Tag

Self Sovereign Identity

Oct 24
0

WHAT CAN YOU DO WITH DIGITAL IDENTITY

By | Blog | No Comments

What can you do with digital identity is a fundamental, probably critical, question for the industry to answer. It probably should be top of pack for any company thinking of standing up a digital identity solution, as without it you will have created a boat without paddles or a sail. It may look good and be technically sound, but it won’t get you too far. Metaphor aside, if a digital identity solution does not solve an immediate problem and lacks a scalable business plan, then it will quickly lose momentum and become obsolete. This is, of course, true of any technology or business, but is acutely relevant to the digital identity industry.

This is one of the important findings from a report that I have authored, the second edition of the Goode Intelligence Digital Identity report which was recently published and covers the market for verified citizen and commercial digital identity.

In the four years since the first edition of the report was published in 2019, there has been a growing realisation that you cannot stand-up a digital identity scheme or solution without successfully answering these three questions:
1. Does it solve a real-word problem?
2. Will people use it?
3. How can I make money out of it?

The third question is critical to privately run identity systems/schemes.

A failure to answer these questions has effectively ended Self-Sovereign Identity (SSI). The theory that people would choose to download a wallet or generate their own digital identity and then use this identity with a variety of relying parties, including governments, has not been successful. There are of course other reasons, but fundamentally in building solutions without a direct link to benefit (both user and business) there is little appetite for them.

So, what can you do with digital identity and where are we seeing success and growth. With the emergence of digital identity wallets and verifiable credentials there are three new categories that are added to our list from 2019, Employee ID, Healthcare ID, and Digital Qualifications.

Our top eight use cases and applications for Digital Identity in the six-year period that the report covers, 2024-2029 are:
1. Identity Verification: Supporting remote customer onboarding.
2. Access to eGovernment services: Providing a single digital identity to access cross-department digital government services including eVoting
3. Assured Authentication: When the digital identity is highly assured and issued after strong identity and document verification then it can be used for assured authentication
4. Digital Travel: Including, Mobile driving licenses (mDL), Kerb(couch)-to-Gate for airport, rail, and boats.
5. Age Verification: Including Offline – used in bars and clubs instead of a paper document, and Online – used to ensure access to adult (age restricted) digital content and services is upheld.
6. Digital Signature:  Supporting smart contracts.
7. Employee ID: Digitising employee records and career history by exploring the capabilities of verifiable credentials.
8. Healthcare ID: Including healthcare professionals, including qualifications and experience, Patient ID, Healthpass (COVID19)

The second edition of The Digital Identity Report, published October 17 2023, is a comprehensive 272 page study that includes a review of current global adoption, market analysis including key drivers and barriers for adoption, interviews with leading stakeholders, technology analysis with review of key technologies and profiles of companies supplying solutions across key verticals plus forecasts (regional and global) for digital identity users, key technologies, and revenue within the six-year period 2024 to 2029.

More information can be found on the report page.

Sep 22
0

The Matter of (Digital) Trust

By | Digital Trust World 2022 | No Comments

Trust is defined by the Cambridge Dictionary as “the belief that you can trust someone or something”. Trust is at the heart of fruitful relationships – both personal and professional – for both the physical and digital worlds.

In the physical world, trust is created through security, effective process and reputation. In the digital world we need to match the levels of trust that thousands of years of human civilisation has created to maintain a safe and prosperous society.

As we move more of our daily lives into the digital realm, we need to ensure that the trust anchors we have developed for our physical lives are replicated, and in some cases improved for digital interactions. This can be a challenging task and as digital transformation is accelerating at an incredible rate across the globe, the question of how we establish digital trust is one of the fundamental ones of our generation.

How do we prove who we are?

How do we trust the authenticity of digital services?

Is this email or message really coming from my bank or government?

How do I know that my personal information will be protected when I provide it as part of a contract with a digital service provider?

These are but a few of the essential questions that are being asked of digital services.

Running an analyst and consulting company that specialises in the interconnected technology areas of identity verification, digital identity, authentication, biometrics, and digital fraud, I have been observing the developments in digital trust for well over a decade. There are plenty of positives that governments, business operators, privacy advocates and technology standards bodies have already achieved in establishing the building blocks of digital trust. But as we plan for next generation technology in the shape of open banking, decentralised identity and finance, and grapple with defining the Metaverse and Web3, there is plenty more that the industry must plan for.

