How can we demonstrate the importance of identity in an increasingly digital society? This interesting master's thesis explores this topic in depth.
Master's Thesis Project: Distributed Ledger Technologies (DLT) Applied to Digital Identity and Self-Sovereign Identity (SSI)
The work carried out by Borja Lanza former student the Master's Degree in Cybersecurity and Information Management in Structuralia and supervised by Óscar García-Rama addressed the synergies that distributed ledger technologies (DLT) can provide whose most popular exhibit is blockchain, to digital identity management and security.
The blockchains since they are designed to ensure the traceability and transparency of transactions, as they are signed using cryptographic methods, make it impossible for them to be manipulated or falsified by malicious actors. This immutability, combined with the fact that they are distributed systems, prevents censorship and can facilitate the creation of digital identities that solve the problems faced by more than one billion people who currently lack any form of identity.
Our data is becoming increasingly vulnerable since we have to manage multiple identities or user accounts. This isn't limited to social media or websites, but also applies to To carry out administrative procedures with government agencies, we must have the necessary resources that allow us to be identified and authorized to carry out these procedures in a secure and reliable manner.
Regaining control over our data to manage who has access to it and for what purposes is another problem that blockchain can ideally solve. Having a single, reliable source of truth makes it much easier to authenticate and verify a digital identity without compromising the identity owner’s privacy, thereby enhancing cybersecurity. mitigating the risks of identity theft and identity fraud.
The research addresses this issue from a theoretical framework, The State of the Art in DLT Applications and specifically Blockchain and Digital Identity Management, by reviewing the technologies involved and current or future solutions within a short period of time.
Objectives of the Master's Thesis
The following objectives were set for the completion of the master's thesis.
Theoretical Objectives:
- Conduct a study on the current state of the art in the application of blockchain technologies to digital identity.
- Identify disruptive applications of DLT technologies and their use cases.
- Define best practices for the application of these technologies, primarily in the areas of identity, privacy, and cybersecurity
- Summarize the findings and identify future trends in the field of study addressed in this paper.
Personally, I also chose this topic to gain a clear and comprehensive understanding of the concepts related to digital identity—particularly self-sovereign identity—as well as blockchain and DLT technologies applied to identity, along with the basic fundamentals of related technologies.
Why Why is the concept of identity so important to our physical and digital existence?
Definition of Identity
Some definitions of "identity" from the DRAE are
- A set of characteristics specific to an individual or a group that distinguish them from others.
- f. A person’s or group’s awareness of being itself and distinct from others.
Is identity a human right?
Within the global consensus represented by the 1948 Universal Declaration of Human Rights (UDHR), the term “identity” is not mentioned even once throughout the entire text.
We can state with certainty that if individuals are not properly identified and do not have a unique identity, they cannot exercise the rights defined in:
- Article 6: Every human being has the right, everywhere, to recognition as a legal person.
- Article 15.1: Everyone has the right to a nationality.
- Article 17: Everyone has the right to own property, individually and collectively.
- Other rights, such as the right to marry (Article 16), the right to participate in the government of one's country (Article 21), and the right to social security (Article 22),
All of these articles relate to a person’s identification, their access to those rights, and the maintenance of a registry that ensures the protection of those rights. Therefore, a person’s right to an identity is fundamental to the exercise of those basic rights.
Self-Sovereign Identity
There is currently no full consensus on the definition of self-sovereign identity.
The self-sovereign identity It is the next step beyond user-centered identity, and this means it must start in the same place: the user must be at the center of identity management. This requires not only the identity interoperability not only the ability for a user to manage their identity across multiple locations, with the user's consent, but also true control over that digital identity, thereby creating genuine independence for the user.
To achieve this, a self-sufficient identity it must be portable; It cannot be limited to a single site or location.
One of the pioneers of identity Christopher Allen In 2016, it established 10 principles for self-sovereign identity that have become a benchmark in the field.
These principles are:
Access: Users must have access to their own data.
- Consent: Users must first consent to the use of their identity by third parties.
- Control: Users must be able to control their identities.
- Existence: Users must be independent entities.
- Interoperability: Identities should be widely usable.
- Minimization: The disclosure of claims should be reduced.
- Persistence: Identities must be enduring.
- Protection: Users' rights must be protected.
- Portability: Identity-related information and services must be portable.
- Transparency: Systems and algorithms must be transparent.
Self-sovereign identity is considered to be a digital identity model, provided it complies with the following 16 principles.
People can generate their own unique identifierss (control, existence).
- People have the management of their authenticators (access, control, existence).
- People have eVerification of their digital credentials and certificates (access, control, existence).
- People can recover credentials and certificates in the event of loss or theft of your authenticators (access, control, existence, persistence, and protection).
- People manage and monitor the associated data with their digital identity (access, control).
- People can do selective data disclosures (consent, control, minimization, protection).
- The personally identifiable information (PII) of individuals is minimized (minimization, protection).
- The cryptographic tests Information about the ownership of identifiers can be found at…
- an rdecentralized public education (interoperability, persistence, transparency).
- The cryptographic proofs of the ownership and the validity of credentials can be found inn…
- a decentralized public network (interoperability, persistence, transparency).
- The right to be forgotten is guaranteed (protection).
- The identity management units (digital wallets) are laptops (portability).
- The digital wallet providers They do not have access to information about individuals' access to services or their interactions with others (access, control, protection).
- The backups ensure the highest levels of security and privacy (persistence, protection).
The implementations comply with the regulatory policies (protection).
Blockchain-Based Digital Identity Solutions
The study also analyzed some of the various blockchain-based identity solutions available in June 2021.
