Day 2: Vasily Suvorov (Luxoft)

Transcript

[Music] next up here is the CTO of luck soft he's also co-founder of the Krypto Valley Association ladies and gentlemen Vasiliy Suvorov everybody's super excited to be here and thank you for coming and saving the energy I hope you've been initially exploring inspired by Professor Bohannon who talked about homomorphic encryption all kinds of different things and I'm really grateful to Danielle who set up the stage I guess for my talk since we've seen you know identity has all kinds of exciting

interesting applications but is it limited to only certain startups or certain companies who can build applications on identity can we actually use the powerful notion of digital identity for building applications on blockchain in different areas in government and medicine in logistics and all kinds of different applications so I would like to share with you information about what's going on in the technology world what are the standards what is it based on how to use them how to combine them with blockchain so I usually like to start when we talk about complex technology topic but maybe seeing if there is some intuition and the language that we use every day and if you look at

different dictionaries the Oxford Dictionary Cambridge and merriam-webster it turns out that identity is very very important counsel in our language right it does allow us to communicate efficiently about things because if we cannot differentiate between what things are are they the same are they different do they have certain characteristics right it's very very difficult to discuss anything get things done in mathematics for example they also use all kinds of interesting notion of identity but in a technical way so it is pervasive it's something that we rely on every day okay I usually have problems with clickers okay there we go so um now switching to blockchain just warming up a little bit so the diagram that you see

here and those of you who are building blockchain protocols will forgive me for giving you compressing all a complex notions of consensus everything else into very few simple steps so it doesn't matter which blockchain solution you're building or deal to technology using you basically you're taking a secret key in your public key right you generate some sort of transaction or change of state you send it to your DLT technology with that signature coming from your secret key right then transaction goes into verification which is based on history and in history you store you know the addresses the signatures and everything else right so essentially it's all depends on your secret key so right so this is your identity this is how we

know it's coming from the right person it's different from other transactions this is how and then it's stored in the history right which is becomes unalterable part of oblation technology so you know we need to manage that we really need to manage that so it doesn't matter which application we're building we really need to think about what is the robust way to manage identity and we need to rely on some proper technology to do that obviously you know blockchain is really bit confusing we have a bunch of different systems for permission block chains for public block chains and new blockchain protocols seem to come in mushroom every day so it does not help application developers who

want to understand which one do I use so it's it's very good that there are organizations out there that get together share their ideas and big holes in each other's arguments because identity is very important topic to define how to manage identity and how to decentralize identity right because for us it's not just identity it's decentralize identity right there's a whole powerful notion of blockchains of these new technologies and there's organization called the centralized energy foundation there is I think 56 companies there just last year there was 20 so it shows you they getting some traction they're getting some movement some big companies like Microsoft Accenture some startups like every name and others and they are actually also working on more formal standards

organizations such as w3c there's couple groups there one is called credentials community group the other ones verifiable claims working group and in my presentation we will look at what they what they do and what they work with so um the first key enabling piece of technology that you should consider using identity applications is decentralized identifiers so the designs goals that were set for decentralized identifiers was basically enable self sovereign identity management you know the privacy ah so you know it's not easy to track you it's not really to correlate how using different services simplicity extensibility and all these other different wonderful things so it's based actual in a very simple notion so you

have an identifier that she's here here on top which says the ID then says example example is a method we'll talk about different implementation and that gives you a number basically your unique identifier within that system what's important is that number then points to D ID document the ID document is a simple you know Jason linked document a little link data format or json-ld it and then it defines number different fields like ok so for this specific identifier that sits on the system right implemented by some sort of technology these are the keys public keys that are known for this person and it can be number of other things such as the end services you can go to to talk to this

identity to the agent which will introduce later and other different things how this person or machine or organization want to interact with the outside world this is how you know how to how to deal with that ok so it's important to understand that okay this is just enabling building block but for the system to function you need to make certain assumptions and and look at the players in the ecosystem and what's interesting about this compared to you know PKI technology and some other technologies is that basically you define the issuer you know somebody who creates the claims or at the stations about your identity your age you address qualifications and so on so forth right so they send these

claims to holder so holder is basically person a thing or organization and what they need to do they just store this claims they store these attributes of their identity and then they need to trust the repository that they're using because they're the holder itself so energy energy concept to be secure right then if they need to prove to somebody a certain age or they able to drive a car or they have a job and so on and so forth they go to somebody called inspector verifier who requests a claim and then you share information directly right so you own it and you can send you you know why you're doing that so you you you send that information there and then the inspector verifier basically

trusts the that can because of technology that this claim has been signed and comes from the issuer authorized sure right the other important thing is the holder when he or she receives the claim actually trusts that they sure give them a correct credential and they can also revoke the credential if it's no longer valid right finally remember the the piece where the Idid pointed to the ID document where we could discover things about the holder if you want to make it public you can with identifier registry right and we trusted that registering incorruptible and talks about correct ownership in other words the public keys

