Enhancing Identity Management with Hyperledger Indy

As all of us deal with the digital world and come online and enter personal information to perform various tasks ranging from shopping a new item to studying about a new topic, carrying out financial transactions and connecting with people on social media platforms. It has made the development and emergence of identity management more critical than ever.

With increasing online transactions, issues like identity theft and data loss have started to emerge. Many digital activities require that individuals disclose their personal information before they can access any service.

Every time a person reveals information on digital platforms, it is stored on numerous unknown databases on the internet.

A lot of identifiable information is exchanged without our consent. Also, it gets saved in locations we are not aware of and may create tremendous attacks if compromised. Since the identities are managed in a centralized way, individuals don’t have control over their identities.

Concerning identity management, it has been found out that the blockchain technology can eliminate the need for central authorities and enable individuals to have control over their digital identities.

To overcome the issues in identity management, Hyperledger has incubated a project called as “Indy” to provide digital identities based on the blockchain.

This article will help you to understand how Hyperledger Indy can address the problem of identity management across the world.

Let’s first discuss how existing centralized identity management works and why it requires an innovative change.

Centralized Identity Management

Internet was initially built as a peer-to-peer web of connections so that users could communicate with each other without depending on an intermediary.

But when the internet started becoming privatized, third-party intermediaries began to emerge and became a fundamental part of the internet’s infrastructure.

In a centralized identity model, any controlling entity can gain control over everything from issuing website security certificates to curating online identities and patrolling access to the world wide web.

The centralized control allows the authorities to gather a massive volume of personal information, stored on servers which can be hacked. Also, the collection of confidential information in the hands of the controlling entities increases the risk of data breaches in the future.

The use of a centralized identity management system may lead to the following issues or challenges:

• Lack of Transparency
  A lot of privacy violation incidents including the Cambridge Analytica Scandal, DeepMind’s illegal patient data sharing and Spain and France fining Facebook were reported in the last few years.The Spanish Data Protection Authority (AEPD) said that Facebook had not been following privacy rules as it used the personal data for advertising purposes. According to the Commission Nationale de l’Informatique et des Libertés (CNIL), Facebook did not inform users of how their data is shared and tracked with advertisers.In many of the privacy violation cases mentioned above, the identity owners do not have any idea where their personal information is being used and how.Another drawback is the lack of controllability of your data. Even after deleting the account on Facebook, you cannot delete it entirely.Though it is your information, you cannot even delete it.
• Identity Theft
  Any data related to the identity on the internet can be theft easily. Breach Level Index says over 7,125,940 records are stolen with each passing day; as a result, it accounts for 296,914 records per hour and 4,949 records in a minute. Such data theft cases indicate how fastly a hacker can tap into the network for stealing information.
• No Global Identity
  Individuals have to submit a new set of documents everytime they have to apply for documents such as driving license, passport or PAN card.Submitting the same documents every time to confirm the authenticity can make the entire process cumbersome and time-consuming. Currently, there is no global identity which can authenticate a user and verify their background entirely from a single ID. Collection of multiple documents becomes a tedious task for both the identity holder and verifying entities.
• Economic Burden
  Identity management system mainly involves three types of stakeholders, i.e., verifying companies, identity holder and entities that need to authenticate users.The current identity management costs are high for all these entities. As KYC companies have to process requests of multiple organizations like banks, hospitals, insurance providers and immigration officials, they are overburdened and require more resources.To fulfill the requirement of manpower, KYC companies charge a higher verification cost, which is converted into the hidden processing fees to the individuals.A global survey of the “Know your customer” challenges says that the average annual spend on global KYC is stated as the US $48million. Furthermore, the study indicates that the time to onboard also remains lengthy, i.e. around 26 days and the time it takes to refresh the user’s records is 20 days that is quite excessive.Therefore, the current identity management system is a financial burden to every stakeholder of the process.

Talking about the initial phase of identity management history, the identity data was controlled by a centralized authority.

The federal identity enabled the identity holders to use a single identity for multiple purposes with the owner’s consent.

But due to its approach to centralized data storage, the federal identities were centralized and non-transparent to the individuals.

After the failure of these identities, the concept of user-centric identity gained traction with the aim of providing identity holders with the control of the digital identities.

But user-centric identities were also limited to the identity register which can revoke access to the user’s identity without the consent of the owner.

As the existing identities failed to address the issues in the identity management system, self-sovereign identity was introduced to give full control to the identity owners.

