäten im E-Commerce:

ZusammenfassungDer Online-Handel verzeichnet seit Jahren ein stetiges Wachstum. Durch die COVID-19-Pandemie kaufen nun auch Nutzende, die zuvor physische Kanäle bevorzugten, vermehrt online ein. Der Anbietererfolg hängt dabei wesentlich von der Kenntnis über die Kund*innen ab. Allerdings dominieren einige große Anbieter den Markt, während kleinere Online-Shops Schwierigkeiten haben, ihre Angebote zu personalisieren. Eine Lösung bietet der Ansatz selbstbestimmter Identitäten. Dieser ermöglicht Kund*innen, ihre eigenen Shoppingdaten zu kontrollieren und sie selektiv mit Online-Shops zu teilen. Dadurch können individuelle Wünsche und Anforderungen der Kund*innen in Online-Shops berücksichtigt und ein personalisiertes Angebot sowie eine gute Nutzungserfahrung geboten werden. Trotz des großen Potenzials selbstbestimmter Identitäten ist der Ansatz in Deutschland kaum verbreitet. Dieser Beitrag beleuchtet den Einsatz selbstbestimmter Identitäten im Online-Handel. Mithilfe eines menschenzentrierten Gestaltungsprozesses wurden Personas und Ist-Szenarien erstellt, sowie daraus resultierend Anforderungen erhoben und Potenziale identifiziert. Auf Basis dessen konnte ein Daten- und Architekturmodell zur Integration von selbstbestimmten Identitäten im Online-Handel entwickelt werden.

Analyzing the Threats to Blockchain-Based Self-Sovereign Identities by Conducting a Literature Survey

Self-sovereign identity (SSI) is a digital identity management model managed in a decentralized manner. It allows identity owners to manage and store their digital identities in a software wallet, for example, on a smartphone, without relying on centralized providers. This approach tries to enhance the security and privacy of digital identities and, thereby, their owners. With the new eIDAS regulation, elements of SSI, such as the wallet, are being pushed onto the market. However, since the model is relatively new, the security threats are still not fully known. This is shown by a brief security analysis of selected existing SSI wallets. In order to get a picture of the known threats, we systematically analyze and categorize related work in the field of SSI and elements applied by SSI. We then evaluate their application to current SSI systems and identify future work.

Towards an Improved Taxonomy of Attacks Related to Digital Identities and Identity Management Systems

Digital transformation with the adoption of cloud technologies, outsourcing, and working-from-home possibilities permits flexibility for organizations and persons. At the same time, it makes it more difficult to secure the IT infrastructure as the IT team needs to keep track of who is accessing what data from where and when on which device. With these changes, identity management as a key element of security becomes more important. Identity management relates to the technologies and policies for the identification, authentication, and authorization of users (humans and devices) in computer networks. Due to the diversity of identity management (i.e., models, protocols, and implementations), different requirements, problems, and attack vectors need to be taken into account. In order to secure identity management systems with their identities, a systematic approach is required. In this article, we propose the improved framework Taxonomy for Identity Management related to Attacks (TaxIdMA). The purpose of TaxIdMA is to classify existing attacks, attack vectors, and vulnerabilities associated with system identities, identity management systems, and end-user identities. In addition, the background of these attacks can be described in a structured and systematic way. The taxonomy is applied to the Internet of Things and self-sovereign identities. It is enhanced by a description language for threat intelligence sharing. Last but not least, TaxIdMA is evaluated and improved based on expert interviews, statistics, and discussions. This step enables broader applicability and level of detail at the same time. The combination of TaxIdMA, which allows a structured way to outline attacks and is applicable to different scenarios, and a description language for threat intelligence helps to improve the security identity management systems and processes.

