Read More

While many self-sovereign identity solutions offer tools for individuals, a government team from Canada is using digital trust technology to improve sustainability reporting in the natural resource sector for organizations.   

The Government of British Columbia (B.C.) – a Trust Over IP (ToIP) Steering Committee Member – initiated the Energy & Mines Digital Trust (EMDT) project under the Ministry of Energy, Mines and Low Carbon Innovation (EMLI) to facilitate the transition to a resilient, clean economy. EMDT’s pilot enables a collaborative digital ecosystem between the B.C. government, natural resource companies, and organizations around the world to improve sustainability reporting using digital credentials. Digital credentials make sustainability reporting more efficient, enhance business-to-business trust, and protect data from manipulation. Digital credentials can be checked in real time, expediting access to trustworthy information. These trusted, verifiable digital credentials are the core digital trust technologies being piloted and the trust ecosystem in which they operate are defined in ToIP architecture, governance, and related documents.   

Join members of the open-source community as they share projects, discuss problems, and collaborate on new solutions at three Linux Foundation conferences this September. Attend one of three sessions featuring EMDT’s business application of digital credentials with Nancy Norris, Senior Director of ESG & Digital Trust in the Ministry for Energy, Mines and Low Carbon Innovation for the Government of British Columbia, and Kyle Robinson, Senior Strategic Advisor.

• Hyperledger Global Forum, September 12: Learn how EMDT is enabling and accelerating the B.C. government’s entry into a digital trust ecosystem by creating a simple and secure way to share sustainability data, certifications, and credentials.    
• Trust Over IP Summit, September 14: In Session 2, witness a demo, exchanging digital credentials between an environmental auditor, a mining company, and the Government of British Columbia. Stay for Session 4, to learn how and why digital trust ecosystems benefit government bodies.  
• Open Source Summit Europe, September 15: EMDT will participate in the “Blockchain in Action in the Fight Against Climate Change” panel session with Hyperledger’s Daniela Barbosa and others to discuss the role of government in creating digital trust ecosystems and how enhanced sustainability reporting supports climate goals.  

To learn more about Energy & Mines Digital Trust, be sure to include the Trust Over IP Summit as a co-located event to your Open Source Summit Europe registration and/or register for Hyperledger Global Forum.

Read More

Read More

Read More

Two weeks ago was the first full-scale Identiverse since the pandemic began, and host Ping Identity pulled out all the stops. It started off with a wonderful video splash with spotlighted drummers banging away, setting the stage for three days of wonderful entertainment, great keynotes, engaging sessions, and nonstop networking.  

Ping CEO Andre Durand ‘s opening keynote set the tone by putting decentralized identity front and center. Stating that our current systems do not scale, Andre took us on a journey through the history of Identity solutions from passwords, to single sign-on, to OAuth, to centralized and federated identity. 

He then ended with what we all know at the Trust Over IP Foundation: that the future is decentralized identity. 

It was not just a wonderful start to the conference, but a great summary of exactly why ToIP was founded: we are collaborating to develop the recommendations, standards, guides, and templates needed to connect the gap shown on Andre’s slide above.

If there was a real surprise at this year’s Identiverse, it was the evidence presented throughout the conference that decentralized identity isn’t just the future, it is the NOW. For example, only an hour after Andre’s keynote, Kristina Yasuda, Senior Identity Standards Architecture at Microsoft, gave an entire talk extolling the virtues of verifiable credentials (VCs) without even mentioning Microsoft’s own VC products. (She also didn’t mention that she is the new co-chair of the new W3C Verifiable Credentials 2.0 Working Group along with Brent Zundel of Avast).

Shortly after Kristina’s session, Brent and Drummond Reed gave a presentation on how the SSI model of digital wallets and VCs can and should be integrated with existing identity and access management (IAM) systems. Their goal was to dispel any notion that “rip and replace” was necessary to start using VCs and the ToIP stack.

