Enabling Trust Through Decentralized Secure Identity

Transcript

Okay guys, thank you so much. Um, we will now be welcoming to the stage Sandro Kenupul. I can almost do that last name. Uh, to present a master class enabling trust through decentralized secure identity. Please help me welcome him to the stage. Thank you so much. Lovely. Um, it's great to be back to be here again. Uh it was actually fun fact four years ago the first time at uh CBC uh downstairs and I've started a presentation back then with trust because when we go back what was blockchain being aimed for we want to create a new social and financial system where we can reestablish trust and today we speak about trust through

decentralized identity. So back to the topic of trust and the big problem we face is that trust is actually collapsing on a global stage. We see this amongst various aspects. I speaking a lot to enterprises nation states as an example. One of the big issues is how secure is my data when I look into a global environment and I store my data with one of the service providers as I have them today which is mostly driven out of the US. How can they access my data based on the cloud act based on visa? There are various different ways how data can be um accessed compromised or actually blocked depending on uh your status being it uh that you

unfortunately land of a sanction list or whatsoever. So it becomes a very very big topic and we at the Cardano Foundation want to address this because building critical infrastructure which is our core mission is actually very close tied to identity. Everything on the net, every data has an identity and I will come back to this in a bit more details. So when you speak about digital trust issues in a very bold way, we can say we are in a new era where nothing can be trusted which is on the web. We know this when we speak about actually fraud from impersonating. So back in the days we believed a bit that uh if I'm being approached by you that I trust that it's your email address. Over the years we have experienced that we have

this fraudulent attempts which in the early days have been a bit easier to identify. We can look into the is there a uh spelling mistake, grammar mistake whatsoever, you can identify some of the things but they're becoming more professional and it's not only text but it's also video these days. So unfortunately, I'm pretty sure if there would be an expert in here, by the end of this uh 30 minutes, someone could actually right now record my voice and my face and put a video on YouTube which uh mimics my movements, my voice and share fraudulent information or tries to create some incentives which are not coming from me. So the personal impersonation is a very very big topic which affects individuals, enterprises,

nation states amongst the world. Cyber crime is becoming more trivial. So back in the days it did cost also a bit something to attack a large enterprise. So let's say the United Nations on scale you needed to put quite some money in there. uh you need to social engineer a bit behavior security systems and this became more trivial due to the rise of AI. AI is a key contributor when you think about how we interact today with each other but also how I learn about yourself. So the more information I have, I can start to easily dig into your personal behavior and with large language models, we can actually create easy attack vectors and thus spam

enterprise and governments on a global scale. So this is a big issue we face today and we have heard it before as well a bit on the presentation uh when we speak about the different type of identifications. Just to give you a couple of numbers. I don't want to bore you too long here, but we do see 30,000 websites are being compromised on a daily basis. Just when you imagine this, this is quite a heavy hit. But even more uh incredible is actually the rise in AI fueled fraud surge. It's over there on the on the map. You can see these numbers are percentages.

So AI really really fools these attack vectors. And how can we prevent it? This is where I'm coming back to now. There has been a very nice data breach report from IBM in 2024 and I want to just ask the audience here quickly what do you feel on average once a data breach contains how much time does it take on average uh an enterprise to identify this breach? Do we speak about minutes, hours, days, weeks, months? What would you assume? weeks, six months.

Perfect. That's that's a very nice answer. And that that's true on the when we be more on the on the analytics here, it's 258 days. So what does this tell us? If the data breach happens today, the attacker has 258 days to actually go wild west on your data, find relevant data, temper data, misuses data and this is where the problem lies. We don't we cannot react on time to actually fight these uh attack vectors. So the need for verifiable future is to actually recognize a data s source uh immutably.

So if I receive an email, a phone call, whatever it is, I need to identify the source of the sender in an irrevocable way which needs to be trusted. We need to verify this. It needs to be globally spanning globally. only when we speak about geographically but it's also industry agnostic so we need to apply this amongst different industries and standards standards is something which I think it's very important here as well to be mentioned and we need to actually have uh organizational identity I'm coming back to this we have heard it in the previous presentation that we have different identities and I will I will allude to this a bit and organizational

identity is paramount in our you. So, uh, imagine a world and again here we heard a bit of that before, but where you can actually trust that all the responses or the requests you receive are legit. So, just assume your bank is sending you an email. I have this every now and then that I receive emails, uh, texts or whatsoever from banks, DHL, many, many brands, uh, which claim to have an issue and want to have some sensitive data from me and they're becoming better and better. We have seen it this year. Post finance has been uh once a bit the target. They they really they're really good in faking the logo the way they uh articulate themselves and also the email addresses. So it

