Modern Society Needs Better Identity Access Management
In our globally connected world, we have a single, connected society. This society has hit a wall where further development depends on secure trade and certainty of identity. But our current dependence on physical documents as the ultimate source of identity makes verification in the digital world difficult.
Fighting identity fraud and enabling secure transactions is a problem that every business and every government needs to solve. This is a trillion-dollar industry, with millions of partially successful solutions.
What the Technology of Blockchain is Capable Of
Bitcoin now has a market capitalization of $30 billion. This remarkable trust in a system with no single owner and no dedicated location to store data comes from its innovative design.
Bitcoin relies on the principles of a blockchain, which is a technique for storing information so that it can’t be hacked or corrupted. It is a file made up of blocks of data, where each new block of data contains a signature based on the preceding block. These blocks contain a large number of records about any type of information. This blockchain file is retained by each of the many blockchain users, who’ve also run code to verify the file’s integrity. It is like having thousands of auditors checking that nobody has fiddled the books. There is no original source file, instead this file is shared via a peer-to-peer network. So interfering with one single file does no harm and it would be automatically ignored because it is different from the majority.
Trust is established in the blockchain because each user has participated in verifying and sharing its data. This ingenious system provides some unique advantages over conventional data storage and sharing systems.
- Blockchain data keeps a historical record that cannot be edited or hacked.
- No single entity has to pay for, or be responsible for, secure data storage.
- Inbuilt security means that the blockchain can exist safely while always being accessible to the public.
- The distributed nature of a blockchain means there is never any downtime.
- A blockchain scales automatically as the number of users grow.
These qualities have enabled blockchains to be used for a wide variety of purposes where security is a priority, while granting access to a large number of stakeholders. It is particularly useful where records of transactions or the uniqueness of a digital, item must be provable.
The Value of Identity and How to Manage Trust
Identity fraud is a lucrative growth industry. Many organisations don’t want to risk losing a potential customer. And everyone knows that documents sometimes get lost and destroyed. So businesses always have a level of flexibility when it comes to proving identity. This flexibility enables identity fraud but disabling it is important because our society depends on identity trust.
Businesses depend on identity when assessing the qualifications of a candidate. Governments depend on identity for deciding who is safe to let into their country. Even online communities are dependent on identity for proving intellectual property rights.
Every decision made about identity is based on the documents provided. In an age where counterfeiting technology is readily available, checking the authenticity of documents is expensive and not rigorously done. Governments usually provide identity documents equipped with biometrics. The resulting identity document, loaded with anti-counterfeit technology, an electronic chip, and biometric data is very expensive to manufacture. Including biometric data increases an authority’s ability to match the document with the person carrying it. But because these documents are physical objects, and can be lost or stolen, they are often not on the person when required. They are also of little value when proving identity in the digital world.
As governments seek efficiencies to reduce costs, their processes are moved from physical documents into the digital world. Establishing a single repository for all electronic identities would significantly streamline these processes, but security concerns must be met.
Applying the Benefits of Blockchain Technology to Identity Management
Just like financial transactions can be recorded to a blockchain, the unique identity of an individual, including their biometric data, can be stored in the same way. Doing this brings with it the many benefits that blockchain technology has to offer.
Private access blockchains use the same technology as public blockchains, but only allow authorised users such as internal servers to mine for new blocks, or perform transactions. This is often the preference of large establishments which prioritise privacy over the added security that more users, and a greater number of blocks, provide.
Because private access blockchains do not benefit from a vast number of independent users verifying the calculations, adding extra blocks, and sharing identical files, they lack the robust security demanded by blockchain identity with biometrics. This and the lack of public participation, coupled with the threat of government manipulation, is likely to make proposals for private access blockchain identities unpopular.
Extending permission to mine for new blocks, to corporate service providers or other bodies within the establishment, is a possible compromise. This would significantly increase the number of users, and enable calculation costs to be covered by private industry profits. Reducing this entry cost for developing nations will enable broader and faster adoption.
Because an identity blockchain with biometrics would be publicly accessible, some people might be concerned that their identity and private information is both visible and able to be stolen. There is a type of encryption that provides a solution to this problem.
It is possible to create two mathematically related numbers, known as private keys and public keys. A private key can then be used to encrypt a file. This file is able to be decrypted by its public key. The public key can do the same trick, so that the file can only be decrypted by the private key.