are correct if if public key has been stolen or revoked a new record needs to be in which says okay this is now the correct key and so on so forth so what happens here compared to other techniques is that previously you need to rely on identity provider to do both things on your behalf you know create a create and store a claim or attestation or identity attribute and then provide it to somebody who wants to check it now we decouple that and so you can work with number of different issuers and be and be in charge of your own destiny and be in charge of your own data where you provide the number different and you know inspect to verify so this is a very very key concept for decentralize 'el or

self sauron identity so got the building on on that so how can you use it so so we have a D ID and we have our traveller maybe Bob who you know who who worked with DVD visa agency United States that verifies an issues driver's license and he wanted to use the information from the driver license to prove he is over 21 years old so if you go to the bar or in some United States in states the United States they verify that she's above certain age so he doesn't want to reveal that you know he's Bob he lives somewhere his date of birth and things like that

so rather than presenting his driver's license he will provide a claim which says that he's over 21 and there as you can see there is something called proof in there in green that allows the bar to go ahead and verify it right so they will make sure that this this this public key and this proof the signature is coming from DMV it's it's it's now an agency they trust them so okay it's it's over 21 so that's great easy so obviously but I mean this is all theory this is just standards so who is using that it turns out that because of the centralized identity foundation there are multiple different methods and multiple different deployment ations of

this technology is we can see some of them here this is growing list um so are you port provides implementation sovereign there is something like so bitcoin IP fast there is emergence tenders on top of the cerium as well and how does this work it's actually very very simple to use and that's why you guys should use it if you build applications for identity on blockchain you take the D ID you you you you you basically build connection to the your favorite decentralized identity system like you poured your C seven to five and so on so forth or sovereign and then you use a driver right so even if you have some other users are using different system you just use the driver to translate the method call into the

identity provider and get the D ID document from them they will translate from their system to the D ID format which actually makes your life easy and portable and less connected to a single single company so when we talk about aetherium obviously a theorem is very very important player that's lots of applications being building aetherium and of course they understand they need an identity layer um there's essentially two efforts out there they somewhat competing but i think there's a lot of dialogue going on this something called ERC seven-25 and in related standards there C 735 PRC for those of you who don't know stands for a

theorem a request for comments which comes from internet world basically the idea of this comments is that it's a technical standard that people propose to the community so if it's a RC seven to five it's very similar to a RC 20 the token standard that it defines a set of methods and and data fields whereby you can do some Atta stations by different providers you can manage your keys and everything happens on chain right so that's very important to understand so basically smart contact smart contract you can think of it as a class right it owns some data in it own some methods to manipulate the data but the old data is stored on blockchain is visible to everybody right so to your public keys verifications of your claims everything

else it is basically visible for everybody but it does allow you to build interesting applications where some D apps based on a smart contract can verify from the other smart contract that certain things are allowed to happen and good right so that's that but it's it's a developing system you port on the other hand sort of Ashley tries to combine two worlds they they use and the important thing to say about our c75 is that your identity is basically a smart contract right with you port however the approach is somewhat different you have a complicated system of smart contracts with some proxy smart contracts and so on so forth to help you

manage your keys and recover your keys and coal to other smart contracts on your behalf but basically all the claims everything else is stored outside over theorem on mobile app today and it's very easy to connect to it they also defining a standard error c7 780 which is similar to air see 735 to store claims on chain if that's what's required right so they really building universal identity layer 4 above on chain and off chain solution focused on all kinds of different use cases but there's a lot of dialogue going between the community so it's a good thing you know from our standpoint again if using the ID there's drivers that will

transform between those two different systems so if you use the ID you safe right so that's easy for you to do now so let's talk about sovereign a little bit um so you've heard about sovereign from Daniel guy started hopefully many of you have heard about them before so just to explain these things to sovereign technology sovereign is a as a public permissioned ledger like utility Ledger's they just focused on managing identity managing those keys if you recall my initial model how people trust each other from issuer to the holder to verifier this something called registry so evarin is that registry right so because basically the

question is if I have my D ID how would I discover connect the ID document about my public keys about my end endpoints for you to interact this and talk to well you need a registry for that and of course you can use this theorem as a back-end or a database for is a back-end for it now the problem is how did this D ID get there well who puts them there how do you know this D ID is coming from you know CG of took or this is coming from police officers it coming from a company is it coming from a specific individual you need to create a framework of trust right and there is this concept called web of trust where people kind of vouch for each other and

include claims about the childís have concrete trust but Trust has to start somewhere and the way sovereign approach this is said okay I actually have to have a governance structure that consists of of the board in that consists of trustees that are in it consists of stewards that are running the nodes and for us to own board stewards to the system we need to understand who they are they need to have an identity we need to be able to trust them they need to have the right motive for being part of the system so so so there's a governance structure to onboard network nodes on the system and then there's network nodes in their own

