Andy Tobin has a great presentation that describes five problems of Internet identity. Our claim is that self-sovereign identity, and Sovrin in particular, solve these five problems:

The Proximity Problem—The proximity problem is as old as the familiar cartoon with the caption "On the Internet, nobody knows you're a dog." Because we're not interacting with people physically, our traditional means of knowing who we're dealing with are useless. In their place we've substituted username-password-based authentication schemes. The result is that people's identity information is replicated in multiple identity silos around the Internet.

The Scale Problem—Digital identity currently relies on hubs of identity information. We login using Facebook or Google—huge "identity providers." But for every place that uses one of these big identity providers, there are dozens that will never be part of the social login system. Many businesses are leery of giving up control of their customer information to another business that might decide next week to change things up. I don't think it's any accident that this is the same concern that was holding back online services in the days of CompuServe.

The Flexibility Problem—Many of the so-called "identity solutions" in play today are limited by fixed schema or attribute sets. For example, GOV.UK Verify is a univeral identity assurance system for UK citizens but has a limited data set. And it's unlikely that they could reasonably expand whatever schema they have to cover all use cases, even if they were inclined to do so.

The Privacy Problem—Current digital identity solutions rely on collections of data, often collected without subject's knowledge. The data is replicated over and over again in different systems. Third parties use universal identifiers like Social Security Numbers or phone numbers to correlate identity information, again without the subject's knowledge. They are a 20th century tool that is unsuited to the digital age.

The Consent Problem—And the data in these thousands of identity silos is often shared with others without consent. Sometimes this is done in service of the subject, but often it's done in service of the bottom line of the organization who controls the silo.

The Sovrin Architecture

Sovrin has a unique architecture that addresses these five identity problems. Sovrin is designed to discourage correlation, minimize disclosure, and promote security. Sovrin's architecture is decentralized so that these benefits are available to all. This is achieved through the careful combination of several important technologies:

Decentralized Identifiers (DIDs)—DIDs are identifiers intended for self-sovereign, verifiable digital identities. Sovrin uses DIDs in a manner that is pairwise and psedonymous. That is, each relationship is given a new, opaque DID by default to prevent correlation. DIDs point to DID Documents that contain public keys and service endpoints and are thus the means of locating the place the identifier can be used and providing the keys to use it.

Verifiable Claims—Verifiable claims are the digital equivalent of the various third-party credentials we all carry around in our wallets. These credentials have several important properties:

• The format and content of the credential is determined by the issuer, not some central authority.
• Anyone can issue whatever credentials they like.
• Anyone can choose to accept whatever credentials suit their purposes
• The credentials say who they're about (using a DID)
• The credentials say who issued them (using a DID)
• The credentials are packaged in a way that makes them tamper-evident

The claims can be verified by anyone without any kind of technical integration to or business arrangement with the issuer.

Zero-Knowledge Proofs—Zero knowledge proofs (ZKP) allow a person to prove things about themselves, based on verifiable claims, without having to reveal the claim itself. This reduces the amount of data given out by a person. For example, a ZKP can just reveal that the holder of the claim is over 18 without revealing the date of birth or even their age. ZKPs also provide support for non-correlation by proving the claim is about the identity owner without revealing the identifier that the claim issuer has for the person.

Agents—Sovrin's architecture supports independent software agents to hold and process claims as well as to perform identity transactions on the identity owner's behalf. These agents interoperate directly with each other as peers. Sovrin specifies the protocols that agents use so that agents from different vendors can work together and to support substitutability.

Distributed Ledger—A distributed ledger provides a place where decentralized artifacts like DIDs, verifiable claims, and proofs can be anchored. When agents create or resolve DIDs, they are interacting with the ledger. When an agent creates a claim or a proof from a claim, the various parts of the claim are referenced on the ledger. Without a ledger, agents would need a central repository of some sort to resolve DIDs. The ledger enables decentralized identity by doing away with the need for a central authority.

Handling the Five Problems of Identity

The architecture of Sovrin is designed to solve the five problems of identity.

• DIDs and verifiable claims solve the proximity problem by giving people the means to prove information about themselves at a distance.

• Agents and the ledger ensure that Sovrin scales by supporting a decentralized system of interacting peers that can scale to any size.

• The decentralized nature of claims and claim schemas solves the flexibility problem because people can use Sovrin for the whatever identity problem they face. Everyone can design and use whatever claims will solve their problem.

• DIDs and zero knowledge proofs provide tools for increased privacy by limiting correlation and supporting minimal disclosure.

• Sovrin supports consent because the identity owner is structurally part of all identity transactions. Sovrin agents, under the identity owner's control, automatically and privately record for both parties what was shared and under what terms.

Most physical world identity transactions are self-sovereign. They put people at the center and use decentralized credentials to transfer trustworthy attributes about the identity owner. The naturally support scalable, flexible, private interactions that take place with the identity owner's consent. The Internet introduced the proximity problem and the available solutions and their inherent limitations led us the situation we're in now.

Sovrin capitalizes on decades of cryptographic research and the now widespread availability of decentralized ledger technology to rethink identity solutions so that we can have scalable, flexible, private interactions with consent despite the issues that distance introduces. Sovrin introduces protocols for identity that govern interactions so as to solve the five problems of identity.

Photo Credit: Some IDs may be invalid starting Sept. 15 from Airman 1st Class Mariette M. Adams (Public Domain)