becomes more complicated. Now imagine a way where you don't have to be scared is this legit but where you know by heart due to a verifiable credential it must be from you. It cannot be from another source. That would be amazing wouldn't it be? We heard it before the password issue. We all struggle every couple of weeks or months depending on the application and websites you use. You need to change your password. They're becoming more complex. You have hundreds of password. How do you manage them? Most likely you use the same password over and over again which is a huge attack vector. So please don't do it. Uh the other side is you can run a spreadsheet which is also not that ideal. Then you can use password natural

whatsoever confederated systems. Uh that's a problem. Now imagine what is a federated system doing. It helps you to be easily navigating yourself among browsers, not using every time a new password. But having a federated password manager with as an example Google whatsoever, you also allow them to track your activities and your behavior. So you become a bit transparent here. So imagine a world where you no don't have passwords and no configur configurated confederated login but you have your own identity which will be applicable amongst your journey uh in the web pitching attempts as I mentioned a bit before uh would be

pretty much impossible because if I have this enterprisegrade identity I cannot impersonate to be from DHL without being there and having an identity which is actually issued and verified through the relevant um issue and verifier. So security breaches coming back to the 258 days we have seen before they can also if something happens will be detected immediately and you can stop the attacker before he actually gets access to to your data to to your sensitive data. This would be the dream. That's what we are aiming for. And what did we do at the Cardona Foundation to address this to achieve this is we had a couple

of workshops we traveled around the globe speaking with different identity solutions and I agree with you we don't have to reinvite the re reinvent the wheel there are good solutions out there so it's not enough to build something from scratch but find the right partners to do this and we find the right partners with Kerry Kerry stands for key event received infrastructure and it's a fully decentralized solution this is very important at our heart that it is truly decentralized. We see a lot of identity solutions out there. Uh the Swiss government goes a bit the similar way now with the eid in the first iteration where it's somewhat decentralized but not fully decentralized. Uh but that's uh a challenge we we are taking there as

well. Um so they are building an ident they have built a protocol which is for critical infrastructure and critical security and I will give some examples as well and this is what is actually we are looking for when we speak with our target audience and how we actually imagine the web to be looked at in in the future. So it also has global interoperability at scale. That means it's applicable for financial services, healthcare universities academia whatever you want to have, it's globally applicable amongst borders. You can go cross borders and cross industries. It supports GDPR. Uh it's relevant and again here we heard that before GDPR becomes a pain and not a little pain but

a big pain for pretty much everyone who's involved with it. How can you be more efficient and cost cost efficient but also uh timely with GDPR issues and this is being addressed with carry as well. It is postquantum resistant. Why is this important? I think we all know kind of why this uh important but it's also I don't want to create an identity today which I need to replace in five years or in 10 years. Ideally I have my identity and it's with me for a lifetime. So postquantum resistancy for us as well was kind of key feature when we decided who we are going to work with. It actually allows this organizational identity I mentioned before and here I can give you some

examples then uh a bit later on but this is really going back to what we heard before organizational identity. We have the organization, you have departments, you have teams, you have individuals. These individuals maybe have different roles within the company. Then they have a private uh uh identity as well. And these needs to be managed and carry allows an infrastructure to actually issue these type of uh identities. Um from the digital trust uh venture Timothy Ruof and two colleagues from GLY uh we have this nice uh sentence which is the ability of a person or thing to prove their authority to represent an organization outside the boundaries of that organization. Sounds maybe a bit

complicated but the key is outside the boundaries. So it's easily to identify that I'm alleged actor in my company within the company. But how do you know that I'm authorized to stay here and speak on behalf of the Corona Foundation? You just believe CBC did their job. But you don't know. So how can you verify these type of things and you see that we have Gly here and Glyfe uh for us as well it's a reputable and trusted partner uh on this journey where we speak to very closely. I don't know sure if you know about GLY. GLY is the global legal entity identifier foundation. They have been established actually post uh the uh subprime crisis in 2008 where the financial stability