The Paradoxical Impact of Information Privacy on Privacy Preserving Technology: The Case of Self-Sovereign Identities

Advance of digital technologies brings great benefits but takes users at risk of the dark sides of the internet. Preventive mechanisms and privacy-preserving solutions could overcome this challenge. As such, self-sovereign identities (SSIs) provide users with increased control over personal information. However, users neglect their privacy in favor of the most convenient solution. In this paper, we empirically examine how information privacy influences adoption of SSIs. Our results contradict the existing theory that privacy is critical to the success of identity management (IdM) systems. Analogous to the privacy paradox, the study does not lend empirical support that perceived privacy has an impact on the adoption of an SSI. On the contrary, these findings contradict the prevailing view of privacy as a key factor for IdM systems and contribute to knowledge on privacy and adoption behavior.

A Self-Sovereign Identity Based on Zero-Knowledge Proof and Blockchain

Systems for generating and managing digital identities are in the process of being transformed to improve data sharing security and increase decentralization. Addressing both issues, a theoretical solution to create and manage Self-Sovereign Identities (SSI) is proposed using two Zero-Knowledge Proof (ZKP) protocols based on the discrete logarithm difficulty. Automorphism group properties are introduced to link several identities, their identifiers and attributes to produce a proof. The proposed SSI protocol does not encounter the problem of reusing the same secret key as in the case of the initial ZKP Schnorr protocol. The designed protocol ensures minimal disclosure of information to a single trusted third party. In addition, it allows zero disclosure of information to service providers requiring proof of authentication or identification. Such a SSI protocol is compliant with Electronic IDentification And Trust Services (eIDAS) as well as General Data Protection Regulation (GDPR) regulations.

Toward Interoperable Self-Sovereign Identities

Toward Interoperable Self-Sovereign Identities

Cryptographic–Biometric Self-Sovereign Personal Identities

This article describes a hybrid of self-sovereign identities (SSIs), cryptographic authentication, and biometric authentication, which allows remote yet secure proof of identity, all while addressing privacy concerns. The proposed technique addresses cooperative attacks, which are unique to the SSI embodiment of blockchain technology.

Blockchain-based identity management and access control framework for open banking ecosystem

Financial institutions are following an open banking (OB) trend for service innovation and integration. OB allows third-party service providers (TSPs) to access user financial data for purposes of finding the best deals and improving user experiences. The trust in third parties required for OB ecosystem success raises questions about digital identity integration, data sharing, and privacy preservation. Decentralized applications (DApps) for classifying and protecting data privacy, recording user consent, tracking TSP access actions, managing application programming interfaces (APIs), and preserving self-sovereign identities already exist, but in some countries such as Taiwan they have yet to be integrated into an operable three-phase OB approach. After identifying all major requirements of primary OB participants, we develop a blockchain-based identity management and access control (BIMAC) framework that shares some advantages of both traditional banking and blockchain technology. The BIMAC infrastructure applies smart contracts and a stateless authentication mechanism to form a reliable personal information transaction security control (PITSC) platform that offers such functionalities as decentralized third-party login (TPL), the ability to open bank accounts online, data authorization/revocation, integrated payouts, and TSP access monitoring. System performance evaluation results indicate that the frequent execution functions of the proposed framework have lower computation costs than the average transaction cost of public Ethereum.

Maintaining trust in a technologized public sector

AbstractEmerging technologies permeate and potentially disrupt a wide spectrum of our social, economic, and political relations. Various state institutions, including education, law enforcement, and healthcare, increasingly rely on technical components, such as automated decision-making systems, e-government systems, and other digital tools to provide cheap, efficient public services, and supposedly fair, transparent, disinterested, and accountable public administration. The increased interest in various blockchain-based solutions from central bank digital currencies, via tokenized educational credentials, and distributed ledger-based land registries to self-sovereign identities is the latest, still mostly unwritten chapter in a long history of standardized, objectified, automated, technocratic, and technologized public administration. The rapid, (often) unplanned, and uncontrolled technologization of public services (as happened in the hasty adoption of distance-learning and teleconferencing systems during Corona Virus Disease (COVID) lockdowns) raises complex questions about the use of novel technological components, which may or may not be ultimately adequate for the task for which they are used. The question whether we can trust the technical infrastructures the public sector uses when providing public services is a central concern in an age where trust in government is declining: If the government’s artificial intelligence system that detects welfare fraud fails, the public’s confidence in the government is ultimately hit. In this paper, we provide a critical assessment of how the use of potentially untrustworthy (private) technological systems including blockchain-based systems in the public sector may affect trust in government. We then propose several policy options to protect the trust in government even if some of their technological components prove fundamentally untrustworthy.