Apart from Sovrin and Hyperledger Indy The Spanish development driven by Alastria.
AlastriaID is the pAlastria Identity Commission's Digital Identity Project. Its proposal for a blockchain-based digital identity aims to provide an infrastructure and development framework for implementing sovereign digital identity projects with full legal validity in the eurozone, based on the following principles:
Establish a framework for utilizing SSI via blockchain, in accordance with the SSI eIDAS Legal Report, also known as the «eIDAS Bridge.».
- Follow the guidelines set forth in the Report of the Electronic Identity Workshop, published by the EUBlockchain Observatory and Forum.
- Comply with the eIDAS Regulation, pursuant to Regulation (EU) No. 910/2014 of the European Parliament and of the Council of July 23, 2014, on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC.
Make digital identity on the blockchain and the GDPR two complementary tools, following the recommendations outlined by the EUBlockchain Observatory and Forum and the study by the European Parliament’s Research Service.
Alastria ID is a mature model that complies with W3C standards and has served as the basis for the European Self-Sovereign Identity Framework (ESSIF) and the standardization processes of UNE, CEN/CENELEC, ETSI, ITU, and ISO; it is considered a de facto standard. It is interoperable with ESSIF, a European SSI project within EBSI and promoted by the EBP. It is currently the UNE 71307 standard.
Zero-Knowledge Proofs
The zero-knowledge proofs They enable one party to an interaction to prove to the other parties involved that a statement it makes is true, without revealing any information beyond the validity of the statement itself.
The parties involved are commonly referred to as demonstrators y verifiers, and the statement they share privately and securely is called witness. Its main objective is to disclose as little information as possible between the two parties involved.
Zero-knowledge proofs are used to verify that one possesses a specific piece of knowledge without revealing any information about the knowledge itself.
Some examples of ZKP applications include:
Prove that a person is of legal age without revealing their date of birth or current age.
- Registering as a resident in a town without providing a home address, while still being able to use the services of the city government where one legally resides.
- To demonstrate that you have a minimum amount of money to cover a payment or purchase, without showing your total balance or assets that serve as collateral.
To demonstrate that one has specific permits and licenses that allow a vehicle to be driven without compromising the owner's privacy.
Knowledge tests are often used in computer science to:
Verify one's identity (for example, authentication protocol).
- To prove that one belongs to a privileged group.
To prove that something has been done correctly (make a payment).
For a ZKP to work, certain parameters must be met:
Comprehensiveness: If the statement is true, then an honest verifier can be convinced of this by an honest prover.
Solidity: If the prover is dishonest, they cannot convince the verifier of the validity of the statement by lying.
Zero Knowledge: If the statement is true, the verifier will have no idea what the statement actually is.
Conclusions
The research for my master's thesis allowed me to to examine the importance of identity in an increasingly digitized society where people are defined by different identities. These identities are at risk for various reasons cyber threats such as identity theft, phishing, and credential theft, which can have a significant impact—not only financial—when one of our identities is compromised or stolen, such as a social media profile.
Therefore, We need to be aware of all the rights and tools at our disposal to protect our personal information, which is used to track and analyze our behavior, given the risk of an invasion of our privacy or surveillance of our movements and thoughts.
Distributed ledger technologies (DLT), —of which blockchain is the prime example—provide the technological foundation needed to ensure that control in a secure, resilient, and robust manner. These technologies have made tremendous strides in recent years and are transforming the way value is exchanged.
Although they are best known for their application in cryptocurrencies, their use in the field of digital identity is one of the most revolutionary, especially in Self-Sovereign Identities (SSI). Integration with other technologies such as zero-knowledge proofs (ZKP) will represent a major step forward in how we interact in the digital world, providing greater trust, security, privacy, and control over our data, while ensuring their confidentiality, integrity, and availability.
In Structuralia We would like to thank [name] for their outstanding work and initiative. Borja Lanza and his master's thesis project. Do you want to build your professional future just like Borja? You can visit our website at Structuralia and to explore the significant amount of training material in this sector, as well as the variety of specialized master's degrees what you need to achieve your goals.
AUTHOR'S REVIEW:
Borja Javier Lanza López holds a bachelor's degree in multimedia, Master's Degree in Multimedia Applications y University-Specific Master's Degree in Business Intelligence and Big Data by the UOC (Open University of Catalonia).
As new technology professional has continued to keep up with the latest developments thanks to the Master's Degree in Cybersecurity and Information Risk Management endorsed by Alfonso X el Sabio University and the International Master's Degree in Innovation Management Endorsed by Isabel I International University in Spain; both courses are taught by Structuralia
He has built his professional career as a trainer and technology consultant, focusing primarily on blockchain and cybersecurity in digital transformation projects.
AUTHOR'S STATEMENT:
1. What would you highlight most about the master's program?
«The Master's Degree in Cybersecurity and Information Risk Management provides a broad and comprehensive foundation in the various aspects that make up a field as broad and interdisciplinary as cybersecurity.«
2. How do you think this will help you in your professional development?
»Cybersecurity is one of the most in-demand fields today, and there is a shortage of professionals in this area. Earning specialized, recognized training is one way to demonstrate the knowledge needed to start a career in this field.".«
3. Why did you choose Structuralia?
«The convenience and freedom of being able to study anytime, anywhere—especially during difficult times like these—while earning an official degree from a recognized university.
»The opportunity to apply for scholarships from the Organization of American States (OAS) is a bonus that allows you to pursue cutting-edge master's programs at an affordable cost and meet people from different countries."
Throughout the academic year, Structuralia hosts numerous master classes open to all students, featuring professionals from various master's programs who greatly enrich the learning experience.
