BLOCKCHAIN: HELPING SECURE OUR DIGITAL IDENTITIES

David Pollington, Senior Director Technology, GSMA

Blockchain, the backbone technology behind Bitcoin, has grown rapidly since its creation in 2008. Since 2013, Google searches of “blockchain” have risen by 1900% with 90 per cent of banks now exploring blockchain technology according to Accenture. Blockchain technology is being used in an increasing number of industries beyond financial services, including telecommunications, media and the public sector which is no surprise when many argue that technology may provide better security, transparency and efficiency. In fact, it’s not only businesses that are set to benefit from this technology, but millions of people too, thanks to the unique set of attributes that make it a useful tool to help secure our digital identities.

The digital world has played a huge part in disrupting the process of identifying an individual. Historically, this process has been fairly straightforward. For example, a government institution could verify the name and address of a citizen by conducting identity checks with banks or telecommunication providers. As these organisations are regulated to ‘know their customers’, they are able to corroborate the information held by the government institution and therefore verify the identity. Digital identities need to function in a similar way to this – but it’s much harder.

In a digital world without tangible, in person interactions, establishing trust and ownership may be difficult. This is where the blockchain comes into play. Blockchain technology allows individuals, independent of each other, to rely on the same shared, secure and auditable source of information for managing identity. When using this technology in conjunction with a mobile authentication service like the GSMA’s Mobile Connect, blockchain could be the key to securing our digital identities.

Blockchain basics

When a user’s information is added to the blockchain, it is inserted as a single block containing the user’s identity attributes and the user’s public key, all signed with the user’s private key. At this stage, the level of confidence in the user’s identity is at base level. Other entities, such as a bank or electricity provider also represented within the Blockchain can establish relationships with the user by signing the particular attributes of the user that are relevant to that relationship. So for example, the Passport Office could sign the address, name, and photograph of the subject if the attribute values match those on record at the Passport Office.

As the blockchain is used more and more, relationships are established for each person and confidence in the accuracy of the attributes (and the identity) grows. As more transactions take place involving that individual, the ‘reputation capital’ of the identity also grows. In other words, confidence in the identity’s accuracy increases as does confidence in the trustworthiness of the person behind it. And if any of the relationships change, this will be recorded in a separate block with a cryptographically signed timestamp that is visible to the entire blockchain.

The combined power of blockchain and mobile authentication

One critical aspect of any modern, digital service is finding the right balance between convenience and security. Security in the blockchain is upheld with public and private keys. The public key is used to identify the specific user involved, almost equivalent to a user ID. Whereas the private key is the credential that the user needs to keep protected, the private key equivalent to a password or biometric.

However, it is not that simple. A public key is not a convenient “user ID” and the private key is not something that can be easily remembered (like a password) or even be unique to that person (such as a biometric). It is a real challenge to securely store the private key to ensure that it can’t be used by others while being able to easily use it to verify the associated identity.

One solution is to introduce the concept of a wallet through which each person can confirm their attributes and manage their public and private keys. This wallet could be identified through a more convenient user ID, such as the user’s mobile phone number and be unlocked using conventional multi-factor authentication. The individual can then verify their identity by proving that they own their private key.

Mobile authentication services like the GSMA’s Mobile Connect are an ideal framework for supporting such wallets. To put it simply, mobile authentication ensures the person attempting to access an account is who they say they are. Then by adding two factor authentication, the user is asked to verify their identity via their mobile phone via a pop-up challenge to enter their PIN or biometric password. This process happens whenever the user logs into their accounts, providing a very simple, convenient, and secure way of authenticating themselves and asserting their identity. The combination of Mobile Connect for administering the wallets and blockchain for administering the identity is a perfect solution to providing digital identity and in a way that is ‘conveniently secure’.

David Pollington, Senior Director Technology, GSMA

Blockchain, the backbone technology behind Bitcoin, has grown rapidly since its creation in 2008. Since 2013, Google searches of “blockchain” have risen by 1900% with 90 per cent of banks now exploring blockchain technology according to Accenture. Blockchain technology is being used in an increasing number of industries beyond financial services, including telecommunications, media and the public sector which is no surprise when many argue that technology may provide better security, transparency and efficiency. In fact, it’s not only businesses that are set to benefit from this technology, but millions of people too, thanks to the unique set of attributes that make it a useful tool to help secure our digital identities.

The digital world has played a huge part in disrupting the process of identifying an individual. Historically, this process has been fairly straightforward. For example, a government institution could verify the name and address of a citizen by conducting identity checks with banks or telecommunication providers. As these organisations are regulated to ‘know their customers’, they are able to corroborate the information held by the government institution and therefore verify the identity. Digital identities need to function in a similar way to this – but it’s much harder.

In a digital world without tangible, in person interactions, establishing trust and ownership may be difficult. This is where the blockchain comes into play. Blockchain technology allows individuals, independent of each other, to rely on the same shared, secure and auditable source of information for managing identity. When using this technology in conjunction with a mobile authentication service like the GSMA’s Mobile Connect, blockchain could be the key to securing our digital identities.

Blockchain basics

When a user’s information is added to the blockchain, it is inserted as a single block containing the user’s identity attributes and the user’s public key, all signed with the user’s private key. At this stage, the level of confidence in the user’s identity is at base level. Other entities, such as a bank or electricity provider also represented within the Blockchain can establish relationships with the user by signing the particular attributes of the user that are relevant to that relationship. So for example, the Passport Office could sign the address, name, and photograph of the subject if the attribute values match those on record at the Passport Office.

As the blockchain is used more and more, relationships are established for each person and confidence in the accuracy of the attributes (and the identity) grows. As more transactions take place involving that individual, the ‘reputation capital’ of the identity also grows. In other words, confidence in the identity’s accuracy increases as does confidence in the trustworthiness of the person behind it. And if any of the relationships change, this will be recorded in a separate block with a cryptographically signed timestamp that is visible to the entire blockchain.

The combined power of blockchain and mobile authentication

One critical aspect of any modern, digital service is finding the right balance between convenience and security. Security in the blockchain is upheld with public and private keys. The public key is used to identify the specific user involved, almost equivalent to a user ID. Whereas the private key is the credential that the user needs to keep protected, the private key equivalent to a password or biometric.

However, it is not that simple. A public key is not a convenient “user ID” and the private key is not something that can be easily remembered (like a password) or even be unique to that person (such as a biometric). It is a real challenge to securely store the private key to ensure that it can’t be used by others while being able to easily use it to verify the associated identity.

One solution is to introduce the concept of a wallet through which each person can confirm their attributes and manage their public and private keys. This wallet could be identified through a more convenient user ID, such as the user’s mobile phone number and be unlocked using conventional multi-factor authentication. The individual can then verify their identity by proving that they own their private key.

Mobile authentication services like the GSMA’s Mobile Connect are an ideal framework for supporting such wallets. To put it simply, mobile authentication ensures the person attempting to access an account is who they say they are. Then by adding two factor authentication, the user is asked to verify their identity via their mobile phone via a pop-up challenge to enter their PIN or biometric password. This process happens whenever the user logs into their accounts, providing a very simple, convenient, and secure way of authenticating themselves and asserting their identity. The combination of Mobile Connect for administering the wallets and blockchain for administering the identity is a perfect solution to providing digital identity and in a way that is ‘conveniently secure’.