But the most resounding endorsement of VCs came when Alex Simons, Microsoft’s Corporate Vice President of Identity and Network Access gave the opening keynote on the second day. He not only spent the entire first half of his talk explaining why VCs were the headline new feature of the Microsoft Entra product suite, but then invited Kristina to give a live demo of VC interop between Microsoft, Ping, Workday, IBM, and MATTR. For more on the specific interop profile they were using, see this blog post from Microsoft decentralized identity product manager Ankur Patel.

On Thursday, ToIP Steering Committee member Mike Vesey, CEO of IdRamp presented several use cases in his session “Establishing Trust with Decentralized Identity Networks, Verifiable Credentials, and Zero Trust”. Mike shared several decentralized identity solutions operating in production today, including:

• “Zoom Bouncer”, a new meeting security application now available in the Zoom public app store that allow meeting hosts to use verifiable credentials and biometrics to protect virtual meetings from zoom bombing. 
• The North Dakota Department of Education decentralized identity initiative shows how verifiable credentials are being used for decentralized verification of student learner records for graduating students. 

Mike also gave a demo of the IdRamp zero code orchestration platform that allows issuance of verifiable credentials from any traditional IAM system and verification with any traditional relying party service—an entire journey that can be implemented in just a few minutes without any code. “IdRamp has been providing decentralization for a few years now.” states Mike Vesey, “The IdRamp platform provides a seamless bridge from centralized identity systems into decentralized credential based authentication and access control. It was inspiring to hear that same vision being shared by the largest IAM organizations in the world. The future of identity is decentralized and ToIP is playing a major role in guiding organizations on their journey into decentralized zero trust protection.”

Judith Fleenor, Director of Strategic Engagement at the Trust Over IP Foundation, agrees: “It’s exciting to see live use cases of verifiable credentials across various sectors of government and industry. It is equally exciting to see organizations such as our Steering Committee members IdRamp and Monokee making integration with traditional IAM a breeze through their innovative system integration platforms and consulting services.”

Another key theme throughout the conference was FIDO2 passkeys. At least a half-dozen sessions were focused on this topic—not surprising given the announcements from Apple, Google, Mozilla, and the FIDO Alliance earlier this spring—and that Identiverse focuses on an enterprise IAM-centric audience where solutions to multi-factor and passwordless authentication have been sought after for two decades.

Overall, the attendees from ToIP agreed that this Identiverse took a strong step in the direction of ToIP—and it made it even more important that we push forward with our work of completing the full definition of the ToIP stack.

If you’d like to participate in ToIP’s efforts to further define a complete governance and technical architecture for interoperable digital trust, join us by becoming a member.

We are pleased to announce that Monokee s.r.l., a scaleup from north Italy, has joined the ToIP Foundation as a Steering Member. A company rising from the centralized and federated IAM world to embrace the SSI paradigm, Monokee intends to be an active contributor to the community’s efforts in defining the interoperability standards that will lead to Web 3.0.

Launched in 2018, Monokee leverages the 20 years of experience of its two founders in IAM/IGA consulting. The company’s flagship product is an easy-to-integrate, point-and-click visual identity orchestration tool used by security architects from SMEs to larger enterprises.

Representing Monokee on the Steering Committee will be Ing. Roberto Griggio, Monokee’s CEO. Roberto graduated in Computer Science from the University of Venice, Italy and sports more than 20 years in identity and access management and related fields. On the technical working groups and task forces, Monokee will be represented by Dr. Mattia Zago, Monokee’s SSI Solutions Architect. Mattia holds a Ph.D. from the University of Murcia, Spain, specifically dedicated to cybersecurity and artificial intelligence subjects. 

“Joining the ToIP Steering Committee represents a significant milestone for me as a researcher and us as an identity company,” said Dr. Zago. “Seeing that the community is aligned with our view of a hybrid integration between federated enterprises’ services and decentralized identities further increases our motivation to pursue it. Indeed, we will keep pushing forward our identity orchestrator to provide seamless (and codeless) integration experiences for security engineers.” 

