eMadrid_KatjaAssaf_DigiCred.pdf

1. Digital Credentials in 2028 A reflection upon the challenges we had to solve Katja Assaf Hasso-Plattner-Institute, University of Potsdam 13th January 2023

2. The year 2028… In the research project DiBiHo (Digital Credentials for Higher Education Institutions) the three partners TU Munich, DAAD (German Academic Exchange Service) and Hasso-Plattner Institute investigated the challenges of establishing digital credentials for learning achievements. We have created a systematic mapping of requirements coming from the literature to identify and prioritize challenges. This includes (technical) interoperability, revocation of credentials and privacy enhancing cryptography. To test the feasibility of our ideas, we have created a proof of concept implementing our proposals. The presentation will discuss the identified challenges, our approaches and the remaining open questions.

3. The year 2028… Alice

4. … in the year 2028. Alice University of Potsdam Universidad Carlos III de Madrid Interoperability Transfer …

5. Alice Universidad Carlos III de Madrid Interoperability Student ID … … in the year 2028.

6. Alice Hackerspace Selective Disclosure … in the year 2028. Student discount…

7. Alice Hackerspace Selective Disclosure … in the year 2028. Student discount…

8. Alice Universidad Carlos III de Madrid Pseudonymity … in the year 2028. Online voting …

9. Alice Universidad Carlos III de Madrid Pseudonymity … in the year 2028. Online voting …

10. Alice Universidad Carlos III de Madrid Privacy … in the year 2028. Privacy …

11. Alice Privacy Relying Party … in the year 2028. Privacy …

12. 1. Digital Credentials ■ Digitalized or Digital 2. Requirements ■ DiBiHo Proof Of Concept ■ Requirements for Digital Credentials 3. Challenges and Future Work ■ Middle Ware (Technical Interoperability) ■ Revocation ■ Anonymous Credentials Outline Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 12

13. DiBiHo Project Summary Digital Credentials for Higher Education Institutions – DiBiHo 13 Consortium Project Goal Exploration of a trusted, distributed, and internationally interoperable infrastructure standard for issuing, storing, presenting, and verifying digital academic credentials in a national and international context for German Higher Education Institutions. Project Period 11/2020 – 12/2022 Funding Contact Felix Hoops (Lead TUM Team) Alexander Mühle (Lead HPI Team) Kathleen Clancy (Lead DAAD Team) Website www.dibiho.de Ref. No.: M534800 DiBiHo Project

14. What is a digital credential? Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 14

15. Digitalization of Paper Credentials Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 15 ● Same disadvantages ○ Copying ○ Verification requires lookup ● Same advantages ○ Same process ■ Simple transition ○ Simple implementation ■ Practicality ■ PDF with QR-code or link

16. Digital Credentials as substitute Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 16 ● Harder ○ Trustwise ● Requirements unclear ● Not always human readable ● More options ○ e.g. SSI ○ User control ○ Privacy

17. Requirements

18. Digital Credentials - Features Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 18 Self-Sovereignty Selective Disclosure Sharing Consent Pseudonymity Revocation free-of-charge Portability Tamper Evident Auditability Verifiability Interoperability Reflect Current Onboarding Process (Integration)

19. Digital Credentials - Framework Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 19 Trust University Processes Legal Constraints

20. Digital Credentials - Framework Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 20 Trust University Processes Legal Constraints Self-Sovereignty Selective Disclosure Sharing Consent Pseudonymity Revocation free-of-charge Portability Tamper Evident Auditability Verifiability Interoperability Reflect Current Onboarding Process

21. Digital Credentials - Features Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 21 • Systematic literature mapping (112 sources) ■ Journal and conference papers ■ Grey literature (e.g. project reports, company whitepapers) ■ GitHub projects Mühle et al., ‘Requirements of a Digital Education Credential System’, submitted for EduCon 2023

22. Digital Credentials - Features Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 22 • Systematic literature mapping (112 sources) • Categorization ■ Functionality ■ Privacy ■ Usability ■ Deployability ■ amongst others Mühle et al., ‘Requirements of a Digital Education Credential System’, submitted for EduCon 2023

23. Digital Credentials - Features Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 23 • Systematic literature mapping (112 sources) • Categorization ■ Functionality ■ Privacy ■ Usability ■ Deployability ■ amongst others Mühle et al., ‘Requirements of a Digital Education Credential System’, submitted for EduCon 2023

24. Digital Credentials - Functionality Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 24 Mühle et al., ‘Requirements of a Digital Education Credential System’, submitted for EduCon 2023

25. Digital Credentials - Functionality Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 25 present register/revoke verify Relying Party Issuer Trusted Data Registry Learner register issue

26. Receiving Credentials from HPI & TUM Digital Credentials - Proof of Concept

27. 27 VP Metadata Credential Verification Results For all VCs included in the VP. (can be expanded for more details) Verification Result Overview Digital Credentials - Proof of Concept

28. Digital Credentials - Functionality Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 28 present register/revoke verify Relying Party Issuer Trusted Data Registry Learner register issue