Self-sovereign identity offers the control of digital identity in the hands of identity owners rather than third-parties or organizations.

To make an identity self-sovereign, the infrastructure of identities should be a decentralized platform instead of a distributed platform.

Hyperledger Indy is one of the distributed ledger platforms which has been designed for decentralized identity. Let’s discuss decentralized identity management in detail before we move to the Hyperledger Indy’s environment for building a digital identity.

Decentralized Identity Management

Imagine you are migrating to a new country and you have to apply for various types of services such as driving license, electricity connection, voting and entertainment subscriptions.

Users need to prove their identities for opening an account by registering with each service provider individually. They either have to remember the combination of usernames and passwords or other credentials for authentication purposes.

Decentralized identity management simplifies the entire process with the underlying blockchain and cryptography technologies.

A decentralized identity ecosystem emphasizes confidentiality (anonymity) with a cryptographic solution for password and key management. It not only improves the security and privacy for identity owner but also makes it easier for verifying entities to authenticate the users.

Since the records stored in a distributed ledger are immutable, it will be impossible for hackers or unauthorized entities to hack or steal personal information of users.

Every authorized entity requires the consent of identity owners to access their personally identifiable information (PII).

As PII is not stored in the centralized databases and every node on the blockchain based identity platform maintains a copy of the ledger, there are no chances of a single point of failure.

So, it is clear that a self-sovereign identity based on the decentralized model can offer strong privacy protection.

Now, we shall explain how Hyperledger Indy can provide users with a unique and robust identity management solution.

Self-Sovereign Identity Management with Hyperledger Indy

Hyperledger Indy project allows you to build a secure, scalable and robust self-sovereign identity solution. Indy enables to store identities in a location where it can be edited or deleted.

Once you provide a location for identities, Hyperledger Indy platform can list location with a globally identifiable name. If anyone wants to access the identity data, Indy platform can point out the location where it is stored.

The roles of key players of self-sovereign identity management solution are as follows:

• Identity Provider
  Self-sovereign identity solution does not have a centralized identity provider, but there can be a well-defined standard to create, revoke and share identities according to the identity owner’s consent.
• Identity Owner
  Identity owners have their own independent identities verified by their own set of public/private key pairs. This identity system depends on a distributed ledger managed by the key players in identity management.
• Identity Validator
  Identity validator is not a central authority, but the individual parties who have gained trust. They can validate the identities with their private keys, whereas outside parties can verify the identity with the public key of validators.
• Identity Users
  Identity users use the distributed ledger of identities to get identities and verify it on their own.

Let’s understand how the complete process works.

1. Users can decide a human-memorable name for the identity.
2. The identity name can be converted into a unique key called as “DID” (Decentralized identifiers) on the ledger. The values associated with the key are known as DDO (DID descriptor objects). The combination of DDO and DID is referred to as DID record.
3. Users can be identified with the DID record on the distributed ledger. The private keys of an identity owner cryptographically secure each DID record.
4. A public key corresponding to the key-pair is generated in the DDO with a key description. DDO also contains a set of service endpoints to interact with the identity holder.
5. There is a DID method specification associated with each DID which defines the set of rules for how a DID is registered, updated, resolved and revoked on a specific ledger or network.

Off-ledger Interactions

As the ledger is public, it is essential to ensure that the personally identifiable information should not be exposed on the ledger. The following items are stored on the ledger to ensure the privacy of a public ledger:

• DIDs
  Decentralized identifiers which are pairwise unique.
• Public Keys
  Allow encrypted interaction with the identity owner.
• Service Endpoints
  Allow communication with the identity owner through an associated agent.
• Proofs
  Zero-knowledge proof or hashed artifacts to enable identity owners, validators and dependent parties to verify the validity period of specific information.

Verifiable Claims and Zero Knowledge Proofs to verify the identities built on Hyperledger Indy

Hyperledger Indy provides the built-in support for Zero-knowledge proofs to avoid unwanted disclosure of identity attributes.

A verifiable claim is a requirement when the dependent parties have to verify the identity holders’ information. Claims can be issues against the unique DID pairs registered on the ledger, signed by the issuer’s private key and verified by the public key of issuers.

Off-ledger agents can handle claim exchanges and verification with the service endpoints discovered in the DDO.

Indy offers Zero-knowledge proofs for cases when the verifiable claims are not considered true.