Monokee believes a formal definition for the authentication and authorization processes is critical for integrating IAM/IGA solutions. Despite the importance of this aspect, most contemporary solutions require a non-negligible amount of engineering effort to connect identities, attributes, applications, flows, protocols, and many other elements.

Monokee simplifies this process with its Visual Identity Orchestrator (VIO), a drag-and-drop interface to build your authentication processes from scratch, starting from predefined blocks and connecting them in a flow-chart fashion as illustrated below.

Each block and connector in the resulting map represent parts of the process in a virtually codeless environment: Monokee’s visual builder turns that map into computer-generated code, with no room for human errors. The VIO is also a major improvement for process management. For example, adding an authentication factor in an existing process is just a matter of dragging a new block into the chart and inserting it into the flow.

The abstraction provided by Monokee’s VIO aligns perfectly with the vision of the ToIP foundation of an interoperable web of trust. Specifically, Monokee aims to bridge the gap that exists at layers 3 and 4 of the ToIP stack between classic centralized and federated ecosystems and new decentralized services and resources. While this obviously involves technical challenges, the real interoperability questions reside in the governance framework that coordinates the topmost ecosystem layer: how to embrace the new trust paradigm without tossing away the achievements of the last decade?

Monokee envisions a hybrid world capable of taking advantage of the structured, well-tested, and effective IAM solutions while incorporating decentralized and distributed elements to improve end-user privacy and usability. Monokee plans to provide resources and workforce to help ToIP working groups achieve their 2022 objectives, starting with the ToIP Technology Architecture Specification, anticipated for release in September 2022.

EIC 2022, held May 10-13 at the the Berlin Conference Center, had a strong ToIP presence, including Director of Strategic Engagements Judith Fleenor and Steering Committee members André Kudra (esatus), Bryn Robinson-Morgan (Mastercard), Christine Leong (Accenture), Drummond Reed (Avast), Mike Vesey (IDRamp), and Scott Perry (Schellman). Other ToIP members in attendance included Trinsic, IDunion, and Sezoo.

Our first collective takeaway was that identity conferences are back! This was the first full-scale EIC since 2019, and although still in hybrid form, in-person attendance was very strong. Vendor booths and conference sessions were quite busy, and there were four full tracks on content from midday Tuesday through Friday. “EIC was a wonderful opportunity to connect with colleagues old and new, with a shared mission to advance digital trust.” remarked Bryn “I was impressed by the interest in the ToIP stack and the recognition that to achieve interoperability on a global scale we must address both technology and governance issues.”

Our second major takeaway was that decentralized identity is a very hot topic. One of the four conference session tracks was devoted entirely to this new branch of the industry, and references to SSI and verifiable credentials were sprinkled throughout the keynotes. André noted: “Federated identity solutions are broadly used globally today and it’s great that there’s now such huge interest to infuse SSI to it. To ultimately arrive at a truly decentralized online identity world, embracing what’s already out there is inevitable.”

On that note, Judith spotted numerous examples of SSI terminology being “co-opted” to describe products and services that did not in fact follow SSI and ToIP design principles. This is both a good thing (because the speakers wanted to be associated with SSI) and a bad thing (because they are mis-using the terms).

A third major takeaway was that the world of federation wants to join the world of decentralization. One of the major announcements from the conference was the OpenID Foundation white paper entitled OpenID for Verifiable Credentials. To quote from the OpenID website:

The goal of this whitepaper is to inform and educate the readers about the work on the OpenID for Verifiable Credentials (OpenID4VC) specifications family. It addresses use-cases referred to as Self-Sovereign Identity, Decentralized Identity, or User-Centric Identity.

This theme was further reinforced by a series of sessions on GAIN, the Global Assured Identity Network, whose original white paper described it as an OpenID “federation of federations” that aims to bring “roaming” to existing bank ID networks around the world. At EIC, GAIN was working hard to “broaden the tent”, inviting Judith to join their final panel with 11 different speakers talking about the GAIN vision of a globally interoperable network for high-value digital identity credentials. 

