You don’t need to look very far to realize that managing digital identity remains a challenge in today’s society. Billions of data records are compromised in hacking scandals and data breaches. The average internet user manages about 70-80 separate usernames and passwords. Phishing techniques frequently trick us into revealing IDs and passwords. Identity theft results in an estimated $17 billion of losses per year. And the list goes on.

These are the issues plaguing individuals who possess digital identities. An estimated 1.1 billion people in the world are unable to prove their identity thus obstructing them from accessing vital healthcare, education, and financial resources.

But what exactly are we referring to when we say “identity”? Well, a lot of different things.

They come in different shapes and sizes from government issued IDs (driver’s licenses, passports, food stamp vouchers, voter IDs) to healthcare IDs (physician licenses, digital prescriptions, medical records), to financial IDs (know your customer profiles, credit histories) to social IDs (browsing histories, social media interactions). And more broadly, they represent any information you decide to share with a specific person or entity at a specific point in time.

But regardless of what the actual ID represents, most identity management frameworks are composed of three parties: issuers, holders, and verifiers. Issuers are trusted parties that issue credentials and attest to their validity. Holders are the individuals to whom the credential is issued. Verifiers are the parties responsible for authenticating that IDs being used represent the holder and were indeed issued by the alleged issuer.

The issuance of a driver’s license provides a simple example of how identity is managed. In the United States, the State’s department of motor vehicles responsible for processing license applications and granting licenses represents the issuer. The driver to whom the license is issued represents the holder. And any person or party using the ID to authenticate the individual’s identity would represent the verifier.

As is common with most multi-party transactions, the underpinning of this identity management relationship is trust. The verifier trusts that the issuer, in this instance the department of motor vehicles, issued the ID and usually physically inspects it to verify this. The holder trusts the department of motor vehicles to safeguard and store its personal data. And this is just one example of the trust relationship that exists between stakeholders in identity management.

More broadly, internet users both explicitly and implicitly entrust billions of personal data records to social media platforms, financial services companies, healthcare providers, and just about anyone who is providing them services and verifying their identity.

Abstracting from the fact that many of these providers monetize their customers’ data and online activity under the guise of a “free” service, this results in duplicative, centralized databases that amount to honeypots to be exploited by hackers. The costs associated with these centralized identity frameworks are hard to quantify. Equifax paid $575M to the US Federal Trade Commission and state government agencies in a settlement related to its 2017 data breach. But these are only the explicit costs borne by the company and do not account for the costs borne by the users who had their sensitive personal information leaked. The opportunity costs associated with granting companies and other parties access to sensitive data in return for a “free” service are even harder to quantify.

Decentralized Identity Solutions:

The mission statement of most decentralized identity solutions is something along the lines of “give individuals control over their own identity”. But what exactly does that mean and how is it achieved?

In short, it means leveraging blockchains and public/private key cryptography to manage the issuance and verification of digital identities. And by leveraging this blockchain infrastructure, a lot of different things become possible. Individuals can more selectively decide when and with whom their information is shared as they control the private keys to their identity. Counterfeiting of credentials becomes more challenging as digital signatures cryptographically authenticate IDs and eliminate the need for manual verification of physical documents.

The key technical differentiating factor between decentralized identity solutions and their more centralized counterparts are decentralized identifiers (“DIDs”). DIDs are blockchain based IDs used to link ID holders (individuals, institutions) to blockchain based public key addresses. They provide the base trust layer for establishing who is who in decentralized information sharing paradigms and they come with four main properties:

They are permanent in that they never need to change.
They are resolvable in that they are used to look up metadata.
They are cryptographically verifiable in that control over them can be proved by signing transactions with private keys.
They are decentralized in that no centralized registration authority is required to issue them and store the related data.

According to the World Wide Web Consortium, there are currently over 90 DID method specifications in development across 80+ different permissioned and permissionless blockchain networks.

The graphic below provides an overview of what the ID issuance and verification process with DIDs entails.

The high-level steps can be mapped out as follows:

An issuer registers a public DID on their blockchain or distributed ledger of choice.
The holder provides the issuer the information needed to create a credential.
The issuer creates the credential, digitally signs the DID they created and then gives the holder the credential to put in their wallet.
When the wallet holder presents the credential to a verifier, the holder establishes a separate DID by effectively countersigning the DID registered by the issuer.
When the holder presents that digital credential to the verifier, the verifier can refer to the appropriate blockchain or distributed ledger to verify that the issuer did indeed digitally sign and issue the credential and that the holder is indeed the controller of the credential who countersigned the DID.

But what does this mean in practice? It means there is the potential for the issuer, holder and the verifier to all realize benefits and efficiencies over current solutions.

Issuers can eliminate many of the costs associated with issuing physical credentials that are susceptible to tampering and counterfeiting. Holders can be in greater control of their own identity and can decide when, with whom, and under what terms they reveal certain elements of their identity. Verifiers can have greater assurance that the credentials being presented are authentic and can offload costs and risks associated with manually authenticating IDs and storing sensitive customer information.

That is not to mention that this greatly reduces the risks associated with centralized customer data repositories. In a decentralized ID system, information is just that: decentralized and stored on local devices such as smartphones. And with decentralized data paradigms, the risk of ID theft can be confined to single users and wallets as opposed to large databases housing billions of records of personal information.