We will get a chance to discuss the matter of (digital) trust at Goode Intelligence’s latest physical conference and exhibition – Digital Trust World 2022. Digital Trust World 2022 builds on the success of the inaugural 2021 event to provide a platform for the world’s leading authorities in Digital Trust to drive the conversations around how we can effectively develop trust in the digital world, alongside our thought leadership expertise in the digital trust economy.

Taking place on Monday 21st November 2022 in London, Digital Trust World 2022 develops a narrative built around the four essential components of digital trust:

  • Digital Onboarding (Identity Verification)
  • Digital Identity
  • Authentication & Privacy
  • Digital Fraud Management

Each of the four sessions are interconnected and take delegates on a typical user journey, be it a citizen or a consumer, from onboarding (identity verification/proofing), to identity issuance and management, to authentication & privacy measures, and then through to fraud management (digital fraud).

This ground-breaking event brings together leading technology providers with business decision makers, investors and technology integrators who have a strong interest in the latest innovations for a global conference with keynotes, presentations, industry-led moderated panels, round-tables and interviews.

I hope you can join us in London on 21 November 2022.

Register to attend.

Thank you

Alan

 

Jul 29
0

Alan’s View – 29 July 2021

By | Blog | No Comments

Alan Goode, CEO and Chief Analyst, shares his views on the latest developments for Digital Trust featuring latest updates on  Covid-19 health pass, quantum encryption and SSI, updates on RSA Outseer and Transmit Security, and latest round-up on investment and M&A for the industry.

 

 

Jul 12
4

Digital Trust World 2021 – The matter of trust in a digital world

By | Blog | No Comments

Digital Trust World 2021

The matter of trust in a digital world

From the company that brought you the annual Biometric, Identify and Identity Summits, join us in shaping the digital trust landscape of the future.

Trust is at the heart of fruitful relationships, both personal and business.  This is true for both the physical and digital worlds.

In the physical world we create trust through security, effective process, and reputation. These pillars guide us through our decision making when establishing trust and inform us when asking questions such as, Do I trust this person to honour an obligation? Can I trust a business with my money?  Do I trust that my healthcare provider will keep my records secured under lock and key, and that the key can only be accessed by authorised people?

Trust is also very much a two-way process – a mutual relationship based on reputation. Can an entity trust that I am a real person and not an imposter, that I will abide by the rules of the relationship, and that I do not have previous history of reneging on a contract, either on purpose or by misfortune?

In the physical world we issue documents and create records that prove who we are, when we were born, where we live, what we can do and what have we done.  These make us eligible to receive healthcare or social care, to permit us to travel internationally, to permit us to drive a vehicle (and what types of vehicles), to prove that we have been fined for speeding. The list goes on….

In the digital world we need to match the levels of trust that thousands of years of human civilisation has created to maintain a safe and prosperous society.

We are in the fourth industrial revolution and due to COVID-19 pandemic, digital transformation is accelerating at an incredible rate. How we recreate the trust of the physical world, and even improve on it, is one of the fundamental questions of our time.

Digital Trust World 2021, a major new event from Goode Intelligence, will provide a platform for the world’s leading authorities in Digital Trust to drive the conversations around how we can effectively develop trust in the digital world, alongside our thought leadership expertise in the digital trust economy.

Goode Intelligence has been active in covering the latest developments shaping Digital Trust since 2007 when it published its ground-breaking market analyst report on the mobile phone as an authentication device. Since then, Goode Intelligence has been instrumental in shaping the narrative around trust in the digital world predicting the

  • Importance of biometric technology for frictionless mobile authentication in 2010 – three years before the arrival of Apple Touch ID
  • Critical role of mobile in remote identity verification
  • Opportunity for decentralised identity, central to the passwordless authentication movement
  • Arrival of multi-purpose biometric technology for cars
  • Future of touch-free biometric payments to support new retail opportunities
  • Importance of quantum cryptography in withstanding the threat from quantum computing.

Topics and Themes

Digital Trust World 2021 covers the following topics and themes segmented into the following technologies:

  • Authentication
  • Biometrics
  • Digital Identity
  • Fraud and Security

The event will also cover aspects such as Privacy & Ethics, Skills and Professional Training, Legal Requirements, Attracting Investment and Powerful Communication for Business Success.