Because all of the information stored in the blockchain would be encrypted, and personal information would have another layer of encryption applied to that used by the blockchain, the data is safe. By using a public and private key system, users retain control over their information while still being able to use it for authorisation.
Identity Blockchain with a Biometric Boost
Including biometric data into each record will significantly increase the usefulness of electronic identities. This is because biometric data can be considered a digital equivalent of a physical person. Unlike a normal document that can be printed and shown to anyone, a document containing biometric data can only be used by the person whose physical characteristics match that document.
Businesses are moving away from physical records because of their fragility, difficulty in sharing, lack of incorporation into automated systems, and storage costs. Physical records of identity pose all of the same problems. Even more importantly, our identity is verified online, and by our devices, many times a day. This is despite having no physical evidence to give it authority. It is now possible to solve the issues of turning our physical identification documents into an online identity with the added security of biometric data.
Advantages of a Biometric Identity Blockchain
By including biometric data in an identity blockchain, it would satisfy the needs of all existing identity verification systems, both physical and online. It would achieve this by exposing a source of proven data that cannot be hacked, falsified or tampered with. Data that can directly link the human characteristics to the stored information.
This means that instead of showing a passport or a driver’s licence, you could simply press your thumbs on a reader or have your iris scanned. With online services, you could prove your identity by encrypting a token with your private key. By decrypting that token with your public key, available on the identity blockchain, the online service can verify your identity.
Another advantage is that your online identity can never be lost by forgetting your password. This is because you can always verify your identity by physically presenting yourself at an identity service provider. Banks, police stations, and other organisations currently fulfil the role of identity service providers. It is reasonable to assume that this business model would continue when providing the service becomes more streamlined and cheaper.
By having a single source for identity and biometric data in the blockchain, all records related to an individual can be linked back to that identity. This does not need to be managed by the identity blockchain, but can be as simple as a reference to the identity’s location in the blockchain. Because of this, government, financial, and personal records could share a single unique element that binds them together. And this unique identity will never suffer from duplication or mistaken identity.
With biometrics on the blockchain, two-tier authentication is not required, because the metric that is used is unique, tamper proof, and cannot be stolen.
Concerns Raised by Establishing a Biometric Identity Blockchain
There is a good reason behind anonymous voting, and giving citizens the ability keep their lives private. It enables us to engage in politics and disagree with those in power without the threat of retribution.
This privacy is now being undermined by technology as smart algorithms collect and link our online activity, transaction records, and more, to target us with more direct advertising. To fight this, many people keep their various online identities separate.
By providing a single point for authenticating your identity, it will become harder for people to keep their online identities separate. Many believe this will impact their civil liberties and then the health of their democratic system. People living under governments that they don’t trust will feel less able to keep their disagreement with a government’s actions anonymous.
Where Are We Now, And Who’s Playing?
The United Nations recognizes having a legal identity as a fundamental human right. In 2016 at the ID2020 summit, the UN set the goal to “provide legal identity to all, including birth registration, by 2030”
At the summit the use of blockchain technology was discussed because it enables identity to be managed without any one organisation owning or controlling the data.
America’s Department of Homeland Security is investing in four separate blockchain projects for identity management and privacy protection. While Microsoft is working with a number of parties including Blockstack and ConsenSys to provide programming tools for an identity blockchain.
While these activities are all clearly driven by a need for better identity access management, and powered by the developments in crypto-currencies, one critical element is missing. Biometric data will enable linking this universal and publicly owned system to individual humans with measurable differences.
Where to From Here?
There are already a lot of interested players in the blockchain identity market. But we don’t need to be concerned that multiple systems will arise. In fact, using multiple blockchains, makes identity management even more robust. This is because blockchains can be cross linked, using shared encrypted elements.
While both governments and corporations will quickly agree on how secure an identity management system needs to be, different parties will want different data points stored within it. And while there is flexibility in the system, having a standardised data structure makes interfacing with software much simpler.
W3C is one of many recognised success stories where an organisation has responsibly managed the rules and structures of a system for the benefit of all citizens. By using a similar model of governance, an identity standards body could ensure the same level of dependability and success. Managing the standard outside of a government or corporate framework would give people the confidence required to participate in the system.
At some point in humanity’s future, there will be a biometric identity blockchain holding the identity of every individual. The only questions are when and how we will achieve this? The current surge of interest in this area makes it seem like it will be soon. And the better we understand its risks and opportunities, the better we’ll be able to guide it towards success.