board and the G20 realized hey we don't know what is the exposure towards the financial institutions. Uh the the prominent one was Lehman Brothers. Uh so no one knew exactly the exposure amongst the different entities of Lehman Brothers. So they uh G20 um then gave the order to F to the financial stability board. They established Gly and Gly issues the LEI the legal entity identifier to millions of enterprises that we have a clear system how they can be identified. Clive also has verifiable leis which they worked on for the past couple of months and years. verifiable leis are built on the same technology as ours on carry and this allows the so-called VLEI the verifiable uh legal anti-identifier

and this is an accepted or uh uh yeah accepted standard which also complies with an ISO standard which I don't have on top of my head uh right now unfortunately um and can be applied in critical infrastructure as again VI for healthcare vi for financial service and amongst others so this is something which can be scaled and is accepted in the market and this is something which for us was relevant by choosing the right partner. So we built the our identity wallet which is called Vidian or the Vidian platform. It's not only a wallet. It's an infrastructure piece based on the carry protocol which is actually the backbone and I think you're going to have a quick video here. How do

you empower trust in every interaction? And how do you know it's authentic once you do? In healthcare, data compliance protects patients. In supply chains, source validation supports transparency. And in finance, network security prevents fraud. Across industries, identity verification is the foundation of trust. Yet, existing solutions fall short. Last year, data breaches affected 1.7 billion records in America. Why? Because we give up control of our credentials, data, and digital identity.

Take back control with Vidian, an open-source digital identity platform. With Vidian, your organization can protect user data and prevent fraud, support enhanced credential issuance, and ensure interoperability with verifiable data. And with the Vidian wallet, these features are right in your pocket, making self-s sovereign identity simple, privacy first, enterprisegrade, futureproof. Discover how Vidian empowers trust in every interaction.

So obviously for us um the whole um cryptography was was at the heart and that what's the backbone on the solution uh we are speaking about. So, Vidian as you have seen is a platform. We don't only speak about a wallet. There is a identity wallet which is available uh on the app stores for iOS and Android. Uh but there is more to it. So, it's actually the first uh first in the world uh carry wallet with VI integration. Uh again here this is becoming very important when we speak about enterprise grade and government grade uh uh adoption and collaborations. I will give you an example uh two examples afterwards. And it has this enterprisegrade infrastructure which

also includes a sandbox. So if we want to scale here with enterprise we understand from our own journey it's a very very complex uh topic it's not easy how can you be interoperable with different system being at legacy systems being is with new web3 applications and here it's actually a way where you can quite easily or start to integrate uh with vidian and also we support you with our team on the infrastructure side to make this happen. It also allows you to have white label solutions uh for most of the enterprises and uh organizations.

Important if you want to run your identity stack. I will give you an example of one of our collaborations we have with the UNDP that's United Nation development program. We where they said okay we want to white label this so it should not run under Aridian but under our own label which you often see in traditional uh uh businesses. So again it's a light touch integration is optional with Cardano as well. So here we actually look into the complexity of the organization uh the partner we are working with to allow a tailored integration based on the complexity uh which needs to be achieved. On top of this we are building and we are working on the uh credential management systems on the browser integration. It's clear

to us that uh speaking with enterprises governments etc and so on uh you need to have a smooth browser integration and not only a a mobile wallet. So these are things which are being deployed uh soon. So this is what we are working on. And we also have the document signing. Document signing you all know do sign and some others. Uh how can you directly integrate this into such an identity tool. Um we have this document signing integrated directly. Uh we always try to learn from experience and applied a bit in an environment where we can get critical feedback. So last year uh during the international identity workshop in the US uh amongst some of

the largest brands uh we attended and we had kind of a PC use case where we uh had our identity wallet for the browser interaction with the web shop or with the workshop where people actually created their identity to interact uh on on through the browser. Then how does this look like in reality as well? Blockchain always has a bit this problem that it's not really nice. The user experience is not the best. Um, and here it's really going back a bit to your environment you're used to. So give an easy to read to environment having dashboards that's from a sandbox environment which you can actually get access through our team uh where you can build a few where you see actually the activities the interaction the numbers

of the platform you are using and you manage your clients uh your employees or whatever identities you issue can also be a product uh on the product side I'll come back I think that's very important here just an example on how such a PDF looks like you have an NDA here and you can direct design with your digital identity on Vidian and verify uh which is verifiable on the document uh directly. I will give you three use cases quickly just to showcase a bit what does it mean from a different level. So we have Tadamon which I which I mentioned a bit before which is from the UNDP so the United Nations Development Program we have guild one and the Cardano ballot. So with Tedamon um that's actually within the UNDP an