turn can then basically create the ID records on the system and create identity for people and because you know who they are and they have a motivation to be on the system that basically serves as your trust Aleya right this is how you how you build it from ground up and because it's a separate ledger you can kind of manage your risk you can you can see where you distribute your trust who runs that where and deal with problems right so of course it's possible to build if it's not a technologist but because you want to jumpstart it you don't run it it's it's it's a lot better to maybe start with this solution but obviously we'll see how this works so you know other

interesting concept about sovereign in the next slide I'll talk about the underpinnings of that that create this technology is that basically there's a concept of agents right because it's it's fine and good if I have my cell phone and I have my data on it but what if I'm not online and somebody needs to interact with me and verify my identity right so this is where agents come in and you have basically a couple different agents you have at the edge layer the app top type of agent and some agent that will represent me in the cloud and you have of course can have multiple agents representing you and they serve as a gateway for interactivity with you for understanding who you are and allow you to work with other people basically right so and

that's why you need service endpoints and in di D document the other interesting thing that this technology allows because it's based on something called attributes based credentials is zero knowledge proof so if you have haven't sure you have over nerve the data and you have a verifier basically I don't have to reveal all the information that I have from the issuer to the verifier I can provide information about me but I can hide the data and it will provide a zero knowledge proof that the verifier will check and make sure that yes cryptographically it makes sense it's coming from the known source so we satisfied with it so it's it's also very very important thing and I guess the great thing about this technology is that from the source code standpoint

it's open source it's part of hyper ledger alliance is you know hyper ledger incubates all kinds of DLT technologies their school it's called Project Indy so you can take it and you can use it even without sovereign in your network if that's what you want but you can also contribute you can understand the technology and things like that so it's a great thing so so this part is probably just an example of how that actually works in a real setting just to put it in the context so let's say you have a traveller and travel have different different D IDs because we want to have a pairwise relationship why do we want to do that because we don't want to lick privacy I have a slide that

talks about that too so basically I travel on behalf of the company and I have relationship with that company with one D ID so I have a claim from them and I'm authorized traveller from that company I go can can check into a hotel they can verify that I'm say I'm from IBM so they give me a good rate I'm not just pretending and they know how to bill me so all automatic holds great but this hotel may be actually um I I don't want them to track me across all the usages so I use a different identity right and and this is my kind of a session key if you will right so I have a special session with them and they trust it they know who I am but the data is coming from my company I'm only given the information not my job title when I

was hired and things like that but just I'm travelling on behalf of the company so I provide Azul nourish proof and they can accept me without tracking me and understanding where I go next so next I go to rent a car and I'm using yet another part of the claim from the company to prove Who I am right maybe my date of birth that's provided by the company maybe the fact that I have credit are the different things so yet again I have another identity with them and then I use zero knowledge proofs to to reveal information that's only specific to this guy and then the screenshots they're basically give you some some protocol logs how you interact with the system and what it does so so we talked about well this whole system

has been built to enable privacy and protect you so but you know it's not a given because if you look at your identity information your government ID a passport number your address date of birth as if code and everything else are highly correlated if you reveal those things to your providers to the people who you need to interact with be able to capture that information and track you right so so basically the way that works if I have an insurer who provided a claim I went to one very far to another very far if they have the data it uniquely identifies me even behavior data a fingerprints of my devices that I'm using they can they can correlate it they can collude and understand who I am

and discover my real identity on the other hand side if I'm building my system such that Arvind verifiers go to assure to verify my claims and they provide some information about me that uniquely identifies me then he sure knows who I'm dealing with right so from if it's my bank all of a sudden they know oh I'm talking to another bank maybe I don't want that so you need to avoid sharing PII as if possible but if you need to just make it make sure that your users understand that you know so so it's not a given its technologies sound the privacy is not a given so how does this work so it's based on a wonderful technology that was pioneered here in Switzerland are called attribute based credentials or anonymous credentials in basically the way that

works there's a bit of math there is that as a holder I interact with my sure I I have an ID with them or session key I provide my blended master secret in other words they cannot understand what it is but they know it's a certain number and and then they provide credentials to me saying ok for this for this session key for this identity these are the attributes we provide something called Co signature for and Cl signature is a very specific technology created by comm initially since care actually he ran a research center of IBM it has wonderful properties that later allow you to basically then take subsets of his attributes and provided in different verifiers it used different of course identity because you don't want to be tracked

right and then you provide a zero knowledge proof that in first case to say like you sure with the public key vouch is that the attributes in green I'm giving you access to this attributes in green a to but I'm actually not giving you a three but I'm just saying it's not equal s whatever that is and for the other guy I mean we use the same proof but um I'm using the same Prudential but I'm using a different proof whereby I'm just ruling okay attribute a one but attribute therefore that you don't know is more than M right so I can do these things that can even combine our tributes from multiple issuers and create composite composable proofs right and they are linkable and untraceable because this proofs are

