Sitra event: IHAN Tech Check 2020 22.1.2020 – Identity, Teemu Kääriäinen / Vastuu Group – Consent, Gregor Žavcer / Datafund – Logging, Perttu Prusi / Fujitsu – Data transport, Tuomo Muhonen / CGI – Services, Antti Harjula / Nixu Markus Kalliola/ Sitra Lukasz Geratowski / HiQ, Asmo Urpilainen / HiQ

1. IHAN Tech Check 2020

2. Agenda
08:30-09:00 Networking & breakfast
09:00-09:30 IHAN Tech so far, Juhani Luoma-Kyyny / Sitra
09:30-10:15 IHAN Streams
– Identity, Teemu Kääriäinen / Vastuu Group
– Consent, Gregor Žavcer / Datafund
– Logging, Perttu Prusi / Fujitsu
– Data transport, Tuomo Muhonen / CGI
– Services, Antti Harjula / Nixu
10:15-10:45 CEN CWA – pre-standard to enable fair data economy, Markus Kalliola / Sitra
10:45-11:00 Blueprint 2.5, Juhani Luoma-Kyyny / Sitra
11:00-11:20 IHAN TestBed
- Lukasz Geratowski / HiQ, Asmo Urpilainen / HiQ
- Teemu Kääriäinen / Vastuu Group
11:20-11:30 Next steps, Juhani Luoma-Kyyny / Sitra

3. IHAN tech so far...

4. IHAN tech so far....
“IHAN concept – securing
the Data-Human connection”
2018 2019
“IHAN cookbook”
“IHAN Blueprint 2.0”
“IHAN Blueprint 1.1”
FarmData Pilot
2020
Tech pilot funding round
Tech pilots
IHAN workshops
“IHAN Blueprint 2.5”
IHAN Testbed
CWA Release
writing workstreams

5. IHAN streams

24. © 2020 FUJITSU
IHAN Tech Check 2020
Logging Stream
Perttu Prusi (Lead), Fujitsu Finland
Mikael Rinnetmäki, Sensotrend
Antti Kettunen, Tieto

25. Identity + consent management + undisputed and immutable logs =
fundamentals for transparent trust in circumstances where trust is not
self-evident
Essential for End Users’ confidence in IHAN system
• How can I as Service Provider prove I had the End User’s explicit consent
for processing the personal data?
• How can I as End User see, who has accessed my personal data?
• How can I as Data Provider prove that I have shared personal data with
the End User’s explicit wishes?
Confidential
© 2019 FUJITSU
Approaching the Topic

26. Standardization and IHAN compatible services have their detail level
requirements built on top of IHAN framework and guidelines
• Not defining exact data models
• Not defining APIs and endpoints
• Not defining technical nor application / service internal logging
Confidential
© 2019 FUJITSU
Out of Scope

27. Standards accelerate component development in a new business area by
giving a framework and guidelines on top which they can be designed and
implemented.
Confidential
© 2019 FUJITSU
Decision Process
Reference cases →
Sensotrend
Tieto
Vastuu Group
Datafund
Kela Kanta Services
→ Frameworks →
IHAN Blueprint
MyData
CEN-Cenelec Level of
Guidelines
GDPR
→ Use Cases →
Data Operator
Distributed Identity
Agent
Data Provider
End User
→ Requirements
Data Operator
Agent
Data Provider
End User
Service Provider

28. Documents
• The background and principles of logging in IHAN context for
IHAN compatible component design purpose
• Dimensions relevant for IHAN compliant logging to set the
expectation level
Provides
• Toolkit for standardization and service component design
work
• Architectural models and IHAN logging componentsConfidential
© 2019 FUJITSU
Conclusions and Way Forward

29. © 2019 CGI Inc.
IHAN Tech Check info
Data transfer
22.1.2020
Tuomo Muhonen
Tuomo.Muhonen@cgi.com
+358 40 172 1156
29Sitra IHAN Tech Check info: Data transfer

30. © 2019 CGI Inc.
Data transfer
30Sitra IHAN Tech Check info: Data transfer

31. © 2019 CGI Inc.
Scoped out
• Transferring data on portable media
• Complying with laws and regulations details
• Country specific issues
• Data structure details, though standards are recommended for
practicality
• Data conversion between formats
31Sitra IHAN Tech Check info: Data transfer

