Kantara - Digital Identity in 2018

KANTARA INITIATIVE
N O R D I C I A M C O N F E R E N C E 2 0 1 8

Digital Identity 2018 –
A Wedding Rhyme?
#IAMwithUBI, Helsinki, May 24th 2018
Colin Wallis
Executive Director, Kantara Initiative
Ethics & Conformance Trust Marked

Attribution: PA https://ichef.bbci.co.uk/news/976/cpsprodpb/EBFE/production/_101641406_hi046913336.jpg

‘Something old, something new,
something borrowed, something blue’

© Copyright 2018 Kantara Initiative, Inc.
Kantara Initiative – A Snapshot
 US non-profit, founded 2009. Estonia non-profit,
founded 2017 (licensee)
 Strong ethics & societal purpose. Low barriers to
participation. Passionate about giving control of
identity and personal data back back to individual
owners
 Mission: the global consortium improving trustworthy
use of identity and personal data through innovation,
standardization and good practice
 Business model: Membership, Trust Framework
Operator, Specification development, Publishing
platform
 Comprises global thought-leaders; Organizations &
Individuals & Government agencies
© Copyright 2017 Kantara Initiative, Inc
Our Liaisons (examples)
Our Leadership

…and our 40+ individual contributor members
Kantara’s Global
Membership
& x10 Non-Member Participants

Our Core Work
 Nurture emerging technical communities
through our discussion & working groups
and our incubators - Digital Identity
Professionals, Identity and Privacy R&D.
 Develop and standardize community
practices with specifications companies can
understand, trust and implement.
 Operate conformity assessment programs
to enable companies to meet their
adherence goals to standardized practices
needed to support their business.

Award-Winning, Trend-Setting, Compliance-
Assisting Innovations
 UMA, the world's first open specification for
delegated authorization, extending OAuth
2.0.
 Consent Receipt specification – a user’s
receipt for personal data containing the
conditions upon which the consent is given –
giving control of personal data back to
individuals.
 The world’s first Trust Framework to offer
3rd party assessment, approval & grant of
trust mark for NIST SP 800-63-3.

‘Thought Leader’ Organisations & Individuals
Join Kantara
 Strong Ethics
 Low barrier to participate and contribute
 Collaborate with peers transparently and equitably
 Develop and publish artefacts on the platform
 Seek conformance, approval and grant of trust mark for
solutions
 Contribute comments to ISO and other global policy and
standards bodies side-stepping national policy and
standards bodies

Programmatic Advertising is Data driven advertising – an unrestricted trade in PI via Cookie Matching
Who was surprised?

Old models using old concepts
Attribution: Behance, April 6, 2011

Business practices that pollute
the Internet...

‘If industry can’t self regulate, Government will do it for them’
ConsentPerformance
of Contract
Legitimate
Interest
Who was surprised?

..even though there are old (but generally good)
mechanisms for industry to self regulate

Conformity
Assessment
System
Standards
Assessment
Scheme
Rules
Qualified
Assessors
Mark of
Conformity
Conformity
Attestation &
Certification
Conformity
Assessment
Systems are
Available ISO/IEC 17000

Principles Upon Which to Develop
Open Standards are Available
 Cooperation
 Adherence to Principles
 Collective Empowerment
 Availability
 Voluntary Adoption

What Makes Data Privacy Regulations
Different This Time Around?
 Virality
 Digital transformation
 Aspirations
data
control
data
transparency
data protection
Attribution: Eve Maler @xmlgrrl

‘something new’

CustomerTech is New…Kind Of..

To Which GDPR Articles are Most Relevant?
 Article 5: Principles relating to personal data processing
 Article 7: Conditions for consent
 Article 8: Conditions applicable to child’s consent in relation to information
society services
 Articles 12-23: Rights of the data subject
 Article 25: Data protection by design and by default
 Right of access, to restrict processing, to withdraw consent at any time
 User-controlled delegation of access
 Centralizable management of consents
 Transparency of and control over consented access
 Consented sharing directly from sources for greater data accuracy
 Parent/guardian-to-child constrained delegation