organization or a project which works with the Islamic Development Bank and the Islamic Sustainable Federation Department to support I think it's amongst 57 member countries uh fight against poverty and they can't do it themselves. So what they have is so-called CSOS that um that's civil social organizations. So that's That's private people. They're building in a uh civil organization and they would like to support. So they need to fulfill quite a lot of requirements to be accepted as a certified cso by the UNP or here by Tadamon as they are being called and this process is very cumbersome and once they are being

certified by you how can you transmit this data amongst different silos. So when you think back when I said what's important is outside the boundaries. So I can easy transfer your message in our siloed system but how give it away in another system and when you think about 57 countries uh these things become very trivial uh very important. So, Tedon actually we have this uh platform built which you see it's uh white labelled with the Tedon logo everything and they can verify identities uh and verifiable credentials here to yell uh with the CSO certificate which can be verified amongst their journey when they want to claim as an example goods. So if

there is transportation of food and they want to claim it for distribution, they can verify that they are trusted partner of the UNDP and Tanamon and thus get access in a more uh efficient way. Another one uh is with guild one which I mentioned guild one also here important we speak about interoperability that's systems from legacy systems to web 3 but also within the web3 space when you speak from private and public uh permissionless blockchain. So Corda, you probably know R3 Corda is a private permission blockchain. Corda uh and Cardon is a a public permissionless blockchain. If you have questions, we have a booth downstairs. Please join us and uh happy to answer all these questions. So here they built a bridge to actually allow a private environment uh which uses Cardon as a trust layer.

But what's important here when you speak about VIS and we spoke about the different levels um what they did is actually this is Alberta here and every single red dot now I mean this is insane is an orphaned or abandoned wells so that's a wells in Alberta which most likely leaves Mton is one of the most uh shadow uh it's it's harmful uh thing for the environment right so yeah thank greenhouse gas. So this leaks into the air. They're abundant. They're orphans.

So no one cares. So what they did is actually they are tackling this problem. But to get the right financing for these wells, they need to prove what is happening. So what they did is actually they are putting VLE on the projects on the companies on the wells and they have sensors in the soil and with satellites and they're measuring the greenhouse uh on it. Then there will be snapshots that can be claimed. They are verified by the project through the wells and then you have a verifier. Uh you can imagine the old days you have an auditor whatsoever which actually also verifies that the data is coming from the wells and with this you can create verifiable credential which gives a traceable and an immutable um way to track the impact.

So if they have today XY Z set of kilos or tons and due to trade investment and the seeding they can actually prove how these numbers go down thanks to these type of uh transparent uh solutions and this is something which is very very important. So identity is not only you and me and our employee and the CVC but it's also any type of good where you need to have a verification against. Another uh use case we did as well, we also try to challenge a bit our own community. So during our summit last year, we always have this award ceremonies where we awarding the best projects amongst different categories

and it's not on us to vote who shall win but that shall be the community and for community to actually participate to vote. We had the Cardono ballot which was backed with identity solution to avoid that you have double voting that you actually have some some uh misuse of of of of the ballot itself and this obviously becomes important when you speak about elections when we speak about proxy votings in a traditional way how can you prove uh proxy votings not sure if any some of you are in financial services shareholder right directives addressing this uh but they're very cumbersome to fulfill in today's system um that's a huge problem and how can you make these things smoother and this is exactly where a solution like Vidian gives added value and uh resolves all

these pain points. So, Vidian and the wallet is live. You can download the the wallet. You can create an identity and we have a team of expert. Uh you see identity solutions at uh but you don't you can take a picture or just visit us in our booth here downstairs and we're happy to actually answer questions but also to help you if your enterprise if you're working for an enterprise representing uh one wants to learn more how it can be implemented in your organization. And for this also we are supporting with masterclasses. So what we do is we uh enable masterclasses for enterprise who want to learn more about identity and blockchain as such.

We have uh a free a free masterass we offer either on-site or virtually. Um please make use of it. Join us and learn more. Thank you very much. [Applause] Thank you so much Sandro. It's been great actually. Everyone's been really on time today. So, I really appreciate that. Otherwise, my job is to wag my finger at you. So, thank you so much to Sandra and the Cardano Foundation. As he said, they do have a booth downstairs where you can come by and chat with him if you have any questions from the presentation today as well. So, um, I'll let you guys, uh, adjust if you need to, and then we'll have Row Labs up next in just one