32. © 2019 CGI Inc.
Data transfer models
(just an example)
Direct
Companies can exchange data
without third parties and aggregate
needed customer data.
Aggregator
Operator aggregates data and controls
data access.
Broker
Operator brokers data between
parties, but does not aggregate data.
Company A Company B Company A Company B
Infra
operator
Company A Company B
Infra
operator
Sitra IHAN Tech Check info: Data transfer 32

33. © 2019 CGI Inc.
Prerequisite
”Customer has consented to data consumption”
No data transfer if either endpoint does not have
the concent
Sitra IHAN Tech Check info: Data transfer 33

34. © 2019 CGI Inc.
Direct data transportation
example
Sitra IHAN Tech Check info: Data transfer 34
Bank A Bank B
Hello! I’m
applying for a
loan from Bank A
Certainly! Before we
give the offer, could we
see your banking
transactions from your
current bank?
Request for account transactions
List of account transactions
Applying for a loan from a bank.
Bank providing a loan offer wants to see applicants
account transactions from a period of time.

35. © 2019 CGI Inc.
Aggregator based example
Sitra IHAN Tech Check info: Data transfer 35
”Blood sugar
Data aggregator”
Medical research
Medical treatment
In case of a diabetes where I have a sensor that monitors
my blood sugar levels. A data aggregator company could
provide access for my doctor related to my blood sugar
levels. Also medical research parties could ask to utilize
my blood sugar data for their research purposes.

36. © 2019 CGI Inc.
Broker facilitated data transfer
Sitra IHAN Tech Check info: Data transfer 36
APIgateway
German
pharmacy
Finnish
My Kanta
Finnish
person
Person is on vacation in Germany. She has forgotten her
personal medicine at home. German pharmacy fetches
person’s prescription from Finnish My Kanta registry.

37. © 2019 CGI Inc.
When integration
efforts are
@data provider’s side
@data consumer’s side
Data models – Company specific
37Sitra IHAN Tech Check info: Data transfer
Company specific Common standards
Short term? Long term?
Consider the legacy or
systems that do not
comply with
standards.

38. © 2019 CGI Inc.
Data transfer quality
• The endpoints must agree on the requirements on data quality
• Is it OK to lose some data ?
• How to request the missed data for resending?
• How to track what has been sent and received?
• The technologies will vary case by case
• Data encryption needed on identifyable sensitive data
• SSL / TLS or separate data encryption
38Sitra IHAN Tech Check info: Data transfer

39. © 2019 CGI Inc.
A tricky use case
• Based on GDPR the user have the right to get false data corrected
• Wrong data has been sent to other parties
• How to resend or delete some old data at the receiver?
• If the consent is not valid any more, how to send data?
• No consent -> No data transfer
39Sitra IHAN Tech Check info: Data transfer

40. IHAN Services
Stream
22.01.2020 | Antti Harjula

41. • Services are important part of our economy and definitely one of the
major components of emerging decentralized data economy.
• Major components:
• personal (service) directory
• public (service) directory
• service interfaces
• user preferences
• Main target is user-centric services which respects user’s privacy and their
preferences and build the services around user context and purpose.
• Eliminates need for consenting to each services independently and protects
user’s privacy and gives chance to control own data.
Approach

42. • Reasoning for the out scoping was to narrow down the focus on the building blocks of the
decentralized data econony
• These items are relevant for future of the ecosystem and implementation phase but out
scoped from this document:
• The rules and conditions of operating public directory
• Architecture and implementation of TDA as a user friendly interface towards decentralized data
economy
• Algorithms within TDA for consent which can be automatically applied based on the user preferences
to specific service
• The way consent are given, contracts are made, definitions, legal concepts, or other factors that
affect the explicit understanding of the user and their interaction with a service
• Non human interaction with services, e.g. company vs service
• Possible monetary value of data
Out scoped items

43. • High level guidelines and next steps discussed and agreed together in the
weekly calls
• Experts working on their own between the calls and notifying others when
the specification is ready for review
• So far it has been rather easy to find the consensus
• Some minor conflicts between technical and business people
Decision process
Specification
writing
Review
Weekly call

44. • Conclusions so far:
• Public (service) directories – Should be decentralized and in the beginning
there should be at least one which is operated by a trustworthy party. This helps
to gain users’ trust and build the ecosystem faster.
• Layered services – Services may integrate with existing services and utilize
information available in building a new service (minimum set of information)
• Publishing – Publishing public (service) directories, services and data, needs to
be standardized, with a minimum required set. This has been done on a high
level.
• Next steps:
• More detailed specification
• Alignment with other streams utilized in the Services stream:
• Identity, Consent, Data Transfer & Logs
Results
Conclusions & way forward

45. CEN CWA

46. CEN, CWA, Workshop, Standards – Say WHAT?
22/01/2020 Markus Kalliola

47. Agenda
Why/how collaboration with an Standards Development Organization?
CEN
CEN deliverables
CWA
What next for the CWA?