Judith did a wonderful job speaking to how that vision aligns with ToIP’s mission while advocating that, while federation technologies like OpenID are fine for enterprise usage, true global interoperability can best be achieved with a network of networks based on the ToIP protocol stack. She summarized the benefits of using standardized protocols rather than technical API specifications as: “OIDC for the enterprise, ToIP for the Internet”.From a ToIP perspective, the highlight was our 40-minute panel called “The Stack, the Stack, the Stack: How ToIP is Enabling Internet-Scale Digital Trust”. Judith moderated the panel consisting of André, Bryn, Christine, and Drummond sitting in front of a full-screen image of the ToIP stack.

The session drew a packed audience, and this panel format proved to be a very effective way to share the ToIP vision. At the close of the panel, we were swamped with many more questions than we had time for. We spent the next 45 minutes outside the room talking with attendees about the ToIP stack, the ToIP Foundation, and how our solution to interoperability can be applied to the European Digital Identity Wallets initiative.

This strong interest in ToIP reflects our final major takeaway from the conference: the European Digital Identity Wallets initiative is generating intense interest in interoperability. Many EIC sessions touched on different facets of the interoperability questions facing the “toolbox teams” from each of the 27 EU member states working to develop their own digital wallets. Furthermore, these questions are not limited to technical interoperability—governance is also a major concern.

“The privacy-preserving and citizen-empowering advantages of decentralized identity and verifiable credentials are clearly what is driving the EU initiative,” said Governance Stack Working Group co-chair Scott Perry. “However much of their thinking on governance is still rooted in federation technologies, so this is an area where ToIP’s work on governance frameworks can really help.”

As a final highlight, Italian digital identity company Monokee, whose Solutions Architect Dr. Mattia Zago presented on “Hybrid Central/Decentralized Identity: Deployment strategies for SSI”, was impressed enough by the ToIP presence at EIC that by the end of the conference Monokee had joined as our newest Steering Committee member. 

“Joining the ToIP SC represents a significant milestone for me as a researcher and us as an identity company,” said Dr. Zago. “Seeing that the community is aligned with our view of a hybrid integration between federated enterprises’ services and decentralized identities further increases our motivation to pursue it. Indeed, we will keep pushing forward our identity orchestrator to provide seamless (and codeless) integration experiences for security engineers.” 

Welcome Monokee!

by Mike Vesey, CEO, IdRamp, and Karl Kneis, COO, IdRamp

Understanding the decentralized identity (DCI) market can be challenging. Inspiring C-level decision makers and IT executives to adopt decentralized identity technology is even more difficult. Current research publications provide limited insight with inconsistent ideas and terminology. Anyone interested in DCI adoption can quickly get lost in an ocean of information that raises more questions than answers. What is the solution? Decentralized ID, Self-sovereign ID, Blockchain ID, Web 3.0 ID, Personal ID, Verifiable Credentials, DID or are they all the same thing? Is the technology production-ready or a next-generation innovation to be considered in the future? 

After spending a great deal of time working with enterprise C-level teams on complex digital identity problems, one thing seems clear. When it comes to decentralized identity solutions, many business sponsors do not yet understand how DCI can provide practical answers to immediate frontline business problems. This climate creates the impression that decentralized identity is interesting but not ready for prime time adoption.

Business leaders want to know

Business leaders want to know: 

• How can I use decentralization to make identity management easy to deploy and operate? 
• Is it possible to add new features and business requirements without investing in long, expensive projects? 
• How do I adapt this new technology without re-platforming every few years? 
• Is it possible to enable decentralized identity with the systems I have to grow it at a speed and cost I can afford?

Prominent decentralized identity initiatives are often presented as pilots or innovation projects. Popular decentralized identity community discussions prioritize solving large social problems over business solutions that drive mass adoption. Understandable for a new bleeding edge technology, but the good news is DCI technology is ready for mainstream adoption now. With careful listening, collaboration and education, we can dispel misunderstanding and help business sponsors understand that decentralized identity is the best possible solution for problems they have today. 

