Self Sovereign e-ID Schemes & Privacy Challenges

Transcript

[Applause] [Music] so hello everybody my name is najib uni i'm the ceo of joki and also i'm the technology advisor of partisan blockchain and today i'm pleased to introduce you servant identity and i think the question about privacy we try to answer during this this talk now i hope it works okay perfect so you we know all of us that digital identity and we live in society where we give a lot of personal data to a lot of system uh if you have for example a tesla you have everything on a tesla that

to track you and connect you to the to the edge and to the clouds and we also share personal data every day in our daily life for bank for insurance for medical so we have concern about who who can trust when we share this kind of really highly sensitive data so what is first a digital id i think a good introduction about what is a digital id but for for clear let's say example here you have all of you when you enter to this room or enter to this conference you have show your your id so what you call that national id so it could be a passport an id card so this is unknown so it's paper paper printed or let's say a

plastic card geometric passport also but this is common and people used to use it but most of us we also have what we call a social account or a social media account like twitter's facebook i'll show you it's not called they changed the name today i don't remember the name it's meta so now it's meta meta account uh just a joke for dfinity the logo is really close to to your logo i've seen that this morning so maybe you should reclaim claim the the right of your logo about email accounts all of us i think we have thousands of email accounts i just joke but we create one email account just to to register for a system

and this is really pain to create every time for for register to the conference sometimes or to go to a theater or whatever we have to register on email accounts so if you look the landscape of identity model i try to be short but it is important to understand it's like uh when cardinal presents the different kind of blockchain in identity space you also have a different kind of identity model so the the first model that we all know is the centralized model and we know that the centralized model failed and i will show you after a while it failed because here we collect in a central system all your personal data all your sensitive personal data and you have seen recently that major breaches happen when

you store all your data in one place okay you have what we call also federated identity in fact you use it every day i think also on your talk dfinity you show the social login where you can choose with which login accounts you select it's also federation so you have one system that allows you the possibility to login with another account so it may help you to save the registration of another account because you already have a gmail facebook twitter so you click then you have a protocol that redirects to the to the twitter you log into twitter then you go back to the service provider so this model works today well it's federated but you need to trust the entity that give you back

the authorization to go back to the application but if you use the federated identity model behind the scene the model the the service that offer you that they see everything they see where you goes because they already like you when you go to for example to to access your e-banking may you access your passion record they see everything so they collect also they accumulate personal data but for you it's convenient so you use it and then today i'm done i'm gonna talk about what we call self-serving identity in this model you never let's say let the service accumulate too much data because here you control what they can do they can see on you and you give your consent or

not to get access to your attribute and this model is the model i'm going to talk about so just to represent the first model so the third the federation model is the central model if you look that model is one identity providers verify your identity and give you information to what we call a service provider what could go wrong with this model this this is a map that's growing day every day so the last one i think it was facebook but facebook is two times mentioning this but there is others microsoft recently also uh big films all of them have been breaches at least one time in their life and when they say breaches is your data that have been

breaches and then it's too late because you have stored all your details you know how much cost a medical record is the most important uh record sold on the dark web because it contains all your personal medical data and this is selled around marketplace sold our marketplace so if you look now the ssi system so the self-serving identity system in this model you see the user is at the middle compared to this one here you don't have the user at the middle you have the user at the bottom here you have the user at the middle and every interaction between a service and you goes to you which means that you control when someone wants to access for example your date of birth

you have the explicit consent which is requested by the service to access that information and we can see that with cryptographic protocol like them introduced just after we not even needed to disclose the debt of birth we can disclose just a proof that we're adult so let's do a game together so you know the wild game so who can find valdo here but don't please mention it you don't have to reveal where it is exactly so can you show me the solution of this problem or can you give me a hint to solve this problem so you don't have to reveal the position but you have to prove me that you know where it

is in fact you know the solution so i'm sure you know but i will give the audience a chance to to to look so there is two solutions to this problem the first one you just cut where value is so you don't reveal the exact position because you don't remember the picture here but if i just cut and give you the back i can prove that i know where i do so this is one kind of proof that give you the fact that i know where it is the second solution you do the reverse you just cut that dough and you give it to me so you have found that blow but you don't reveal the

position and this example is what we call zero knowledge proof very very basic explanation sorry but for cryptographic guys but it helps you to understand how we can prove to a service that we know something without disclosing the value and the good example is my date of birth i don't want to disclose my birthday i don't want to disclose my year of my digital id so let's look how blockchain can support a ssi system to be clear we don't need blockchain for an ssi system we need an infrastructure and i think dfinity show really well where we can publish public keys where we can publish proof of your authentic identity so

blockchain or this a decentralized system so this kind of characteristic requires to run a digital decentralized system we need anonymous and privacy is the essential part of this system because at the end if you go back to the federated or the central model then you lose privacy so you need a system where you keep your privacy strong but you need a system which is secure but also immutable then you have issue about right to be forgotten with gdpr why to raise your identity right to modify your identity so when we go to blockchain you don't have this possibility most of the blockchain we see on the place you cannot modify your transaction you cannot modify

the record so the challenges around that are mostly linkability technology scalability and storage of sensitive data and we i think uh we see on the previous example that other challenges is how you recover your identity if you lose your keys if you lose your device this is really strong challenge and i think kurt read to the floor to to try to solve and give answer about this scene yes i will elaborate more on identity and privacy i'm kurt nielsen i'm one of the co-founders of patricia blockchain yes so as najib was mentioning