At a high level, the decentralized ID industry can be broken down into four pieces of a “decentralized identity stack” that is pushing the pace of adoption.

(i) Blockchain Infrastructure – Blockchains and distributed ledgers lay the trust framework for decentralized identity solutions. They include permissioned blockchains, such as Sovrin, in which organizations place controls over who can operate network nodes, and permissionless networks, such as bitcoin, in which any participant can run a node to participate in consensus.

The main purpose of blockchains is to manage the issuance of DIDs and provide a cryptographically verifiable and distributed registry. DID methods are being developed across both general purpose blockchains such as Ethereum, as well as blockchains optimized for decentralized ID management such as Sovrin, Veres One, and Ontology.

(ii) Standards & Interoperability – Entities such as the World Wide Web Consortium are developing standards for how decentralized ID data is structured and verified with a focus on making solutions interoperable.

(iii) Consulting & Deployment – Blue chip consulting companies and blockchain technology companies are bridging the gap between development and real-life decentralized ID use cases with educational resources and consulting services.

(iv) Wallets & Verification Services – Technology companies are developing wallet applications and verification solutions. Wallets are used to store personal identity credentials and the private keys associated with DIDs. Verification services allow companies to leverage decentralized identities, often stored in digital wallets, to authenticate their customers.

Decentralized ID Value Capture

Clearly, there are several stakeholders in the decentralized identity system. And while product development and experimentation are still very much ongoing, it is worth examining where value could accrue should decentralized ID solutions see broad adoption.

The most obvious beneficiaries at this point are individual ID holders. By being in control of their own identities, there are a myriad of ways in which users could benefit. In a quantifiable sense, this could mean being compensated to reveal personal information such as browsing histories, consumer preferences, or healthcare data. In a more qualitative sense, it is hard to put a dollar sign on the economic benefits of enhanced personal privacy afforded by these solutions.

Technology companies developing wallet applications and providing verification services could also benefit from growth in the ecosystem. Pricing matrices such as those provided by Civic, provide an early glimpse into what decentralized ID monetization structures could look like. Under these arrangements, companies providing ID wallets and verification services could charge verifiers a fixed SaaS rate or per use rate for leveraging their verification solutions to onboard and authenticate customers.

Additionally, value could accrue to blockchain tokens related to certain wallet applications such as the ones we have listed below. The use cases and designs of the tokens vary on a project-by-project basis but they are generally being employed to incentivize use of applications, transfer value within their respective identity and data networks, and in some instances grant governance features. All else equal, a meaningful increase in usage of their related wallets and ID networks could drive incremental token value depending on how these tokens are structured and integrated into their respective ecosystems.Decentralized ID related tokens have rallied along with the broader crypto bull market this year but nevertheless remain well below their all-time highs achieved during the 2017-2018 bull market. Based on our research, Ontology, Civic, and SelfKey represent the more active decentralized ID projects with tokens tied to their ecosystems.

Likewise, blockchain consulting companies could generate consulting fee revenue from growth in the decentralized ID ecosystem. Blue-chip technology companies such as Microsoft, Accenture, and IBM are pioneering their own decentralized ID solutions while development companies like Evernym and Consensys are helping companies build out their own decentralized ID infrastructure.

Finally, the blockchains on which DIDs are registered, and specifically blockchains optimized for DIDs, could benefit from growth of the broader ecosystem. Decentralized ID solutions rely on blockchains or distributed ledgers to facilitate DID issuance and verification. All else equal, DID issuance necessitates blockchain transactions which, at scale, could drive demand for native blockchain tokens to cover transaction fees.

Conclusion

Taking identity solutions fully digital is a wide-ranging task being explored by governments, private sector companies, blockchain communities, and standards bodies alike. Issues with current ID frameworks range from concerns surrounding centralized database repositories to misuse of personal customer information to outright inabilities for individuals to obtain identities.

Estimates for the economic value that could be unlocked by fully digital ID systems are as high as 3 to 13 percent of GDP by 2030. And given that different types of IDs exist across fragmented regulatory and legal jurisdictions, a winner takes all outcome is unlikely. Decentralized ID solutions are introducing a new framework for how personal information is stored and shared. But they are not a panacea. They typically shift the onus of securing information from corporations onto the individuals themselves. And anyone who has had their own bitcoin wallet knows that managing and recovering private keys is not something to be taken lightly.

The success of these solutions will ultimately depend on their ability to generate strong network effects which will take time. Standards need to be fully established and adopted by a wide range of industry participants. Issuers need to be comfortable adopting new frameworks for how they manage and issue credentials. Users need to adopt the technology and, in many instances, be comfortable with personally securing their credentials. Businesses and verifiers need to adopt verification technologies to facilitate acceptance of these credentials.

This all amounts to a tall task. But then again, the explicit costs associated with current centralized solutions are massive and the opportunity costs associated with them are not getting any smaller.

© 2021 The Block Crypto, Inc. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Andrew Cahill

An Introduction to Decentralized Identity Solutions

Mar 25, 2021, 2:08PM UTC