Most C-level executives do not understand the complexities of SAML or OIDC, but they do understand that solutions using these protocols help solve their business problems. We need decentralized identity to reach that same level of understanding in terms of reliability, comfort, and adoption. 

Decentralized Identity needs to become ID

Shifting the conversation to the perspective of people who actually buy technology is an effective way to speed up adoption. Business leaders need proof of value, battle testing, and technical maturity. Decentralization will prevail based on measurable business results. DCI is not in battle with centralized systems; it is simply a better business solution for modern problems.

Focusing on familiar business performance indicators goes a long way in moving DCI out of the innovation lab and into mainstream adoption. Does decentralized identity help me save or make money? Is it more expensive than what I have today? When a business spends millions per year on centralized SSO and learns how decentralized identity based authentication can solve the same problem with stronger protection at less cost. That business will find value and interest in DCI adoption.

Ultimately, decentralized identity needs to become digital ID in the minds of business leaders. Trust architecture needs to be easy to understand and use. Businesses do not have time to navigate the ideology and technical complexities. They need education that speaks directly to their business problems today. Trust Over IP (TOIP) models, guides,and specifications are powerful business tools to help drive learning, transformation and adoption. You can use the growing list of free information published on the TOIP Deliverables page to help educate and transform your organization through DCI.

Perception is reality

A few common misunderstandings that come up in our business adoption conversations include:

• Decentralized identity is not just a solution for social issues, it is pain relief for front line business problems. Decentralized identity will provide superior results if you need Zero Trust, Password elimination or fraud prevention.
• Decentralized identity does not equal loss of control. It is a more effective way to manage and protect digital business.
• Decentralized identity adoption does not require re-platforming and heavy investment in line with past ID platforms. We can quickly deploy it with incremental adoption and easily combine it with all other ID services.
• Decentralized identity governance complements existing IT operation models and standards. It does not require a total change to current procedures.
• Decentralized identity service management does not require significant HR changes, custom development skills, or advanced technology resources. Existing IT teams can easily deploy and operate DCI systems with the people they have today.

That all sounds simple enough to explain, but how do you make it happen? Business sponsors need evidence to justify the investment. They need to see it in action. Our next post will focus on how we help overcome decentralized identity adoption through decentralized orchestration. This simple but powerful strategy provides an easy path for adoption and innovation.

Stay tuned.

Read More

Read More

Read More

Read More

Read More

When it was launched in May 2020, the ToIP Foundation summarized its mission in a single 20-page white paper called “Introduction to Trust Over IP”. This paper was based on an article called The Trust Over IP Stack published in the December 2019 special issue of IEEE Communications Standards Magazine called The Dawn of the Internet Identity Layer and the Role of Decentralized Identity.

Two years later, with ten times more members and double the original number of working groups, the Foundation is a much more mature organization. Despite this growth, we are very pleased that the original vision of the ToIP stack has stood the test of time.

In summer of 2021, we put out a call to all ToIP members to participate in a series of “community writing workshops” to collaboratively produce two new Foundation-wide deliverables:

1. Introduction to ToIP V2.0 (PDF)
   This is the second-generation version of our original introductory white paper that would go more deeply into the origin and purpose of the ToIP stack and how it addresses the key challenges of decentralized digital trust infrastructure.
2. Design Principles for the ToIP Stack V1.0 (PDF)
   This is an articulation of the key design principles we must follow in the design and development of all aspects of the ToIP stack.

We were thrilled that over two dozen members took us up on this challenge to participate over four months to produce these two documents, both of which have just been approved by the ToIP Steering Committee.

Introduction to ToIP V2.0

Our primary goal with this second-generation white paper was to make the vision and mission of ToIP accessible to a general audience—literally anyone who cares about the future of the Internet and how we can deal with the myriad security, privacy, data protection, and data sovereignty issues that have emerged as “the world’s greatest information utility” passes its first half-century of growth.