you might have that your privacy is maybe linked to other things so it's not just a matter of protecting your identity it's also a matter of the data that is used in the services and maybe across services is leaking your identity at the end so maybe the privacy needs to go a step further in order to actually have real private identity and that's what i will try to talk about and and to to talk about it in by using or talking about three different examples this is applications on the patient blockchain and then in order to solve this we need to move beyond the the uh zero knowledge proof that nadib was showing we need a more generic approach to solving for privacy if we want to go this way which we want

uh in this project called fatigue blockchain it's a new project but we have actually been working on mission since 2008 and for the past four to five years we have been merging mpc multi-party computation which is a generic zero knowledge computation technology together with blockchain and that's what we are launching with the particular blockchain project so let me quickly move on to the first example so this is all about making private identity as simple as possible this is collaboration with global leading ngos here it's all about

kobe 19 having a passport showing that you had the vaccine so over here we have an issuer who is giving you the vaccine but he also takes a photo of you and then we use the blockchain to make sure that this information is distributed to the people in in question so we have a verifier and the citizens again so this is in the physical world the verifiers scan the qr code and what pops up is a picture of the person in front of him and that is the identity so he just looks at the picture and the person in front of him you'll always see that the person in front of him so you don't need more information because he's already there and then you do the syrian knowledge

proof in order to tap into all the details about the the vaccine whether it's expired and so on type of vaccine just add a story necessary scared about this commit passport i'm sure you you know today some some valid passport with mickey mouse and adolf hitler been issued in switzerland so we valid certificate today i think if you read the press the works i can give you give it to you if you want to play and this is typically the centroid model the actual system where we do the digital passport you have one key that's signed for the world switzerland uh let's say passport and if this key gets broken

all the system is broken and now you can create fake certificates like mickey mouse with adolf hitler passport and this is where the central model thing sorry for entertainment perfect perfect yes so so this is really a very simple way to solve the problem and it works in countries where you don't have a strong healthcare sector but also in in places where you have a strong healthcare sector because you don't really need more information to solve this problem and this can be solved with zero knowledge proofs so it's not really backing my claim in the beginning but let's take it one step further so let's look at the drivers of the internet economy the advertisement industry and a service that we are also collaborating

with on the particular blockchain so this is about the user that has a profile and with a lot of detailed preferences and then you have a search engine and you have an advertisement market so as a query search query is done by the user and you do a privacy preserving match towards the the preference information of the users as well as other external data and you basically use that information to pick one of many personas and the personas goes into the advertisement market and that's where we have the traditional approach the market or the people are competing about what types of advertisements that you show to the user at the end but now

you actually use the privacy preserving technology to people out the power in the internet economy so now the user is in control of the data so that is bringing us not just private identity it also brings changing the power structures it might even go a step further to consider the idea of selling your data or maybe not selling your data maybe just selling the use of your data because that's exactly what you can do when you have this type of technology so if you're no longer trading your data you're just giving the right for someone to use your data

without actually disclosing the data this is a system that we built like three three or four years ago it serves 250 000 users it's using multi-party computation to do the matching to find the so the data requests that come into the system find the right segment and then the users come in with the data and the type of use could be anything from input to a survey or it could be it could be phase 4 trials for for healthcare treatments so real life continuous trial of healthcare treatments or anything else so this is three sort of examples of how

step how you move towards more privacy beyond just identity but if you want to do this we need to go beyond the zero knowledge proof and you need to to have a more uh generic approach to to doing this type of privacy preserving computation so that brings us to the particular blockchain and so blockchain is really about like replacing middlemen you're the distributed system so what we do here is to take it one step further and also replace what is known as the trustee in the economy so a person or an organization that is managing your your private data and and others as well

so that's what we're doing we're adding the privacy in a distributed fashion to so this is a picture of the technology stack or the infrastructure so it's what it really does is that it's a layer one plus two that's what we call it and it's it looks like any other blockchain right except for the private smart contracts and those are the smart contracts that is directing the system to run zero knowledge computations generic computations on private information there's also a lot of other innovations in here so we have efficient layer one with fast track consensus and

finalization and sharding and then it then is designed to orchestrate these privacy preserving uh computations and the second layer is all about the interoperability and and the privacy so you can use the privacy zone technology to actually do these bridging and bridging it becomes it's a very sort of in integrated part of of the network uh ammo running out of time just a little bit okay so just very quickly so the interoperability is actually solving a decoupling of the token economy behind this so you come in you you use what is called npc tokens to stake them and then you run a node in the network but what you have paid and what the users bring to the network is

already liquid external coins that is bridge into the network and channeled through the the system to the node operators so we're not creating a new uh cryptographic coin we're using already existing liquid coins that people already have as means of payment and that sort of allows us to do this exchange so you can we can bring privacy to the blockchain ecosystem and we can align ourselves by bringing in the coins that exist on the different blockchains and that's kind of our approach to collaboration with the ecosystem and i'm out of time otherwise i would have talked about what we want to do and

we're doing a lot on focusing on the sdg goal the sustainable development goals but that would be another talk i guess yes most likely and thank you so much for to blockchain team for you thank you