Zero-knowledge proofs enable identity owners to authenticate the possession of a credential without displaying the credential itself with the help of anon cred (anonymous credentials).

Let’s consider an example of exchanging college education details (claims) of a candidate to the organization.

• Before the claims are issued, the authority for education certificates creates a claim schema, public keys and a revocation registry entry on the ledger.
• The authority provides the candidate with a verifiable claim, confirming he has completed and passed out the graduation successfully via DID A.
• The candidate then presents proof of a subset of his claim- whatever information he chooses- to the organization where he’s applying for a job via DID B. He also includes a proof that his claim has not been revoked by identity validator.
• The organization can verify the authenticity of a candidate’s education certificates without approaching the identity validator.

Solving the problem of interoperability in identity across DLTs (Distributed Ledger Technologies)

People nowadays have multiple accounts on various social media networks (Facebook, Google, Twitter, etc.). They hold different credentials for authentication to access each of these accounts.

A lot of attributes can be duplicated on different identity providers for the same user. As a result, it becomes difficult to manage the identity attributes in a seamless way.

Some specific service interactions need to use identity information from different sources. For example, the date of birth from one account, contact number from the second account and so on. Currently, the user needs to select attributes from multiple identity providers to access many digital services.

Therefore, a protocol for identities must be secure, interoperable, private and open to everyone.

The following items were designed to accomplish the interoperability in identities across DLTs:

• DIDs
  Decentralized Identifiers are interoperable and unique identifiers which do not require a centralized authority. As DID can link to service endpoints and public keys and they are pairwise pseudonymous, it can prevent correlation and maintain privacy. People can have hundreds or thousands of DIDs representing the various digital relationships.
• DDOs
  DDOs are JSON objects which expose the service endpoints and public keys to interact with the entity identified by the DID.
• Verifiable claims
  Verifiable claims are interoperable and standard combined with the zero-knowledge proofs to enable minimal disclosure.

Components involved in an identity solution built on the top of Hyperledger Indy Platform

1. Cryptography
   Identity solution built on Hyperledger Indy uses Zero-knowledge cryptography using which one party can prove another party that they know the value of X without revealing other information apart from the fact that they know the value of x.
2. Nodes
   Nodes can be classified into simply nodes, master nodes and full nodes.A computer which performs transactions on the blockchain network is termed as a node, a client operating on the network which maintains a full copy of the blockchain is known as a full node. On the other side, master nodes allow decentralized governance.Nodes achieve consensus in the identity solution built on Hyperledger Indy using Redundant Byzantine Fault Tolerance mechanism.Redundant Byzantine Fault Tolerance (RBFT)
   RBFT is an advanced Plenum Byzantine Fault Tolerance mechanism where multiple instances of a BFT protocol are executed parallelly. Every instance has a primary replica. While all protocol instances order requests, only a master instance executes them efficiently.
3. Ledger
   Backed by Merkle tree, the ledger is replicated across all nodes in the network.
4. State and Storage
   Similar to Ethereum, the state in Hyperledger Indy is managed by Patricia Trie. It is a combination of Radix Trie and Merkle Trie, used to store data.Storage for each node is implemented with leveldb which provides the implementation of a key/value database. It offers an ordered mapping from string keys to string values. Indy stores DIDs as state variables with values.

Recovering the compromised DIDs

In case, your identity is theft or loss, it can be recovered again by requesting an identity provider with a supporting identity proof document. As the identity provider would have the details stored on the distributed ledger, the decentralized identity can be re-issued.

Identity validators can re-validate the identity with the help of biometrics information saved on the ledger. An identity owner is then verified and can recover the lost decentralized identity.

Though decentralized identity management solution can be built using various blockchain platforms, Hyperledger Indy project promises to design a solution that comes with the following features:

• User-controlled exchange of verifiable claims
  No doubt that the Indy public network is open to all, it is only an identity holder who permits the identity to be validated.
• Accessible provenance for trusted transactions
  Indy is a universal platform which allows exchanging trusted claims to provide a trusted provenance.
• Privacy on the public ledger
  Indy’s architecture includes a unique feature called “Privacy by Design.”

The unique principles of Hyperledger Indy project explicitly designed for decentralized identity allow us to get rid of the existing issues in the identity management solution.

We, at LeewayHertz, have a team of Hyperledger blockchain experts who have an in-depth understanding of implementing and building identity management platform with Hyperledger Indy project.