 A subgroup of the UMA Work Group, with globally acclaimed expert legal help,
has produced a draft framework defining:
 The business tools we (and others) can build from this framework can be single-
and cross-jurisdictional, and single- and cross-sector
 Our contention:
How the UMA protocol enables a license-based model for controlling access
rights to personal digital assets
UMA can provide the autonomy, reciprocity, and objectivity to grow market
trust in widely sharing access to personal digital assets with devices, apps, and
Internet databases.
‘The BLT Sandwich’
Putting together a business, legal, and technical framework for UMA usage & deployment
Attribution Eve Maler @xmlgrrl tinyurl.com/umalegal © Copyright 2017 Kantara Initiative, Inc

Something Else New…
Introducing the Localised Self Propagating Identifier

“The growth of artificial intelligence
(AI) creates a risk that machine-to-
machine decisions could be made
with no transparency to humans.
To avoid this, and to ensure AI is
developed ethically, individuals
need to be able to influence and
determine the values, rules and
inputs that guide the development
of personalized algorithms directly
related to their identity.”

…yet old problems
persist inside new
ideas…

Blockchain Identity –
it has to be something new, right?

Kantara - Digital Identity in 2018

You will not have just one DID – you will have thousands
Each one will give you a lifetime encrypted private channel with
another person, organisation, or thing
You will use it not just to prove your identity, but to exchange
verifiable digital credentials
Best of all: there is no central registration authority – every DID is
registered directly on a blockchain or distributed network
SSIMeetup.org

Looking Closely at the Terms…
Self Sovereign Identity – User centric identity or self issued identity
Verifiable claims – Attributes exchange, attribute management
Decentralised IDentifier – A pseudonymous key pair
Zero Knowledge Proof – Data minimisation
Distributed Ledger/Blockchain – Registr(ies) of DNS URI
(attribution: .Nat Zone https://nat.sakimura.org/)
Claims Provider – Identity Provider
(attribution: .Nat Zone https://nat.sakimura.org/)

Is Blockchain identity ‘new’?
or something ‘borrowed and extended’?
or something ‘re-mixed and re-mastered’?
(thanks to greater computing power, faster internet and some
new technology that can solve an established problem)

User Controlled GDPR Consent Cookie
(The IAB’s daisy-chained cookie ‘re-purposed for ‘good’)
 http://advertisingconsent.eu/ the IAB’s transparency & consent
framework.
 The Framework standardises the capture of user consent (CW: first parties)
for data processing and “signals” this information across the advertising
supply chain (CW: third parties) to process user data on one of the legal bases
laid down by the Regulation”. It uses the user’s browser cookie..
 What if….in the context of GDPR consent, this cookie approach could
be ‘re-purposed’ to become part of the consent process ‘for good’,
including agreement on the user terms along with the vendor terms

Kantara’s Consent Receipt Specification
Built into the user journey and machine readable
Signed JWT

Summary Conclusions
and Closing Thoughts

#1: The digital identity landscape
can change within a few months

#2: Finland is one of the lead nations
 FICORA – lead agency
 TrustNet Project
Trust Network for Distributed Personal Data
Management. MyData +Sovrin
 Finland Trust Network
 Federated Identity
 European Trust Mark
.. a microcosm of a global phenomenon – privacy, security, user control,
& the challenge of sharing with privacy

This image was originally posted to Flickr by katrinket at https://www.flickr.com/photos/53759368@N00/362776208. It was reviewed on 29 May
2010 by FlickreviewR and was confirmed to be licensed under the terms of the cc-by-sa-2.0.
?

Icons made by https://www.flaticon.com/authors/maxim-basinski. Flaticon">www.flaticon.com</a> is licensed by http://creativecommons.org/licenses/by/3.0/ CC 3.0 BY

Nurture. Develop. Operate.
– That’s What We Do
colin@kantarainitiative.org
Twitter:
@KantaraColin
@KantaraNews
Join us at https://kantarainitiative.org/membership/
Ethics & Conformance Trust Marked

T HE PA N E L ISTS
Janne Jutila
Internos Partners
I A M w i t h U B I 2 0 1 8
Colin Wallis
Kantara Intiative
Markku Mehtälä
Inside Secure
Sue Dawes
OIX UK Europe

Kantara - Digital Identity in 2018

More Related Content

What's hot (20)

Similar to Kantara - Digital Identity in 2018 (20)

More from Ubisecure (17)

Recently uploaded (20)

Kantara - Digital Identity in 2018