Systemic risks in electricity systems: A perspective on the potential of digital technologies

In the last decades, several developments have transformed electricity systems in Europe towards liberalized and decentralized systems that are coupled inter-sectorally and inter-regionally. These developments have yielded various significant benefits, such as increased efficiency and robustness. However, we argue that they have also caused new interdependencies and complexity with a corresponding increase in associated systemic risks, e.g., local failures may spread faster and more extensively throughout the system. In this paper, we illustrate how systemic risks may arise in European electricity systems by discussing three exemplary developments. We also discuss the decisive role of the digital transformation that, on the one hand, speeds up the transition of electricity systems and challenges electricity systems’ stability through rapid change, but on the other hand may also provide solutions to tackle systemic risks. We argue that, especially in a strongly interconnected world, policymakers must implement a global perspective on these critical and increasingly complex systems, requiring adequate cooperation with respect to data. Using an exemplary case from Germany, we finally illustrate how an intensified data exchange may help to address systemic risks. In this context, we draw a perspective on the potential of emerging digital technologies, like self-sovereign identities, blockchains, and privacy-enhancing technologies.

The transparency challenge of blockchain in organizations

This position paper discusses the challenges of blockchain applications in businesses and the public sector related to an excessive degree of transparency. We first point out the types of sensitive data involved in different patterns of blockchain use cases. We then argue that the implications of blockchains’ information exposure caused by replicated transaction storage and execution go well beyond the often-mentioned conflicts with the GDPR’s “right to be forgotten” and may be more problematic than anticipated. In particular, we illustrate the trade-off between protecting sensitive information and increasing process efficiency through smart contracts. We also explore to which extent permissioned blockchains and novel applications of cryptographic technologies such as self-sovereign identities and zero-knowledge proofs can help overcome the transparency challenge and thus act as catalysts for blockchain adoption and diffusion in organizations.

Governance and societal impact of blockchain-based self-sovereign identities

Abstract Traditionally, governments and companies store data to identify persons for services provision and interactions. The rise of self-sovereign identities (SSIs) based on blockchain technologies provides individuals with ownership and control over their personal data and allows them to share their data with others using a sort of “digital safe.” Fundamentally, people have the sole ownership of their identity data and control when and how it is shared, protecting their privacy. As these data need to be validated to be trusted, they may become a more important data source for digital information sharing and transactions than the formal source of identity controlled by governments. Furthermore, SSIs can be used for interacting digitally with any organization. These developments change the relationship between government, companies, and individuals. We explore information sharing and governance in the digital society using blockchain-based SSIs. In addition, the impact of SSIs on data storage in the digital world is assessed. Technology enactment might result in no greater control or privacy and might only reinforce current practices. Finally, we argue that regulation and a combination of centralized and decentralized governance are still required to avoid misuse and ensure that envisaged benefits are realized.

Decentralized Factoring for Self-Sovereign Identities

Invoice factoring is a handy tool for developing businesses that face liquidity problems. The main property that a factoring system needs to fulfill is to prevent an invoice from being factored twice. Distributed ledger technology is suitable for implementing the platform to register invoice factoring agreements and prevent double-factoring. Several works have been proposed to use this technology for invoice factoring. However, current proposals lack in one or several aspects, such as decentralization and security against corruption, protecting business and personally identifiable information (PII), providing non-repudiation for handling disputes, Know-Your-Customer (KYC) compliance, easy user on-boarding, and being cost-efficient. In this article, a factoring registration protocol is proposed for invoice factoring registration based on a public distributed ledger which adheres to the aforementioned requirements. We include a relayer in our architecture to address the entry barrier that the users have due to the need of managing cryptocurrencies for interacting with the public ledger. Moreover, we leverage the concept of Verifiable Credentials (VCs) for KYC compliance, and allow parties to implement their self-sovereign identities by using decentralized identifiers (DIDs). DIDs enable us to relay on the DIDComm protocol for asynchronous and secure off-chain communications. We analyze our protocol from several security aspects, compare it to the related work, and study a possible business use case. Our evaluations demonstrate that our proposal is secure and efficient, as well as covers requirements not addressed by existing related work.

