How blockchain makes self-sovereign identities possible
One of the curious constructions of the Internet is the term identity provider. You don’t need anyone to provide you with an identity, of course. You have an innate one by virtue of being human. Rather, so-called identity providers, or IDPs, provide you with an identifier, a means of recording attributes important to that provider, and some method of proving it’s you – usually a password.
This is not surprising since online identity has traditionally been viewed through the lens of an organization and its needs, not the individual and his or her needs. Identity systems are created to administer identifiers and attributes within a specific domain. The result: people end up with hundreds of online personas at hundreds of organizations. Each of these administrative identity systems is proprietary and owned by the organization that provides it; you really don’t have an online identity that’s independent of these many systems. Got a new address, or an updated credit card number? You’ll have to deal with each of these systems one at a time in whatever manner they require.
But what if you could do that in one place at one time? Sure, Computerworld, Amazon, or whomever would still want to keep an account, and still need your updated address. But that account would be linked to an identity you provide. More importantly, it would be one you control.
This concept is called self-sovereign identity. Self-sovereign identity starts with the notion that we all are the makers of our own identity, online and off. Because they do not rely on any centralized authority, self-sovereign identity systems are decentralized, mirroring the way identity works in real life.
Offline, our interactions flexibly support the use of attributes and credentials from numerous third parties, all presented by the very person they’re about, typically by taking those credentials out of a wallet or purse and presenting them to someone else to verify. For example, take a driver’s license. States issue it as a credential that you’re authorized to drive. But, it’s useful for a lot more. When you show up at a bar and the bartender wants proof you’re over 21, you show them your driver’s license.
Think about this for a minute and you’ll realized that this is a minor miracle, at least compared to how online identity works. The bar has no legal contract, business relationship, or technical integration with the Department of Motor Vehicles (DMV). They didn’t get anyone’s permission. They just started asking people for their license. The person they’re trying to verify gives them the credential. This works because the bar trusts the DMV to know your birthday. And the important information is packaged in a way that makes it easy to authenticate and difficult to forge.
The offline world makes use of decentralized credentials that are granted to and conveyed by the person they’re about. Identirati call these kind of third-party credentials claims – claims that can be verified as authentic even when they’re conveyed by the subject of the claim. These “verifiable claims” are the heart of self-sovereign identity.
Self-sovereignty doesn’t mean that you’re in complete control. But, it does define the borders within which you make decisions and outside of which you negotiate with others as peers. To continue the bar example, you get to decide what credential to present. The bar gets to decide what credentials it’ll accept. It doesn’t have to accept your driver’s license. If the bartender thinks it’s fake, he’ll reject it along with you.