Our second goal was a “plain English” explanation of the overall structure of the four-layer, two-half sided ToIP stack using new graphics based on the wonderful interactive version developed by Peter Stoyko of Elanica. Here is the new static version of the diagram:

Our third goal was to provide a more complete introduction to the ToIP Foundation as a collaborative organization devoted to the design, development, adoption, and promotion of the ToIP stack—a guide to helping prospective members understand how and why to engage.

The resulting document is divided into the following sections:

• ToIP in a Nutshell
• Why Has Digital Trust Become Such a Major Problem?
• The ToIP Model for Digital Trust
• Applying This Model to the Digital World
• The ToIP Stack
• The ToIP Foundation
• How to Engage with the ToIP Foundation
• The Road Ahead

It is available as a PDF document here and on the homepage of the ToIP Foundation website. 

Design Principles for the ToIP Stack V1.0

To establish a truly interoperable decentralized digital trust layer for the Internet as a whole, meticulous attention must be paid to the design of the ToIP stack. Given the tremendous growth of the ToIP Foundation—from 27 original founding member organizations to over ten times as many today—it was critical to form a strong consensus among the new members about the principles governing this design.

Another key reason to establish design principles for the development of a system is summarized in this quote from the start of the document:

The goal of any design principle is to provide guidance to the designers of a product, service, or system so they can take advantage of lessons learned from the success or failure of previous designs. Design principles represent accumulated wisdom that falls in between the generality of scientific laws and the specialization of best practices.

When it comes to a layered architecture for both technology and governance of decentralized digital trust infrastructure, the “lessons learned from the success or failure of previous designs” is prodigious. Thus the writing workshops for this document continued for four months in order to bring all the relevant design principles together.

To organize the final set of 17 principles into a logical progression, we followed a rubric suggested by co-editor Victor Syntez based on a 2006 blog post by cryptography pioneer Nick Szabo. Szabo distinguished between two types of “code”:

1. Code written in a computer language expected to be executed by a machine (“dry code”), and
2. Code written in a human language, i.e., laws, regulations, rules, policies and other forms of governance expected to be followed by humans (“wet code”).

Accordingly, we divided the principles into three categories:

1. Principles of computer network architecture—these “dry code” principles represent fundamental lessons learned about the design of large-scale computer networked systems, especially the Internet:

#1: The End-to-End Principle

#2: Connectivity Is Its Own Reward

#3: The Hourglass Model

#4: Decentralization by Design and Default

#5: Cryptographic Verifiability

#6: Confidentiality by Design and Default

#7: Keys at the Edge

2. Principles of human network architecture—these “wet code” principles represent fundamental truths about how trust relationships operate between humans—either individually or in groups:

#8: Trust is Human

#9: Trust is Relational

#10: Trust is Directional

#11: Trust is Contextual

#12: Trust has Limits

#13: Trust can be Transitive

#14: Trust and Technology have a Reciprocal Relationship

3. Overall design principles—these three remaining principles apply to the overall design of the ToIP stack, “wet or dry”:

#15: Design for Ethical Values

#16: Design for Simplicity

#17: Design for Constant Change

Care was taken to not only explain each principle in plain English, but to analyze how it applies to the design of the ToIP stack at each layer. We summarized those recommendations using this table format:

Layer	Relevance	Explanation
		The ecosystem symbol represents the purpose of Layer 4 to support the applications needed to develop and sustain entire digital trust ecosystems.
		The triangle symbol represents the Layer 3 verifiable credential “trust triangle” of issuer, holder, and verifier that enables parties using the ToIP stack to establish transitive trust.
		The symbol of two connected mobile phones represents the purpose of Layer 2 as a universal peer-to-peer secure privacy-routing DID-to-DID communications protocol.
		The anchor symbol represents the purpose of Layer 1 public key utilities to provide strong anchors for Decentralized Identifiers (DIDs) and their associated public keys.