Rechained: Sybil-Resistant Distributed Identities for the Internet of Things and Mobile Ad Hoc Networks.

Today, increasing Internet of Things devices are deployed, and the field of applications for decentralized, self-organizing networks keeps growing. The growth also makes these systems more attractive to attackers. Sybil attacks are a common issue, especially in decentralized networks and networks that are deployed in scenarios with irregular or unreliable Internet connectivity. The lack of a central authority that can be contacted at any time allows attackers to introduce arbitrary amounts of nodes into the network and manipulate its behavior according to the attacker’s goals, by posing as a majority participant. Depending on the structure of the network, employing Sybil node detection schemes may be difficult, and low powered Internet of Things devices are usually unable to perform impactful amounts of work for proof-of-work based schemes. In this paper, we present Rechained, a scheme that monetarily disincentivizes the creation of Sybil identities for networks that can operate with intermittent or no Internet connectivity. We introduce a new revocation mechanism for identities, tie them into the concepts of self-sovereign identities, and decentralized identifiers. Case-studies are used to discuss upper- and lower-bounds for the costs of Sybil identities and, therefore, the provided security level. Furthermore, we formalize the protocol using Colored Petri Nets to analyze its correctness and suitability. Proof-of-concept implementations are used to evaluate the performance of our scheme on low powered hardware as it might be found in Internet of Things applications.

Self-sovereign Identities for Fighting the Impact of COVID-19 Pandemic

Whereas part of the world can benefit from the wonders of digital technologies, undocumented migrants, asylum seekers, and refugees are facing the rough reality of being “invisible” in society and ignored by governments. During the COVID-19 pandemic, the economic impact of the closure of the service industry and the impossibility to keep most of the informal work they perform place them into a limbo without income and unemployment benefits. They are denied formal support because of the lack of a legally recognized identity. For this type of humanitarian support, contemporary identities can offer a way out. Self-sovereign identities (SSI) can provide individuals ownership over their data and the ability to share this with others. The essence is that the owner determines whom they share their identity data with. They have the sole ownership of the identity data. As such, an SSI ensures privacy for undocumented persons. This would allow to provide support to those who are left behind by a lack of formal identity. In this article, we explore the possibility of SSI to assist undocumented individuals throughout the pandemic times. SSI can be used to interact with undocumented workers and to share all kinds of identity data, such as sharing the attestation of COVID-19 tests or the ability to donate money to those who are illegal without sacrificing their identity.

Data governance: Organizing data for trustworthy Artificial Intelligence

The rise of Big, Open and Linked Data (BOLD) enables Big Data Algorithmic Systems (BDAS) which are often based on machine learning, neural networks and other forms of Artificial Intelligence (AI). As such systems are increasingly requested to make decisions that are consequential to individuals, communities and society at large, their failures cannot be tolerated, and they are subject to stringent regulatory and ethical requirements. However, they all rely on data which is not only big, open and linked but varied, dynamic and streamed at high speeds in real-time. Managing such data is challenging. To overcome such challenges and utilize opportunities for BDAS, organizations are increasingly developing advanced data governance capabilities. This paper reviews challenges and approaches to data governance for such systems, and proposes a framework for data governance for trustworthy BDAS. The framework promotes the stewardship of data, processes and algorithms, the controlled opening of data and algorithms to enable external scrutiny, trusted information sharing within and between organizations, risk-based governance, system-level controls, and data control through shared ownership and self-sovereign identities. The framework is based on 13 design principles and is proposed incrementally, for a single organization and multiple networked organizations.