29. Digital Credentials - Features Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 29 • Systematic literature mapping (112 sources) • Categorization ■ Functionality ■ Privacy ■ Usability ■ Deployability ■ amongst others • Prioritization according to ■ frequency ■ feasibility ■ and scientific interestingness. Mühle et al., ‘Requirements of a Digital Education Credential System’, submitted for EduCon 2023

30. Digital Credentials - Features Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 30 Mühle et al., ‘Requirements of a Digital Education Credential System’, submitted for EduCon 2023

31. Digital Credentials - Features Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 31 Mühle et al., ‘Requirements of a Digital Education Credential System’, submitted for EduCon 2023

32. Digital Credentials - Features Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 32 • Systematic literature mapping (112 sources) • Categorization ■ Functionality ■ Privacy ■ Usability ■ Deployability • Prioritization according to ■ Frequency ■ Feasibility ■ And scientific interestingness. ⇒ Revocation ⇒ Pseudonymity & Selective Disclosure ⇒ Portability ⇒ Integration & Interoperability Mühle et al., ‘Requirements of a Digital Education Credential System’, submitted for EduCon 2023

33. Early Design Decisions

34. • Design paradigm based on Allens blog post1 Design Decisions: Self-Sovereign Identity Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 34 1 - https://www.lifewithalacrity.com/2016/04/the-path-to-self-soverereign-identity.html 2 - Tobin, Andrew, and Drummond Reed. "The inevitable rise of self-sovereign identity." The Sovrin Foundation 29.2016 (2016): 18. Figure: The principles of Self-Sovereign Identity2

35. Technology Standards for SSI 35 Identifier Standard Claim Standard Decentralized Identifiers (DID) ● Globally unique identification ● Interoperability layer for different identification implementations ● Transparent resolution of identifier to key material ● Allowing free choice in technology and provider Verifiable Credentials (VC) ● Verifiable claims about an entity ● JSON-LD document for generic structure ○ Metadata ○ Claim (arbitrary content and structure) ○ Proof Design Decisions: W3C Verifiable Credentials

36. • An Identity Verifiable Credential (VCident ) is a VC containing Personal Identifiable Information (PII). • An Identity VC is especially deserving privacy protection. • Design Decision to make a distinction between VCdiploma and VCident Design Decisions: Verifiable Identity Credentials Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 36

37. Challenges Considered

38. • An Self-Sovereign Identity System requires enough ■ Issuers ■ Relying Party (Verifiers) ■ Learners (Users) • Generating Verifiable Credentials (VCs) from existing data is easy • We show concept is feasible • Future Work: ■ Real-world applicability ■ Evaluation Middle Ware - Let’s work together Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 38 Interoperability Portability Assaf et al., ‘Prison Break: from proprietary data sources to SSI Verifiable Credentials’, accepted for AINA 2023

39. • Straightforward solution for revocation: ■ Credential Status (active, revoked, suspended) • But: ■ Defragmented issuer landscape • Idea: ■ Introduce middleware similar to Universal Resolver Revocation - What we do in case of error Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 39 Revocation Mühle et al., ‘Universal StatusList: Making a Case for more Middleware in Self-Sovereign Identity’, planned for 2023

40. • An anonymous credentials scheme consists of three protocols: ■ Key generation, ■ Issuance, ■ And showing respectively verification • With the following properties: ■ Credentials can be obtained anonymously, ■ Credentials can be shown anonymously, ■ Credentials cannot be linked. Anonymity, Pseudonymity and Selective Disclosure Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 40 Selective Disclosure Pseudonymity Assaf et al., ‘Anonymous Credentials and Self-Sovereign Identity - two perspectives on privacy enhancing authentication’, planned for SECRYPT 2023

41. Future Work

42. • An Identity Verifiable Credential (VCident ) is a VC containing Personal Identifiable Information (PII). • An Identity VC is especially deserving privacy protection. • Design Decision to make a distinction between VCdiploma and VCident But: • Sometimes binding a Diploma VC (VCdiploma ) to an Identity VC is necessary. • Student seminar exploring Merkle Trees • Option to use cryptographic commitments - not done Future Work: Credential Binding Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 42

43. • Where does trust originate? ■ Accredited universities hierarchical ■ MOOC providers decentralised / web of trust ● Does everyone need to trust everyone else? Future Work: Root of Trust Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 43

44. • Revocation ■ Advanced cryptographic methods ■ e.g. accumulators • Restricted Verifier ■ e.g. view only once • Trust Anchor / Source of Trust ■ Organizational issue ■ Trust network (hierarchical vs decentralised) • Credential binding ■ Difference Identity VC and Diploma VC Future Work Katja Assaf 13.01.2023 Digital Credentials in 2028 Chart 44

45. Thank you for your attention! Ask away! Katja Assaf University of Potsdam - Hasso-Plattner Institute - Chair Internet Technologies and Systems 13. January 2023

eMadrid_KatjaAssaf_DigiCred.pdf

eMadrid_KatjaAssaf_DigiCred.pdf

Recommended

More Related Content

Similar to eMadrid_KatjaAssaf_DigiCred.pdf

Similar to eMadrid_KatjaAssaf_DigiCred.pdf(20)

More from eMadrid network

More from eMadrid network(20)

Recently uploaded

Recently uploaded(20)

eMadrid_KatjaAssaf_DigiCred.pdf