For each principle, in the “Relevance” column we assigned star ratings for each layer as follows:

★★★★★	Highly relevant to the design of this layer
★★★★	Very relevant to the design of this layer
★★★	Moderately relevant to the design of this layer
★★	Somewhat relevant to the design of this layer
★	Only slightly relevant to the design of this layer

Once all 17 principles had been compiled into a document with this format, the contributors felt that we had identified the “center of gravity” of the design of the ToIP stack that could now guide our work in completing it.

We strongly recommend this document for anyone who wants to deeply understand the rationale for our work at the ToIP Foundation. It is available as a PDF document here and on the homepage of the ToIP Foundation website. 

Acknowledgments

Our thanks to Victor Syntez and Drummond Reed for serving as co-editors for these two documents and to the following ToIP members who contributed their time and expertise:

Introduction to ToIP V2.0

Design Principles for the ToIP Stack 1.0

Carly Huitema Daniel Bachenheimer — Accenture Darrell O’Donnell — Continuum Loop Jacques Bikoundou Judith Fleenor — Trust Over IP Foundation Kaliya Young — COVID-19 Credential Initiative Karen Hand — Precision Strategic Solutions Karl Kneis — IdRamp John Jordan — Province of British Columbia Lynn Bendixsen — Indicio P. A. Subrahmanyam — CyberKnowledge Sankarshan Mukhopadhyay — Dhiway Networks Scott Perry — Scott S. Perry CPA, PLLC Vikas Malhotra — WOPLLI Technologies Wenjing Chu — Futurewei

Antti Kettunen Daniel Bachenheimer — Accenture Daniel Hardman — SICPA Darrell O’Donnell — Continuum Loop Jacques Bikoundou Jo Spencer — 460degrees John Jordan — Province of British Columbia Jonathan Rayback — Evernym Judith Fleenor — Trust Over IP Foundation Lynn Bendixsen — Indicio Mary Lacity — University of Arkansas Michel PlanteNeil Thomson — QueryVision P. A. Subrahmanyam — CyberKnowledge Rieks Joosten — TNO Sankarshan Mukhopadhyay — Dhiway Networks Scott Perry — Scott S. Perry CPA, PLLC Steven McCown — Anonyome Labs Thomas Cox Vikas Malhotra — WOPLLI Technologies Vinod Panicker — Wipro Ltd Wenjing Chu — Futurewei

by Jan Lindquist, Neil Thomson, Burak Serdar, Paul Knowles, Christoph Fabianek, Phil Wolff

Introduction

Europe’s Data Governance Act (DGA) reached a milestone. The European Parliament announced it “…reached a provisional agreement on a new law to promote the availability of data and build a trustworthy environment to facilitate its use for research and the creation of innovative new services and products.”

What does the Data Governance Act mean to the ToIP framework and the SSI community?

Background

The DGA defines an “intermediary” that facilitates processing and sharing of data for individuals and organizations to “…increase trust in data intermediation services and foster data altruism across the EU”. In the MyData framework for user-controlled data sharing, intermediaries are called MyData Operators and there is a certification program in place. (See references at the end of this blog post.)

The DGA intermediary has a trusting relationship with the individual. There cannot be any conflict of interest in sharing the data from the individual. In the eyes of the Act, the sharing of the data shall foster “data altruism” across the EU.

To achieve this goal, DGA provisions a certification program and rules for some public-sector data.

SSI Data Sharing Models

The Data Governance Act introduces new roles into data sharing and will set up the necessary governance for a more transparent and accountable data economy. Two main actors are introduced called Data Sharing Service or Intermediaries [refer to chapter III, Requirements Applicable to Data Sharing Service in Data Governance Act] and Data Altruistic Organizations [refer to chapter IV, Data Altruistic in same reference].

Neither of these actors shall have a financial incentive that conflicts with representing a Data Subject when personal data is made available to Third-parties or Data Using Service. The following diagram has three SSI data sharing models.