An Identity Management and Authentication Scheme Based on Redactable Blockchain for Mobile Networks

More and more users are eager to obtain more comprehensive network services without revealing their private information. Traditionally, in order to access a network, a user is authorized with an identity and corresponding keys, which are generated and managed by the network operator. All users' personally identifying information are centralized stored by the network operator. However, this approach makes users lose the control of their personally identifying information. Users are concerned about who can access these sensitive data and whether they have been compromised. In this paper, we propose a blockchain-based identity management and authentication scheme for mobile networks, where users' identifying information are controlled by the users themselves. Our scheme let users generate their self-sovereign identities (SSIs) and corresponding public keys and private keys. The private key used to authenticate the user's identifying information is only known to the user. We use blockchain to record SSIs and public keys of legitimate user, and adopt chameleon hash to delete illegal users' information on the blockchain, while keeping the block head unchanged. Furthermore, other service providers can obtain the user's SSI and public key and authenticate users by querying the blockchain. Experimental results confirm that our scheme can greatly reduce the revocation overhead and communication overhead.

RAIAP: renewable authentication on isolated anonymous profiles

Implementing pseudonymity, key-management, non-repudiation and data minimisation features in isolated procedures is trivial. However, integrating all of them in one consistent architecture has several challenges to tackle. This work proposes data structures to represent Self-Sovereign Identities and to handle those features in a consolidated architecture. Key-management is constructed using secret sharing principles, capable of recovering from a lost or compromised key to a new one without losing track of the original account. Pseudonymity and data minimisation is established using anonymous profiles, showing different views of the same identity. Non-repudiation is contemplated in the profile disclosure process. Profiles are protected against tampering with the use of digital signatures and blockchain cryptographic constructions. All profiles and registries are controlled with a single asymmetric key pair that can be provided by a smart card. Flexible structures are defined that can be used to register claims, attestations, authorisation grants, user consents, or any other activities. All definitions take into consideration the rules of the General Data Protection Regulation (GDPR).

Self Sovereign Digital Identity on the Blockchain: A Discourse Analysis

As a technology that can be traced back to the late 1990s in its structural fundamentals, ‘blockchain’ came into mainstream public discourse as of 2017. Previously discussed in the fringes of the technology-savvy circles, blockchain has now become a global phenomenon and indeed an industry that is rapidly growing and capturing a notable share of the public imagination along with academic discourse. Blockchain’s emergence in the realm of technology is essentially thanks to the invention of bitcoin as both a speculative asset and as a digital store of value. Many governments around the world have made public claims regarding their enthusiasm for adopting ‘blockchain’ in various ways; varying from Russia, Estonia, and Ukraine in Europe all the way to Venezuela in Latin America and even the Marshall Islands in the Pacific Ocean. This paper puts out the objective of achieving self-sovereign identities on the blockchain is a promise that has not yet manifested on the ground, albeit it disproportionately captures a significant share of the contemporary discourse on the three larger concepts of self-sovereignty, digital identity, and the blockchain. A key reason for the lack of manifestation of this promise is that there is little agreement as to what is actually meant by ‘self-sovereign identities’ —in stark comparison to the major consensus over the concepts of ‘blockchain’ or ‘cryptocurrencies’. In order to explore the genealogy of the core concept of ‘identity’, the theoretical genesis of ‘biopolitics’ is consulted, demonstrating that our contemporary technological epoch is best defined as an era of the emergence of ‘bio digital’ power. The paper ultimately argues that the reason for this disproportional share of discourse is created by certain actors to utilize the growing rhetoric on ‘blockchain’ and the libertarian notion of ‘self-sovereignty’ as façades to potentially pursue capitalist objectives. Keywords: blockchain, self-sovereignty, bitcoin, capitalism, digital identity, privacy, data, cryptocurrencies.

Blockchain-Based Identity Management: A Survey From the Enterprise and Ecosystem Perspective

Identity management is a core building block for the majority of software solutions and landscapes. Competing with existing identity-managing solutions, blockchain-based concepts and products have evolved in the context of verified claims and self-sovereign identities. The contribution of this paper is a systematic, criteria-driven survey of the solutions and technologies for this growing field and their comparison with the capabilities of established solutions. By including an extensive set of requirements covering ecosystem aspects, end-user functionality, mobility and overhead aspects, compliance/liability, EU regulations, standardization, and integration, this paper shows the highlights and the deficits of a wide array of solutions.