![Identity-concept](https://upload.wikimedia.org/wikipedia/commons/3/38/Identity-concept.svg)
Self-sovereign identity (SSI) is an approach to
digital identity
A digital identity is information used by computer systems to represent an external agent – a person, organization, application, or device. Digital identities allow access to services provided with computers to be automated and make it possibl ...
that gives individuals control over the information they use to prove who they are to
websites
A website (also written as a web site) is a collection of web pages and related content that is identified by a common domain name and published on at least one web server. Examples of notable websites are Google, Facebook, Amazon, and Wiki ...
, services, and
applications
Application may refer to:
Mathematics and computing
* Application software, computer software designed to help the user to perform specific tasks
** Application layer, an abstraction layer that specifies protocols and interface methods used in a c ...
across the web. Without SSI, individuals with persistent accounts (identities) across the
internet
The Internet (or internet) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to communicate between networks and devices. It is a '' network of networks'' that consists of private, pub ...
must rely on a number of large identity providers, such as
Facebook
Facebook is an online social media and social networking service owned by American company Meta Platforms. Founded in 2004 by Mark Zuckerberg with fellow Harvard College students and roommates Eduardo Saverin, Andrew McCollum, Dustin Mosk ...
(Facebook Connect) and
Google
Google LLC () is an American Multinational corporation, multinational technology company focusing on Search Engine, search engine technology, online advertising, cloud computing, software, computer software, quantum computing, e-commerce, ar ...
(Google Sign-In), that have control of the information associated with their identity. If a user chooses not to use a large identity provider, then they have to create new accounts with each service provider, which fragments their web experiences. Self-sovereign identity offers a way to avoid these two undesirable alternatives. In a self-sovereign identity system, the user accesses services in a streamlined and secure manner, while maintaining control over the information associated with their identity.
Background
The
TCP/IP protocol provides identifiers for machines, but not for the people and organisations operating the machines. This makes the network-level identifiers on the internet hard to trust and rely on for information and communication for a number of reasons: 1) hackers can easily change a computer’s hardware or IP address, 2) services provide identifiers for the user, not the network. The absence of reliable identifiers is one of the primary sources of cybercrime, fraud, and threats to privacy on the internet.
With the advent of blockchain technology, a new model for decentralized identity emerged in 2015. The
FIDO Alliance
The FIDO ("Fast IDentity Online") Alliance is an open industry association launched in February 2013 whose stated mission is to develop and promote authentication standards that "help reduce the world’s over-reliance on passwords". FIDO addres ...
proposed an identity model that was no longer account-based, but identified people through direct, private, peer-to-peer connections secured by
public/private key cryptography. Self-Sovereign Identity (SSI) summarises all components of the decentralized identity model: digital wallets, digital credentials, and digital connections.
Technical aspects
SSI addresses the difficulty of establishing trust in an interaction. In order to be trusted, one party in an interaction will present credentials to the other parties, and those relying parties can verify that the credentials came from an issuer that they trust. In this way, the verifier's trust in the issuer is transferred to the credential holder. This basic structure of SSI with three participants is sometimes called "the trust triangle".
It is generally recognized that for an identity system to be self-sovereign, users control the
verifiable credentials
Verifiable credentials (VCs) are an open standard for digital credentials. They can represent information found in physical credentials, such as a passport or license, as well as new things that have no physical equivalent, such as ownership of a ...
that they hold and their consent is required to use those credentials. This reduces the unintended sharing of users'
personal data. This is contrasted with the centralized identity
paradigm where identity is provided by some outside entity.
In an SSI system, holders generate and control unique
identifiers
An identifier is a name that identifies (that is, labels the identity of) either a unique object or a unique ''class'' of objects, where the "object" or class may be an idea, physical countable object (or class thereof), or physical noncountable ...
called
decentralized identifier
Decentralized identifiers (DIDs) are a type of globally unique identifier that enables an entity to be identified in a manner that is verifiable, persistent (as long as the DID controller desires), and does not require the use of a centralized ...
s. Most SSI systems are
decentralized
Decentralization or decentralisation is the process by which the activities of an organization, particularly those regarding planning and decision making, are distributed or delegated away from a central, authoritative location or group.
Conce ...
, where the credentials are managed using
crypto wallets and verified using
public-key cryptography
Public-key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated with cryptographic alg ...
anchored on a
distributed ledger
A distributed ledger (also called a shared ledger or distributed ledger technology or DLT) is the consensus of replicated, shared, and synchronized digital data that is geographically spread (distributed) across many sites, countries, or institutio ...
.
The credentials may contain data from an issuer's database, a
social media account, a history of transactions on an e-commerce site, or
attestation from friends or colleagues.
National digital identity systems
European Union
The
European Union
The European Union (EU) is a supranational political and economic union of member states that are located primarily in Europe. The union has a total area of and an estimated total population of about 447million. The EU has often been de ...
is exploring decentralized digital identity through a number of initiatives including th
International Association for Trusted Blockchain Application (INATBA), th
EU Blockchain Observatory & Forumand th
European SSI Framework The EU recently created an
eIDAS
eIDAS (electronic IDentification, Authentication and trust Services) is an EU regulation on electronic identification and trust services for electronic transactions in the European Single Market. It was established in EU Regulation 910/2014 ...
compatible European Self-Sovereign Identity Framework (ESSIF). The ESSIF makes use of
decentralized identifiers
Decentralized identifiers (DIDs) are a type of globally unique identifier that enables an entity to be identified in a manner that is verifiable, persistent (as long as the DID controller desires), and does not require the use of a centralized ...
(DIDs) and the European Blockchain Services Infrastructure (EBSI).
Korea
The Korean government created a public/private consortia specifically for decentralized identity.
References
{{Reflist
See also
*
Decentralized identifier
Decentralized identifiers (DIDs) are a type of globally unique identifier that enables an entity to be identified in a manner that is verifiable, persistent (as long as the DID controller desires), and does not require the use of a centralized ...
*
Decentralized web
The decentralized web is research program which proposes to reorganize the Internet using peer-to-peer infrastructure rather than centralized data hosting services. Interest in the decentralized web arose due to the lack of trust in network maint ...
*
Digital self-determination
Digital self-determination is a multidisciplinary concept derived from the legal concept of self-determination and applied to the digital sphere, to address the unique challenges to individual and collective agency and autonomy arising with inc ...
Authentication methods
Computer access control
Digital technology
Federated identity
Identity management
Sovereignty