A business or organization collects personal data and shares it with a third-party often in proprietary and closed interfaces. A non-proprietary health care data exchange interface is FHIR from HL7 which created an open interoperable standard.

A cooperative or intermediary represents the individual when sharing personal data. The sharing shall be standardized and interoperable between different suppliers.

A non-profit organization, acting altruistically, facilitates sharing of data that are in the public institution’s domain. The public institutions may, for example, be health care systems.

Some similarities can be drawn with the Verifiable Credential model where the Data Subject is a Holder, an organization is the Issuer and a third-party is a Verifier.

The DGA adds intermediaries to the ToIP framework

The key difference is addition of the Intermediary. The Intermediary represents an agent for the Holder (Data Subject) which has direct control of processing of personal data through a policy engine. Figure 1 shows the ToIP framework with the actors introduced in the Data Governance Act.

Two layers or paths when performing data exchange are described in the diagram.

• A data path (yellow arrows) composed of Verified Credentials (VCs) and interfaces to a data repository.
• A control path (green arrows) that sets the conditions for personal data usage, given through a data subject consenting to collecting, processing or sharing of personal data.

Each actor in the diagram has three different role types: a data role, a Distributed Ledger Technology (DLT) role, and a privacy role.

• The data role represents Data Subject who the collected data relates to, the Data Source that collects the data, the Data Sharing Service that processes the data prior to sharing the data, and Data Using Service which provides services based on the shared data.
• In addition to the standard DLT roles an additional role called Intermediary is introduced. As described before, the Intermediary facilitates the processing of data on behalf of the Data Subject prior to sharing with a third party.
• The privacy roles are the standard Data Controller/Processor, Data Subject, and Third-party. To better understand the Data Subject, it is split into two, a client and an agent. The Data Subject has direct control via the Client. The Agent allows the Data Subject to delegate control to the Agent (as a proxy).

The final aspect to understand are the key functions to enable the Intermediary to act on behalf of the Data Subject. The Intermediary requires a privacy function that applies the transformation and the privacy control selected by the Data Subject. For example the Data Subject may give consent to processing anonymized personal data that would be controlled by the privacy engine. The storage function may be in a wallet or a pseudonymized database with restricted access.

Summary

While it may look like most of the work in ToIP relate to VC’s, there is also the work from Inputs and Semantics work group that look at standardizing the storage, portability of the personal data, and creating a layered schema that helps with setting the policy engine when preparing and sharing of the data.

The Data Governance Act can be supported based on the technology being promoted in ToIP Working Groups. The work underway in ToIP Working Groups are aligned with the specific requirements of the Data Governance Act. Both ToIP and the DGA are avoiding a pervasive data ecosystem that promotes the surveillance economy. We both put a data exchange with humans at the center of any data transfer.

A future blog post will look at the Digital Markets Act in relation to ToIP. When an organization exceeds a threshold of users and net income, they are required to adhere to the rules of a Gateway stipulated by the Digital Markets Act. More in the next post.

References

• Promoting data sharing: presidency reaches deal with Parliament on Data Governance Act, November 30th 2021
  https://www.consilium.europa.eu/en/press/press-releases/2021/11/30/promoting-data-sharing-presidency-reaches-deal-with-parliament-on-data-governance-act/
• HL7 FHIR
  http://hl7.org/fhir/
• REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on European data governance (Data Governance Act), November 25th 2020
  https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020PC0767
• MyData Operators
  https://mydata.org/mydata-operators/
• Digital Governance Act proposes sharing data for the public good and selflessness – the concept of Data Altruism, January 28th 2021
  https://eudatasharing.eu/news/digital-governance-act-proposes-sharing-data-public-good-and-selflessness-concept-data
• The Digital Markets Act: ensuring fair and open digital markets
  https://ec.europa.eu/info/strategy/priorities-2019-2024/europe-fit-digital-age/digital-markets-act-ensuring-fair-and-open-digital-markets_en

Read More

Read More

Read More