In an article published on February 22nd, Blocksplained did a great job of describing the role our personal identities serve when we engage with the modern global economy:
“The traditional financial world relies on identity as a foundation for business. Institutions such as banks and insurance companies require their clients to provide identification documents to open accounts and access their services. These institutions are also legally obligated to perform Know-Your-Customer (KYC) and Anti-Money Laundering (AML) checks to prevent fraud, money laundering, and terrorism financing.”
Blocksplained
He touched on another important fact in “Self-Sovereign Identity on the Blockchain: The Future of Digital Identity” – the existing identity systems around the world rely on the authority of government.
“Governments are often the issuer of identification documents, providing a unique identity to citizens using a minimum set of specific qualities or attributes. Legal structures facilitate this model within and between countries, providing a reliable way to authenticate identity, particularly in the absence of any universal Trusted Third Party.”
Blocksplained
The existing system has proven to be a ‘reliable way to authenticate identity’ that has helped connect the world with trade and tourism on levels never imagined, but it has also excluded a massive portion of the world’s population. The centralization risk inherent in government-controlled processes presents a unique challenge to the development of a holistically beneficial and sustainable global identity system.
The concept of self-sovereign identity on the blockchain inspires thoughts of a future where each individual has authority over their own identity. Currently, personal identity is not respected as a basic human right. The global community should only expect to see economically vulnerable countries and communities continue to suffer and fall behind without comprehensive identity solutions.
There are several decentralized identity projects being developed on Cardano, each with their own unique approach. One of these solutions is Atala PRISM, a project seeking to provide users with control over their personal data while maintaining privacy and security. At its core, Atala PRISM is a tool for creating a verifiable digital identity that can be used across various platforms and services.
Imagine having a digital, tamper-proof record of your identity, which can be verified by others around the world (contingent on your consent) – no need for centralized authority. Do you think centrally permissioned identity systems are sustainable?
Atala PRISM: Foundations
Last year, I was lucky enough to be able to attend Consensus in Austin, TX. It took place during a very hot and humid mid-June. Cardano had an amazing booth and a great showing at the event. At some point in the weekend, I received a swag bag with a workbook inside titled “Atala PRISM: Foundations”. It serves as an introduction to the concept of self-sovereign identity and details the blockchain approach that makes it possible.
Identity
In Foundations, the Atala PRISM team reminds us how often we use our identity in daily life.
“Every time we use a cellphone, social media, email, text, access a bank account, or turn the lights on, we engage our identity… We may stand in line at our local coffee shop and engage with a stranger… While we wait for our coffee, we may be texting friends, browsing social media, or talking to someone on the phone… We would easily add dozens of interactions during the few minutes we’re waiting…”
Atala PRISM Team
Over the course of a normal day, we may have thousands of unique connections that engage our identity on a personal and business level.
Identity Models
There are different approaches to managing identity that each offer their own benefits and drawbacks.
Centralized Model:
“Examples include government ID numbers, passports, social media handles, cellphone or internet providers, etc… A user in this model must get permission to have an identity from the provider.”
This model isn’t unworkable, but it’s not optimal. Key features are missing.
Federated Model:
This model is an improvement to centralized, but it doesn’t address its main problems. There are numerous identity providers who allow you to use your login credentials to access a variety of services and organizations online. Familiar identity providers include Facebook, Google, GitHub, Twitter, Amazon, Instagram, etc.
Self-Sovereign Model:
Cryptography unlocks the power of the decentralized identifier (DID), which is the concept at the center of this model. “A DID is like a fingerprint—its unique to the individual, and we can have more than one, just like we have multiple fingerprints.”
There is no centralized authority required. An ecosystem of ID holders, issuers, and verifiers can exchange data securely and efficiently. According to the Sovrin Foundation, there are twelve principles that guide the self-sovereign identity movement:
- Representation
- Interoperability
- Decentralization
- Control and Agency
- Participation
- Equity and Inclusion
- Usability, Accessibility, and Consistency
- Portability
- Security
- Verifiability and Authenticity
- Privacy and Minimal Disclosure
- Transparency
How Does it Work?
In Foundations, the Atala PRISM team says, “Zero-knowledge proofs (ZKPs) are cryptographic functions… The purpose of a ZKP is to prove something without knowledge—meaning having the ability to prove something without exposing the details.” A great real-world example of where a ZPK can come in handy is the local pub.
