IDnow: Selective disclosure in the identity wallet

FinTech Magazine speaks to Dr Heinrich Grave, IDnow’s SVP of Digital Identity about ways identity wallets can help instill self-sovereign identity through selective disclosure. 

How does the centralisation of personal data increase the risk of cyber-attacks?

Name, date of birth, address, email address, passwords, tax records, or payroll – all this sensitive user data is stored by companies in huge databases to identify individuals for digital services. 

Although companies have long applied principles to limit employees’ access to such data in accordance with the “Principle of Least Privilege”, the centralisation of personal data increases the risk of cyberattacks. 

We have seen this time and again in prominent examples of data breaches in which millions of records are leaked at once. 

This is because, in this kind of setup, a single data leak or targeted hacker attack puts all digital identities contained in the system at risk. 

Additionally, central storage, despite GDPR and other regulations, increases the risk that personal data will be misused for commercial purposes that the user has not agreed to in advance.

How will identity wallets help with self-sovereign identity?

In the future, self-sovereign identity (SSI) will provide a solution to this challenge. It gives users back control over their own data – without it being able to be manipulated, duplicated or stolen. 

A central component of this architecture is the concept of the digital identity wallet that the EU is currently working on. These wallets will enable every citizen to regain control over their own digital identity and how it can be used. But how exactly will this be implemented? 

As it stands today, a user can enter a record into a service provider’s system (e.g., an e-commerce platform, a mobility provider, or a travel provider) and in the process they are agreeing – intentionally or not – that the entire record may be used by the provider for the service. 

There is no mechanism in place to determine which attributes of the data set are necessary to perform the particular service, but this will change in the future, thanks to the wallet technology.

How can identity wallets limit data disclosure?

With the help of the wallet, the user can limit the disclosure of his data to those attributes that are actually necessary for the provision of the service, e.g. a user’s legal age or a successfully completed university degree. 

This selective disclosure enables an individual to share parts of a larger data set. For example, a user who wants to access an online sports betting site will no longer have to provide their exact date of birth to prove that they are over 18. Instead, they can share the attribute “legal age/18+” from their identity wallet, because this information has already been verified elsewhere. 

This is usually where the concept of “Zero-Knowledge-Proof” (ZKP) comes into play. ZKP is a cryptographic security protocol that makes it possible to prove the authenticity of an attribute (e.g., legal age) about a person. 

What makes it special is that the authenticity check can be performed without having to reveal the actual value of the data (e.g., date of birth). 

In the event of a data leak at the company, no personal user data, such as date of birth, can be leaked because, in this model, the company never had that data.

ZKP protocols are among the most secure in the world when it comes to protecting the privacy of users of online services. Thanks to ZKPs, the use of personal identity data can be significantly restricted. 

As a result, the model goes far beyond the principle of data minimisation, which has often been difficult to adhere to in practice, or is deliberately not adhered to by individual companies in order to keep the generated data sets as large and extensive as possible for marketing purposes.

What are some alternative approaches to attribute verification?

In addition to the ZKP protocols, two other procedures are often being discussed for the implementation of selective disclosure: One is “just-in-time issuance”, i.e., the issuance of the attribute is requested as needed – similar to just-in-time logistics – and the other is the principle of the “trusted witness”. 

• Just-in-time issuance, i.e., the request for verification of the attribute from the issuing party, requires an extremely high availability of the issuer, which must be able to deliver information on the authenticity of the attribute to a large number of people at any time and, if necessary, simultaneously. This leads to an extremely high infrastructure load for the issuer. In addition, this model often eliminates an important part of the anonymity of the process, since the issuer knows which services the user of the identity wallet uses through the direct request of the service provider (e.g., a sports betting platform).
• Another alternative approach, that of the “trusted witness”, shifts the problem described above to another party. In this model, the issuer no longer has to be highly available and does not gain insight into the services used by the user, but instead a third, extremely trustworthy party, the “witness”, is needed to take over these functions and act as an intermediary between the issuer and the trusting party (i.e., the service provider). 

As you can see, in both alternative procedures described above, there is a lot of pressure on the infrastructure of the issuer and the “witness”, respectively. 

This slows down the verification of the attribute significantly, especially under high request load. Both models can also be classified as less secure than the ZKP protocols since they give the parties involved more insight into the identity data.

How does decentralised storage lead to data sovereignty? 

Currently, the personal data of every citizen is stored in private and public databases. With the identity wallet, they will be decentralised, with individuals able to manage them on their own smartphone. 

The user thus becomes the sovereign of their data and can consciously decide to share it without fear of it falling into the wrong hands. Thanks to selective disclosure functions, the user regains control over their digital life, personal data and the dissemination of this data. 

******

For more insights from FinTech Magazine, you can see our latest edition of FinTech Magazine here, or you can follow us on LinkedIn and Twitter.

You may also be interested in our sister site, InsurTech Digital, which you can also follow on LinkedIn and Twitter.

Please also take a look at our upcoming virtual event, FinTech LIVE London, coming on 8-9 November 2023.

******

BizClik is a global provider of B2B digital media platforms that provides executive communities for CEOs, CFOs, CMOs, Sustainability Leaders, Procurement & Supply Chain Leaders, Technology & AI Leaders, Cyber Leaders, FinTech & InsurTech Leaders as well as covering industries such as Manufacturing, Mining, Energy, EV, Construction, Healthcare, and Food & Drink.

BizClik – based in London, Dubai, and New York – offers services such as Content Creation, Advertising & Sponsorship Solutions, Webinars & Events.