Authentication

  • Pick a date – when will we see the end of passwords?
  • We expected the passwordless revolution to be with us by now, so why I am still using passwords?
  • FIDO Alliance update
  • Biometric authentication – offering the right mixture of security and convenience
  • Continuous authentication – a privacy nightmare?
  • Why we need risk-based authentication more than ever – delivering frictionless authentication

Biometrics

  • The importance of liveness detection in combatting identity fraud
  • How biometrics is being leveraged for secure touchless physical access control
  • The role of voice biometrics in supporting frictionless user authentication
  • Biometrics is not just about identity and authentication – how biometric technology is being used to monitor our wellness and wellbeing

Digital Identity

  • All you need to know about the digital identity wallet wars
  • Who should issue digital identity – government, banks, tech companies or telcos?
  • Case studies
    • What we can learn from the Nordic BankID model
    • Latest developments with digital identity in Canada
  • Is SSI the right choice for your business?
  • Digital Identity in:
    • Government
    • Financial Services
    • Healthcare
    • Travel
  • Identity Verification
  • The security of digital identity – what makes a digital identity system secure?

Fraud & Security

  • New models for fraud management
  • The importance of behavioural analysis in fraud prevention
  • What you need to know about the risk to encryption from quantum computing and how to solve it
  • Encryption as a service – models and benefits
  • The risk of synthetic identity fraud
  • What account takeover (ATO) looks like and how to mitigate risk?
  • Regulatory roundup with updates on
    • GDPR and worldwide data protection regulation
    • PSD2 SCA
    • EU AI regulation

Privacy & Ethics

  • Bias in AI – why it is such an important issue
  • What privacy by design is and how you ensure it is baked into digital trust solutions?
  • Diversity and inclusion in digital identity
  • Important considerations when designing and deploying a biometric system
  • Live AFR – is it such a bad idea?

Join me in October as we shape trust for the digital world by registering for your place now.

Dec 17
1

My thoughts for the shape of 2021

By | Blog | No Comments

It has been a challenging year for us all and one cannot underestimate the impact of the pandemic on so many people around the world.  However, there is significant hope that 2021 will be a much better year for many of us.

2020 has been a year of the acceleration of digital transformation.

More people are working from home – At its highest figure during the Covid lockdown, 38 percent of the UK’s workforce was classified as exclusively working from home. [Source 1: UK ONS]

More people are banking remotely – More people are turning to digital banking, mobile and online, and many people are new entrants in using this technology. A study by McKinsey discovered a 20 percent rise in digital banking during the COVID-19 crisis – that’s two years’ growth in just a couple of months. [Source 2: McKinsey]

More payments are moving online – A study from McKinsey says that in the first six months of 2020, consumers spent US$347 billion online with US retailers, up 30 percent from the same period in 2019.

Once it is safe to do so, and the COVID-19 vaccinations have reached the majority of the world’s population, then we shall undoubtedly see the pendulum swing quite dramatically back to physical interaction. We are social beings and a pent-up demand for physical interaction means we will embrace physical shopping, face-to-face business meetings and events and international travel.  However, a new normal will emerge as normal life resumes and we again experience the inconvenience of long queues for parking at the shopping mall or travelling three hours for a 30 minute business meeting. The pendulum will again move towards the virtual world resulting in a balance of physical and virtual interactions with the distinction between the two narrowing. Much of the change in behaviour that has been a result of this pandemic will stick.

The improved digital infrastructure and a change in work culture will go hand-in-hand to support a much more virtual lifestyle. Businesses will support increased working from home and will benefit from improved productivity, reduced costs from smaller office space and improvements in employee mental health – getting that work-life balance is so important.

In the world of digital trust and security, in particular with authentication, biometrics, fraud and security, and identity, I believe that the following will happen in 2021.

Authentication: Despite the many predictions that 2020 will see the ‘death of the password’ it still dominates the authentication landscape.  The need for secure and frictionless authentication mechanisms that work across all channels and devices has never been so pressing but the fact remains that the password is still king. PSD2 Strong Customer Authentication (SCA) has increased the use of 2FA and MFA but banks and payment service providers are largely turning to SMS delivered OTPs despite many reservations from security experts and groups such as NIST. Standards such as FIDO and other passwordless initiatives provide organisations with alternatives to passwords that eliminate many of the security weaknesses, but adoption levels remain muted. There have been positive moves from some of the large tech networks including Microsoft and Google with their authentication apps but in many cases, it is still not mandatory for users to adopt them. I believe regulatory pressure will be the biggest driver to move away from passwords in 2021.

Biometrics: Expect another stellar year for biometric adoption across a wide range of verticals. I predict that behavioral biometrics will be more widely used in partnership with anti-fraud and authentication solutions especially in heavily regulated industries including financial services (EUs SCA and 3-D Secure 2.0 are driving forces in payments).