“Today, we show an ID to a stranger containing our name, address, and date of birth, amongst other details—in a location where our inhibitions may become impaired. The question is: what does the pub need to know? It is not my age but whether or not I am old enough to consume alcohol.”
Atala PRISM Team
This cryptographic breakthrough makes it possible to change the way we share and protect our private identity information. The blockchain enables this fundamental shift thanks to its balance of auditability and hashing privacy.
Holders, Issuers, Verifiers
“We must realize that there is no ‘collective moral intelligence’ living in the cloud that can substitute for genuinely attentive and empathic human perceptions… So whatever we do, let us not concede our most basic moral capacities to the contingencies of the market or the illusion of a hive mind.”
Atala PRISM Team
Let’s see how the self-sovereign system works to benefit the global collective by fortifying the rights of the individual.
Holder – “A holder is an entity that has and controls a decentralized identifier (DID). Holders can make connections with other entities and share information with them.”
Issuer – “Issue credentials to those whom they have connections. An issuer cannot send credentials to random holders. There must be an established relationship.”
Verifiers – “Authenticate or verify the credentials that get presented to them.” There will be different assurance levels requiring different authentication demands depending on the importance of the credentials (think ‘cellphone rewards program vs. acquiring a passport’).
Trust Frameworks and Registries
We interact with others by using trust frameworks, often without even realizing it. For example, “[A] medical board… derives its authority to issue licenses from a regulatory body. This authority is how and why we confidently trust credentialed doctors…”
These frameworks depend on sound governance to maintain trust. “Governance in this context means those who govern who can issue, receive, and verify a credential. The body can consist of a single entity or thousands. There is no limit to the makeup of these bodies.”
Once a sound structure for regulation and governance has been established, a ‘Trust Registry’ containing “a list of entities that are permitted to issue credentials” can be implemented. This list would be maintained by the governance authority, updated each time a new Issuer enters the system.
The Extended Trust Diamond
I think it is fair to say the Extended Trust Diamond accurately depicts the Atala PRISM Team’s vision for the future of self-sovereign identity. The goal is to respect a DID Holder’s privacy and their individual rights while also striving for efficiency and usability.
At first glance, the diagram can appear ominous because it contains a ‘Governance Authority’ managing a ‘Trust Registry’. However, when I remember the ‘Governance Authority’ could be a transparent body of thousands of entities, each selected in a straightforward and unambiguous way, I feel much more bullish about this concept.
Ethiopia
There’s progress being made in Ethiopia to implement “a national student and teacher ID and attainment recording system based on blockchain.” Despite being one of the oldest nations in existence, the 100 million plus population of Ethiopia still doesn’t have a comprehensive educational certificate system. This is a fundamental trust framework that helps a society advance in the modern world. According to their website: “Atala PRISM’s identity solution enables [Ethiopian] authorities to create tamper-proof education credentials for 3,500 schools, 5 million students, and 750,000 teachers.”
DISH Telecommunications
Do you remember the Cardano Summit in 2021? There was a huge announcement that kicked off the event: DISH Network Corporation was interested in Cardano! Shockwaves rippled through the crowd, this was truly game changing news. “[DISH] has taken the first step towards the launch of a decentralized identification and loyalty system built on blockchain technology designed and developed by Input Output.” A large American company offering ‘satellite television, audio programming, satellite internet, and interactive television services’ to nearly 9 million customers is using Cardano and Atala PRISM. It will be an exciting development when a blockchain based customer ID is launched on DISH, hopefully it will create new value for their customers, Cardano, and the company as well!
United in Sovereignty
Identity systems worldwide are overdue for an update. Without control over our personal identity, all other rights and privileges we enjoy will inevitably be exposed as illusory with time. A dispersed collective of individuals, each with sovereign control over their identity, representing regions from all over the world, interacting on a mutual baseline of verified trust. This could be a leap forward for humankind, a epoch shift if you will.
There are many burgeoning decentralized identity projects using Cardano in some form or fashion. I personally am rooting for each one of them to be successful, assuming their solution will ultimately serve to empower the end user. Atala PRISM is a project to watch in this field.
Atala PRISM (2022). Foundations [Workbook].
