The foundational layers of the Internet are TCP/IP (the Internet protocol suite), which are messaging protocols, while the Web is based on HTTP and HTTPS which enable web site access, content exchange, and linking. These protocols have created a powerful and low-cost medium for sending and receiving digital messages and information quickly from one location or person to another. This is the main reason that communications (email and chat applications) and web/mobile applications and sites have been able to flourish and grow rapidly.
Trust online is mediated by large organizations that hold user information in large centralized databases. These large organizations might be banks, social media giants, email providers, health systems, insurance companies, etc. Identity is ‘secured and protected’ by weak authentication systems that rely on usernames and passwords. Transactions are protected by public-private key systems where private keys are stored centrally and all transactions are mediated by a Trusted Authority.
So here are the key problems with our current situation:
Interestingly, even though the paradigm for today’s online world is centralized, from a user perspective identity and personal information is distributed and fragmented. There is no one master identity for each user and so no identity layer. With no identity layer, there can also be no real trust layer, as your identity can be hijacked and fairly easily bought and sold by third parties.
In a decentralized blockchain-based online world, we the users can create our own identities and control our personal information. This type of identity and the resulting identity layer it creates is called ‘self-sovereign’ identity. Self-sovereign identity means that only we can modify our online identity information and all online information is controlled by us. Since identity information must be validated to be useful, a person’s identity is verified by having a significant number of people in the network vouch for the validity of the information in a user’s profile. A leading provider of this type of identity in the blockchain world is the Sovrin Foundation.
An alternate, or hybrid approach to securing identity, is one in which we control our personal information but our online identity is validated through ‘attestation’ by a trusted authority (i.e. a government body). For example, when signing up for a cryptocurrency exchange account or carrying out know-your-customer (KYC) procedures for an initial coin offering (ICO), users can only be registered and verified by supplying government issued identification (i.e. a passport or driver license). A leading provider of this type of identity in the blockchain world is Civic.
From a user perspective our identity under a decentralized blockchain paradigm can be handled most efficiently if it is resides with us. Think of it this way, it is much easier and safer for the average person to work with a single master identity that they control rather than multiple distributed identities controlled by others. As a result, the blockchain in combination with self-sovereign identity makes it possible to create an identity layer for the Internet/Web that is built up by the users in the network.
To be useful this identity layer must be highly secure. Fortunately, blockchains can create the most secure networks known today. Additionally, blockchain systems can employ novel cryptographic techniques so that data transfer to and from the ledger can be nearly impossible to hack. As a result, the combination of self-sovereign identity plus blockchain can create a layer of trust in the online world. Trust is built because everyone can be very certain that my online identity is really me and I have full control over all my information.
Let’s take a look in more detail at one of these novel cryptographic techniques for securing identity and information.
So, for example, you can prove that you are indeed who you say you are without disclosing any identity information to prove it. Or, you can verify that you know a secret without sharing the secret. Since you have not disclosed any secret information in the transaction there is zero knowledge that can be shared with other people.
Today, we often have ‘challenges’ that ask us to divulge secret words (passphrases), identity information (social security number, birthdate) or passcodes to prove our identity before gaining access to services or information. So, you may wonder, how can you prove identity or that you have knowledge of something without divulging any information? Let me first say that ZKP is based on quite complex mathematics, but the process works something like this:
As is clear, use of ZKP significantly increases the difficulty level for hackers. If they hack the verifier they receive no identity or secret information (nothing is stored except the log of transactions) about you. Also, most ZKP verification tests on the blockchain require both a user’s private keys and identity knowledge, which are very difficult to obtain simultaneously and use in combination for a battery of tests.
ZKP was originally implemented on the blockchain in Zcash — a token that enables users to conceal specific information about their transactions. The implementation is known as zk-SNARKs, which has also been implemented on the Ethereum blockchain. SNARK is an acronym for ‘succinct non-interactive argument of knowledge’.
Since we will be the only arbiters of our personal information, we can control the information disseminated to third parties through a capability called ‘selective disclosure’. This capability enables us to provide just the information required (i.e. verifiable claims) for the transaction and no more. Alternately, if we don’t want any of our information to be viewed, we can use ZKP or completely bar specific third parties from any access.
Transactions on a blockchain-based system are typically programmed to use trustless smart contracts. They are trustless in the sense that they don’t require trusted intermediaries to mediate the transaction. Instead, the verification of identity (as I’ve described above) plus standard checks required for the smart contract to operate will create a trust layer for the online world. Obviously, smart contracts will also need to pass through a mathematical validation process so that users will know that they have been verified to work correctly.
A consequence of these identity and trust layers brought about by blockchain technology will be the ability for each of us to monetize our personal data and information. This is quite different from the current paradigm where other entities can and do monetize our identities and personal information without our permission (i.e. Facebook).
Ben Bartlett, a prominent Berkeley lawyer and candidate for California State Assembly, believes that self-sovereign identity can serve as a foundation for universal basic income (UBI). His blockchain platform includes the concept that communities can fund UBI through the personal agency of private data in the marketplace. Specifically, “by declaring personal data to be a sovereign property right, …individuals and communities can become involved in the robust monetization of their data”.
Currently, healthcare data is distributed and highly fragmented with our identity and personal information spread across diverse ecosystem players, including doctors, health systems, insurance companies, clinics, labs and others. With such data fragmentation, healthcare is anything but optimized.
Many industry experts recognize that one of the holy grails of healthcare is the Personal Health Record or PHR. A PHR enables each person to own his or her own comprehensive personal health information and share this data across the ecosystem to receive optimized care. PHRs have not gained widespread adoption because of significant security and identity concerns. Blockchain technology paired with self-sovereign identity makes it possible to achieve a true PHR by simultaneously addressing these concerns in a single system.
Once PHRs achieve widespread adoption, there is still a concern regarding the implementation of PHRs — particularly the unauthorized copying, sharing and storage of healthcare data during transmission, arguably when data is most vulnerable. Hackers are persistently attacking health data repositories to get access to medical records, especially identity information. Mechanisms such as zero knowledge proof (ZKP) can ensure that no actual identity knowledge changes hands at any time during any transaction.
Since healthcare providers will need to be able to read patient information for optimizing care, other cryptographic techniques and approaches will be required to ensure that the data cannot be copied, transmitted, or stored at any time. Each person can provide selective disclosure of critical historical personal information to authorized healthcare providers and other ecosystem players to minimize the potential for unauthorized access.
While the PHR may take a while to become a reality, it is becoming increasingly evident that blockchain technology in combination with advanced cryptographic mechanisms and other technologies such as artificial intelligence (AI), machine learning (ML) and IoT provide transformative and exciting opportunities in healthcare.
The standard element used by anyone interacting with blockchain-based online financial products is the digital wallet. Pairing a digital wallet with self-sovereign identity and ZKP, like in the healthcare use cases above, can create a much more secure and powerful way for each person to manage their assets. We can call this new financial asset a personal financial record or PFR.
Since information in the PFR is quite valuable to nearly all businesses, an added value of the PFR is that it will enable people to monetize their financial information. They can do this by opting in to focus groups and/or behavioral studies and charge businesses and other entities for access to their financial and identity information. Like in the healthcare example, people can use selective disclosure to ensure that only the requested information is provided and no more.
With greater control and higher security, blockchain-based financial products can empower people in many tangible ways as I’ve noted above. The exciting thing is that I have only scratched the surface of what is possible with my example, and there is much more scope for innovation that can unlock significant benefits for billions of people.