Will 2021 be the year that biometric payment cards finally arrive for consumers? Expect an uptick in pilots around the world and increasing commercial rollouts to enable secure, safe, frictionless and no-limit payments in physical locations. Surveys from 2020, including our own yet to be published UK survey, indicate that there is strong demand for these cards and a willingness to pay a nominal sum per month for the privilege of owning one. With the rise of contactless cards in many regions of the world, the addition of biometric authentication will make them the top of wallet choice for millions of consumers.

Biometric accuracy and the ability to withstand presentation attacks (liveness or genuine presence assurance) will continue to improve in 2021 making biometrics a reliable method to identify and authenticate people across a wide range of devices and channels.

Biometrics will be vital for a wide range of applications across many different verticals; to support a safe (often touchless) and seamless travel experience, as a pivotal component in remote digital onboarding, to secure the next generation of connected cars, to link the physical and digital worlds for government-issued digital identity and to both actively and passively authenticate people.

Fraud and Security: There is enormous pressure on fraud and security systems to withstand increasing levels of attack on core systems. Covid-19 has led to increasing levels of fraud attempts against digital services. The UK’s Action Fraud reported a 400 percent increase in COVID-19 related fraud during March 2020 with the majority of reports related to online incidents. As remote onboarding increases there will attacks on the tools that are being used to support this process, including using AI-powered attack tools to fool face biometric systems and the collection of personal information for use in synthetic identity attacks. Attacks on remote account opening has increased during the COVID-19 period and it has become one of the favoured attack points for criminals. In terms of a response from fraud teams, I predict increasing levels of cooperation between fraud and security teams to withstand the assault. This will include increasing adoption of layered tools that protect all levels of digital interaction with customers from discovery, onboarding, authentication and transaction processing.

Throughout 2021, more states will enact privacy and data protection legislation akin to the GDPR and California’s CCPA legislation.

Identity: A portable government-issued digital identity is proving to be a fundamental requirement in supporting digital transformation. It has the ability to provide an anchor for a wide range of linked digital identity credentials. This may be issued in a centralised or decentralised (self-sovereign) model – there are merits for both. Governments manage a rich depository of verified identity data across a number of different agencies. I predict that during 2021 governments will wake up to the opportunity that this data provides by enabling third parties to access this data in the same manner that government-issued documents are used in the physical world.

Age verification will be a popular application for next-generation digital identity solutions. I predict that blockchain technology is a realistic platform for age verification services as it can be supported by a zero-knowledge proof protocol that only supplies a cryptographic representation to the answer – am I legally permitted to access/purchase/consume age restricted products and services, including digital adult content and the consumption of alcohol? For instance, I am a student (this for me was some years back) and I am legally permitted to drink alcohol, but I am at an age where I need to verify my age when entering a venue that serves alcohol. Instead of using a physical government-issued document that proves that I am legally allowed to consume alcohol, along with long list of other personal attributes that are irrelevant to the consumption of alcohol, I (the prover) give permission to the venue management (the verifier) to access my digital identity app (wallet) to verify my age. The verifier doesn’t not need to know my date of birth, they only need to know the answer to the question – am I legally permitted to consume alcohol, to which the answer can only be ‘yes’ or ‘no’.

2020 saw Goode Intelligence work with a wide range of digital identity bodies and providers and we’ll be continuing this collaboration in 2021.

I would like to wish all of you a happy and safe holiday season and I look forward to connecting with you during 2021 – a hopefully less stressful year than 2020.

Alan

[1] https://www.ons.gov.uk/peoplepopulationandcommunity/healthandsocialcare/conditionsanddiseases/bulletins/coronavirustheukeconomyandsocietyfasterindicators/1october2020

[2]

https://www.mckinsey.com/industries/financial-services/our-insights/no-going-back-new-imperatives-for-european-banking

 

Oct 26
0

INTERVIEW: The DID Alliance’s Ramesh Kesanupalli talks to us about GADI, the exciting new initiative for Digital Identity…

By | Blog | No Comments

Last month we were delighted to host a webinar introduction to the Global Architecture for Digital Identity (GADI) in partnership with the DID Alliance*.  Ramesh Kesanupalli, co-founder of the DID Alliance, founder of the FIDO Alliance and CEO, Digital Trust shares his insight on this very exciting initiative and why we need a new method to add trust and accountability into Digital Identity.

After your success with the FIDO Alliance, what made you turn your attention to identity?

