..png)
The COVID-19 pandemic has considerably accelerated the digitization of the economy and, with it, the use of authentication tools to simplify previously time-consuming administrative tasks, facilitate citizens' access to essential public services, and also to secure entries in relation to institutions.
The Secure Identity Alliance, a non-profit organization that brings together major digital identity players such as Archipels, Thalès, IDEMIA, IN Groupe, Veridos, Entrust and Signicat, published a white paper on November 10 entitled On the Road to User-Centricity: Digital ID in the E-Wallet Era (which provides an overview of existing uses, best practices and digital identity models.
In our blog post, we will look back at :
- The definition of digital identity
- The diversity of identity models and their applications in concrete use cases
- The latest trends in current identity standards
What is digital identity?
Although there is a lot of literature on this subject, it is nevertheless worthwhile to recall what the notion ofdigital identity covers.
Identity is a set of attributes that refer to an entity or individual in a given situation or context and that serves a specific purpose.
Digital identity leverages these attributes to support individuals and entities in their online economic and social interactions. The use of a digital identity can facilitate several real-life use cases such as:
- Registering for a new service
- Access to an online resource
- The signature of an electronic document
- Proving eligibility for a service
In many countries, these examples have become commonplace, and if they weren't, the health measures following the pandemic have made it imperative to implement digital identity management systems.
Decentralized identity
The concept ofdecentralized identity emerged with the emergence of Blockchain technology that updated the issue of identity attribute administration.
While in a centralized system, identity attributes are the exclusive property of the issuer (for example, the ANTS for driver's licenses), in a decentralized system, it is the holder of the identity attributes who controls all interactions with its issuers and verifiers.
The diversity of identity models and their applications around the world
There are three digital identity management models that stand out in the current landscape:
The centralized model
So-called "centralized" identity management models are characterized by the existence of a central entity - often public - in the issuance and control of identity attributes.
In this system, data is controlled by public authorities or by a small number of actors with the privilege of generating identity attributes.
If the advantages of this model lie in a clear management by defined entities, the risks of failure can be very expensive... A hacking of the entities concerned could jeopardize the confidentiality of these data and a fraudulent use...
However, many countries are committed to this model, such as India with its AADHAR system, which lists all the digital identities of the entire Indian population in order to access trust services such as electronic signatures, eKYC operations or authentication for banking services.
Another example of the use of a centralized identity management system is Nigeria's digital identity applied to agriculture. The NIMC ID (Nigeria's National ID Management Commission) allows farmers to open bank accounts or make transactions more easily.
The federated model
Federated models give individuals the ability to access many online services using a single combination of digital identity attributes. While this system greatly facilitates the user experience (as users do not need to memorize dozens and dozens of passwords), the management of the attributes is delegated to a central authority - which can be public or private.
In the private sector, the best-known example is social networks such as Facebook or Twitter, where logins and passwords are used to create accounts or access other private services.
In the public domain, there are many examples. For example, France Connect allows French citizens to manage their health insurance, pay their taxes or follow their administrative procedures. In the SIA white paper published in collaboration with Archipels, you will find many other use cases that make use of this federated model.
The decentralized model
We have dedicated a white paper on decentralized identity that details how decentralized digital identity management works. Without going into detail, let's just remember that this model allows end users to directly control their digital identities based on a distributed architecture.
Let's take the example of a credit application to a bank using this decentralized identity model:
While skeptics will point to the relative immaturity of this technology, the advantages of this model are numerous:
- It offers unparalleled security in terms of personal data management
- It is based on interoperable standards allowing private and public entities to add functional layers easily (W3C has built accessible open-source standards)
- It gives the end-user full control over their identity attributes.
Although cutting-edge in its technological proposal, it is a solution that is being adopted by countries such as Switzerland, which is building a decentralized architecture for digital identity management at the cantonal level. For more information on this subject, please feel free to consult the copy of the AIS white paper entitled On the Road to User-Centricity: Digital ID in the E-Wallet Era (in English).
Identity standards for tomorrow's world
ISO 18013 -5
Deployed in September 2021, part 5 of this standard on personal information concerns driving licenses. Thanks to this standard, which is interoperable, secure and respectful of privacy, the mobile driving license (mDL) will now be contained in a mobile application including a digital version of the driving license.
The authority authorized to issue the driver's license (in France, the ANTS) will issue the title to the holder who will store it on the mobile application for presentation to the verifying authority (a car rental agency for example).
Like any self-respecting standard, the use of the latter will be subject to its adoption by the authorities in charge of issuing permits but also to the holders who will have to download the mobile application in question.
ICAO DTC
The International Civil Aviation Organization (ICAO) has developed a guide for the development of a Digital Travel Credential (DTC) that facilitates airport identification operations and related travel services.
This DTC is generated by the end user from their smartphone or from a kiosk at the airport. The DTC consists of two parts:
- A virtual component that contains the structured data of the individual's identity (like the biometric passport for example).
- A physical component that incorporates cryptography and is capable of communication (such as a connected watch, smartphone or electronic passport). This physical component is held by the passenger.
The DTC is issued by the user and is subject to an electronic signature by an independent authority in charge of issuing the passport and therefore certifying the authenticity of the travel document.
W3C - Verifiable Credentials and DIDs
With the emergence of digital identities in everyday life, the question of their monetization by private companies, with proprietary technological standards, has become a central topic of debate.
With the development of blockchain and distributed ledger technologies, the ideal of a decentralized, self-sovereign, privacy-friendly Internet has become popular.
It is on this promise of entry into the web3 era that the W3C has relied for the development of standards for decentralized solutions for authentication and verification: Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), for which you will find precise definitions in our article on these subjects.
While Verifiable Credentials are standardized digital certificates issued by an entity that certifies properties about an individual (e.g. a state or an educational institution), DIDs facilitate identification under the control of the end user.
Identity at the heart of Web3 interactions
If the approaches to digital identity models are as multiple as the geographical areas that adopt them, it is clear that the issue of digital identity has become paramount.
Digital identity greatly simplifies access to public services and, more broadly, between the private and public sectors for a variety of uses. It also requires very high security standards, as it enables the management of sensitive activities such as paying taxes, proving eligibility for a consumer loan or downloading medical certificates.
With this in mind, it is more important than ever to learn about the technologies that can be used to manage the digital identity of individuals, from the certification of their attributes to the verification of these attributes.
We believe that Blockchain technology is best suited to meet these objectives of simplifying online interactions but also of securing them through certification.
If you have any questions or would like to explore specific use cases for implementing a digital identity management strategy, please contact us!
.jpg)