statistically not related right so that's that's very important concept there hopefully it'll make sense so switching gears a little bit talking about how to build applications so if we use all that wonderful interesting technology what can we build and basically you can kind of think about identity applications and put them into different buckets one bucket isn't what I call identity is key whereby you're just using identity to get access to something you proof you you you entitled to something that includes Wilton report cards access control travel mobility Financial Services you know content consumption it would be wonderful if I buy a song on Spotify but can use it on tidal for example that will be great and then of course there are much more

complex application whereby you're actually changing attributes of identities results of the application itself and there's lots and lots of interesting use cases there you know buying sell cars property you know healthcare because of health records maintenance information but my car training and education and so on so forth there are actually very complex so just to give you some of this later examples because the first one is up I think a very trivial already given one identities content we can actually build some of the systems even without guilty right because if we can provide information that is that has some trust element in it right we can basically build this chain of trust and for example let's take anti-counterfeiting

where we want to build the chain of custody so the first step right and let's talk about drugs for example right so you manufacture some some drug you distributed them and then people fake them so you want to prevent that from happening how do you prevent them from happening is basically want to make sure that only authorized people handle it trusted people and they and they have stake in the system if they game this system if we discover them we kick them out so they lose their business well so the problem they want to be honest right so in that we can create hierarchy of authorized handler claims using the technologies is talked about and what's interesting is a manufacturer I authorized my big regional distributor big regional de stupid and goes to to a smaller region authorized somebody there and finally

they go to the delivery guys in authorized damn right so we have this chain of claims that people can present say yeah we actually been authorized to do it now we ship a package so manufacturer creates creates a shipment of medicine you know it creates a package the IDS with his own identity and by the way identity doesn't have to be public identity on the registry you can still use private identity as well because of micro Ledger's so maybe it's peer-to-peer identity so we don't always need to put it on the ledger so we have a package for your identity we give it to the authorized original distributor we create a claim about that that transactions from both sites everybody confirm that they receive the package with such a serial number and so on and so forth then the handoff happens it each handoff we create handoff claims

everybody agrees they received the package and send it off and finally gets the clinic which is also also authorized and known to the manufacturer so at the clinic basically we can take all this different history of claims which we created because it's a chain right and and send it back to the manufacturer and verify are these authorized people is that the right package right and if it's not if something else happened to it we know where to look essentially right so it creates a lot of traces there so it's possible that DLT maybe the connectivity is not good maybe it doesn't warrant a deal to use case but if DLT just becomes much much much easier right so but they're actually use cases where you have to orchestrate a system let's talk

about some personalized medicine for example so as you know now people work on personalized medicine whereby I need to come to a doctor maybe it's a cancer treatment they need to diagnose me and say well actually this guy or girl or child will benefit from our personalized medicine treatment so we need to send them to a special lab that will obtain blood cells of a certain quality then send this blood cells to a manufacturer manufacturer will process this blood cells put them on cryotank shipment to the right treatment center and we need to make sure that there's somebody's paying for it because it's a very expensive procedure so we need to involve all different players you know from the doctor to the patient to the insurance provider to the manufacturer

to the special lab and of course you have want to have a market for it right so you want to track it so how do you do it it's a very very complex application and and to me you know complex application they need combination of technologies so you can use specialized ledger like solvent for example it manages solve an identity and that information my medical record my consent information about the receipt stays with me right and stays with this you know isolated silos but then I can as as I can model the rules in information and interaction between this complex system that we need to orchestrate on a DLT maybe incor to me but happily or maybe you know a theorem and so on and so forth

whatever you whatever it is it fancy and then use used identity information to orchestrate the system and I think it's it's a very important pattern to understand because you know it doesn't have to be just one ledger you have to combine they're just what about payment we can integrate something like stellar in here or me you know and another so maybe you theory 'm inter ledger are the different things and then you have a complete record system that deals with identity with delta stealth state business rules payments and everything else so this is how we like to build our applications and think about you know approaching this this complex complex topics so with that I would like to close and say that abuses self sonar ends is key to scalable you know use cases please don't you know reinvent the wheel look out for the standards try to

participate to them if you don't like something contribute back you know connect to local communities certainly would like to have you all part of Krypto Valley part of our working groups interacting with other people be mindful about gdpr and PII those are things that will bite you if you don't care for them actually very very complex to deal with we really heard from Professor behind and that even proving to lawyers that you destroy the key is a challenge right so you need to be aware of that and of course that entity is more than just a name and address right you can think about all kinds of different use cases actually identities cases the attributes that you need prove to different people so thank you very much for your attention I hope that was useful [Applause]