48. Why collaboration with SDO?
Some IHAN project goals in early 2018
1. IHAN services introduced in three European countries
2. First services implemented and they have common model of functioning
IHAN as a project had an European wide scope from the beginning and a heavy emphasis
on technology, service implementation and technical specifications. How to do European
cooperation on this kind activities? How to scope the work?
Alternatives:
- ISO
- IEEE
- ETSI
- CEN

49. CEN
- The European Committee for Standardization, is an association that brings together the
National Standardization Bodies of 34 European countries.
- More than 50.000 technical experts involved
- One of three European Standardization Organizations (together with CENELEC and
ETSI) that have been officially recognized by the European Union and by the European
Free Trade Association (EFTA) as being responsible for developing and defining
voluntary standards at European level.
- Supports standardization activities in relation to a wide range of fields and sectors
including: air and space, chemicals, construction, consumer products, defence and
security, energy, the environment, food and feed, health and safety, healthcare, ICT,
machinery, materials, pressure equipment, services, smart living, transport and
packaging

50. © CEN-CENELEC 2019 - 50
CEN and CENELEC and their deliverables

51. CWA = CEN Workshop Agreement
- CWA is pre-standardization document
- In 2019 CEN had total of 484 CWAs
- A Workshop is the technical body that develops and approves a CWA, the CEN
Workshop Agreement
- CWA reflects consensus of identified stakeholders - the Workshop participants who
drafted and approved CWA are indicated in the Foreword
- Workshops are self-funded
- Participation in the Workshop is open to anyone willing to join and accepting the project
plan
- Some latest workshops:
– “Reference model for distribution application for microgrids”
– “Real drive test method for collecting vehicle in-cabin pollutant data”

52. How did the work go?
- Meeting with CEN on February 2018
- Agreement with SFS (a CEN member) on June 2018
- Approval from CEN August 2018
- Project plan published at CEN website
- Kick-off meeting 01/2019
- Three theme specific kick-off meetings:
– Identity 02/2019
– Consent 03/2019
– Logging 04/2019
- Planning 02-07/2019
- Specification writing, commenting, bi-weekly teleconfs 08-12/2019
- Spell check and fine tuning 01/2020, 39 pages
- Sent for approval 01/2020

53. What next for our CWA?
- 3 years available for free after publishing, can be prolonged for another 3 years
- Who can benefit from our work?
– Anyone creating Internet services which need identity, consent or logging
– European projects; CWA can be utilized in research and development by research institutions,
universities and private enterprises. Especially EU funded (Horizon) project benefit from SDO
reference documents.
– It is also our goal that this CWA will be further developed by CEN as a Technical Report (TR),
Technical Specification (TS) or as a European Standard (EN)
- In Sitra’s IHAN project
– Requirement specification work continues in other areas

54. AND ARE WE SATISFIED?

55. sitra.fi/en
@sitrafund

56. Blueprint 2.5

57. IDENTITY
MANAGEMENT
IHAN BOUNDARIES
Building block view (Blueprint)
END USER SERVICE
PROVIDER
DATA
PROVIDER
DATA SOURCE
DATA ACCESS
LOGGINGLOGGINGLOGGING
OUTBOUND
DATA ADAPTOR
INBOUND
DATA ADAPTOR
CONSENT
DIRECTORY
SERVICE
DIRECTORY
CONSENT
DIRECTORY
SERVICE
DIRECTORY
IDENTITY
WALLET
IDENTITY
DATA TRANSPORT
API LAYER

58. IHAN Testbed

59. https://ihanapp1-test.azurewebsites.net/

110. IHAN tech – what’s next

111. IHAN tech – what’s next?
- Pilots on-going
- Blueprint development 2.5 → 3.0
- Testbed launch
- Development environment
- ?

112. JOIN THE DATA
REVOLUTION
IHAN® ENABLER OF A
PARADIGM SHIFT