Ramesh Kesanupalli: “There were a couple of reasons: firstly, digital identity is one of the hot topics that is emerging in the industry – after adding up all the attacks that have happened to major entities, and considering the misinformation and untraceable information that is rampant on the internet – Identity is a problem that needs to be fixed.  After the successful standardisation of FIDO and its inclusion in all major operating systems and browsers, it’s only natural to look into identity binding as the next step.  At the same time, the CEO of RaonSecure, Soon Hyung Lee, who has been developing the OmniOne Identity DLT, asked me to take a look at what they were doing which got me started looking into this space.”

Tell us about the basic premise of GADI

Ramesh: “The basic premise of GADI is to define a trustable identity framework that will work at a global scale and bring different identity systems to establish trust and accountability. While security and privacy are the fundamental rights of everyone, for a functioning business or society, trust and accountability are basic necessities.”

What is a digital address and how is it used?

Ramesh: “A Digital Address is a human-readable access point, which is bound to a unique trust anchor for the user that is generated by a trusted issuer in the GADI ecosystem when the user is being on-boarded into the GADI ecosystem.  Once the initial trust anchor of the user is created, and a Digital Address is created for the user with a Digital Address Provider, the issuers can issue the user credentials using the verifiable credential formats, and publish the DIDs (Decentralised Identifiers) of those credentials to the Digital Address that the user is associated with.  The user can then go to any other issuer who would issue credentials to the user and provide their Digital Address so that the other issuer can start issuing their credentials to that user.  The user will then be able to provide verifiable credential presentations to a service provider to prove identity claims as needed based on the service provider’s context.”

Can GADI work with existing identity ecosystems?

Ramesh: “Yes.  Existing identity systems can turn themselves into a Digital Address Provider by embracing the GADI methods of on-boarding users and issuers.  The creation of the initial trust anchor is the key first step which involves identity verification of the user against a government-issued identity document by a high-trust entity.   This could be a Department of Motor Vehicles (DMV), Passport Agency, Employer, Financial Institution or Medical Centre.   Digital Address providers will have to go through a certification process and must follow the governance and policies of the GADI ecosystem.”

Finally, how can people find out more and get involved?

Ramesh: “We welcome organisations, both public and private to come and join the DID Alliance to contribute to the specification, governance, and direction of the ecosystem.  There are different work streams that need help, support and participation.  We have a Technical Working Group, Governance Working Group, Messaging Working Group, Certification Working Group and so on.

“People can get involved at the board membership level, sponsor membership level or associate membership level.  Please visit the DID Alliance web site didalliance.org for more information and to reach out to us.”

*The DID Alliance is an open industry association created to drive the development of a standardised, interoperable framework for decentralised identity services to ensure the authenticity of an established trust in digital identities.

 

Mar 17
0

Verified Digital Identity – Key Applications Driving Growth and Adoption

By | Blog | No Comments

Verified digital identity provides a method to effectively and securely identify people and enable them to perform both offline and online tasks in a safe and secure manner.  The following definition is the one I use for verified digital identity, and adopted most recently in our white paper “Verified Digital Identity – Key Applications Driving Growth and Adoption”: “A digital identity that is issued by an identity issuer or provider who has a high level of assurance of the authenticity of the individual requesting the identity credential. The issued credential can be used in high-assurance applications/use cases.”

Currently, we have a pretty messy situation with global variations in terms of adoption and a mixture of government and commercially led digital identity schemes that heavily rely on paper (documents) and card-based identity as the anchor point for identity verification.

There is little interoperability between these schemes and many of them have been designed to support a single application; travel, access to bank services or permission to drive a vehicle for instance.

There are signs that improvements are being made with a real willingness for stakeholders, both government and commercial, to fix the digital identity problem.

In a recent Goode Intelligence market analyst report, The Digital Identity Report – The Global Opportunities for Verified Citizen & Consumer Digital ID; Market & Technology Analysis, Adoption Strategies and Forecasts 2020-2025 Identity Verification, a number of key applications that are enabled by verified digital identity were identified including:

  1. Identity Verification
    1. Supporting remote customer onboarding
  2. Access to eGovernment services
    1. Providing a single digital identity to access cross-department digital government services including eVoting
  3. Assured Authentication
    1. When the digital identity is highly assured and issued after strong identity and document verification then it can be used for assured authentication
  4. Digital Travel
    1. Mobile driving licences (mDL)
    2. Kerb-to-Gate airport
  5. Age Verification
    1. Offline – used in bars and clubs instead of a paper document
    2. Online – used to ensure access to adult (age restricted) digital content and services is upheld
  6. Digital Signature
    1. Supporting smart contracts

If you are interested in learning more, I’ll be presenting the findings of our latest research into digital identity, including identity and document verification, at Identity Summit London 2020 on 30 January 2020. I hope I will see you there.

Alan