Self-sovereign identity: Cornerstone of the blockchain internet

Identity on the internet is fragmented, centralised and commodified. But in the near future it will be possible to anchor our data within blockchain databases in ways that will give users control of their identities. This means having a secure and transferable identity comprising proven attestations plus reputation scores – a useful thing to have on your mobile device.

uPort, a blockchain identity system being built by the NYC-based Ethereum venture production studio ConsenSys, is building such a system. uPort is more than an award-winning decentralised application; it is a tool to empower people all over the world.

Rouven Heck, uPort's project lead, is a computer scientist who worked for Deutsche Bank as its blockchain technical representative to R3. Describing uPort, Heck said: "We call it a 'credential wallet' or self-sovereign identity tool. It's the first time in history that we can make it user-friendly, that a user can control his identity himself."

When you download the software, it generates keys on your phone and also certain smart contracts (operations hosted and run on the Ethereum public blockchain) which represent your ID.

"These smart contracts allow us to do two really important things," said Heck. "The first is we have a persistent identifier, so this is your digital representation, your digital identity. The other thing is it allows you to replace your phone or your device. In the past, if you stored your private keys only locally on the phone and then you lost your phone, you lost the keys to prove your identity. Alternatively, when you save them on a server/the cloud, it's in the control of someone else like Facebook, LinkedIn or whatever."

Technologies like Ethereum are about giving individuals control over what they do. It also provides the application logic on the blockchain to perform quite advanced tasks. The uPort identity platform allows users to authenticate themselves in various contexts, whether they are on or offline, while providing ways for individuals to collect all sorts of attestations or verifications.

Heck explained: "Say my bank has confirmed that I have more than $10K in my account and my income is above $100K a year, then I can go to a landlord and disclose to him that I have a signature connected to my identity confirmed from my bank that I have this certain amount. This is a digital proof now.

"This allows you to do much more frictionless interaction in the digital ecosystem. For banks, we believe we can build something which we call 'implicit KYC'."

Heck used the example of his own nomadic work life, moving from Germany to Hong Kong to New York. That reputation need not be stuck to a credit score in a certain country. Making identity borderless in this way is a starting point, he said.

Beyond our enterprise arena, technologies like this have huge financial inclusion potential and can serve unbanked communities with fast growing access to cheap smartphones.

"We are looking at this as global solution, not focused on Western banking but really on financial inclusion across the world. People in unbanked regions can collect sufficient information because of good behaviour and local trade and whatever they do. They can disclose this information to digital banks, wherever they are located, and can get loans," said Heck.

Looking ahead

Looking ahead to an internet of things future, uPort can interface with applications like Slock.it, the Ethereum-based lock that can be opened with cryptographic tokens. This sort of identity system means you can rent out your apartment, for instance, without using Airbnb and handing over a key.

The way reputation is done on the internet is kind of dumb and ultimately gameable. We read someone had a good customer experience on eBay and we are persuaded. Heck takes a step back: "Reputation is a matter of perspective. There is no objective reputation, it's all in the interpretation of the receiver. This is very important, since it's various between countries and cultures.

"I collect a big set of data points proven from various institutions that have a strong reputation because of their brand; the KYC process at Deutsche Bank is solid, for example. I can establish this reputation with a new third party and it's up to me to decide how much of this I want to disclose. The more that is disclosed, the stronger the reputation will likely be."

Heck explained there is another project at ConsenSys which runs analytics on reputation information and creates a form of credit score. "We believe this is more like a prototype and different institutions will have their own algorithms to work out how they evaluate certain things. It will depend on which culture you are in, and which country. In some countries a post office statement is valuable; maybe in another country the tribe leader's blessing is more important than a piece of paper."