Discussing Identities and Blockchain at KNOW 2019
Sponsored by the market research and strategy firm One World Identity (OWI), KNOW 2019 was the latest in a series of events exploring the extremely topical theme of digital identity. This year, Intertrust Technologies was honored that our CTO Dave Maher was one of two Intertrust executives invited to speak at the event. Maher, who also heads up TIDALs, Intertrust’s blockchain based R&D project, was a participant on the panel “Building Blocks for Blockchain Identifiers.”
The panel brought up two concepts in digital identity where blockchain is expected to play a role, zero-knowledge proof and decentralized identity. These concepts are gaining attention as potential solutions to the seemingly intractable issue of allowing individuals to easily authenticate themselves over the Internet while protecting the security and privacy of their sensitive data. As Rohan Pinto, the CTO of 1Kosmos, noted an individual “has between 200 to 250 identities.” Blockchain-based identification systems have the potential to tie these identities to a person without each of the issuing institutions gaining knowledge from the other, reducing the risk of exposure.
Daniel Buchner, Technical Product Lead – Decentralized Identity at Microsoft, discussed how these sorts of identification systems could be set up so that the blockchain contains just pointers to identity data, avoiding centralized repositories of sensitive data that could be juicy targets for bad actors. “It could be like email where you own it (your data) but it would be an outbound link to where it actually lives,” (Buchner). According to Buchner, in such a system, access to the identity data would be under the control of the individual. Maher agreed that these systems should be decentralized and suggested that links to the trust anchors authenticating the data could be saved as hash tables. Compared to X.509 certificates that are now commonly used for this sort of authentication, “hash tables are amazingly fast,” (Maher).
A number of questions came up around public records and cybersecurity. David Huseby, Security Maven at Hyperledger, suggested that blockchain based systems should just act as proxies for individuals, decreasing the need for public records. For example, should a retailer want to sue Huseby, all they would need to do is hand over a banking credential about David to the legal authorities without his name on it. “They would then go to the bank to prove who I am,” (Huseby). As for cybersecurity, Buchner suggested that attackers would switch their target to those who control the keys to sensitive information.
While most of the discussion revolved around an individual’s identity data, Maher pointed out the need to think beyond personal data and consider identity for devices as well. “Devices can be proxies for you,” (Maher). The issue of how device identities and personal identities will interact on a blockchain is interesting, but it will have to be a discussion for another day.