The Pan-Canadian Trust Framework (PCTF) for SSI
0 likes1,440 views
The Pan-Canadian Trust Framework (PCTF) is a technology-agnostic model aimed at enabling self-sovereign identity (SSI) adoption within the Canadian public sector, emphasizing trust and recognition of digital identities and relationships. It outlines key components, assessment protocols, and alignment processes with existing identity management policies, while facilitating innovation and interoperability across various technologies. The framework is a collaborative and iterative development process that seeks to integrate existing structures and ensure public sector integrity in the digital ecosystem.
The Pan-Canadian Trust Framework (PCTF) for SSI
- 1. The Pan-Canadian Trust Framework (PCTF) for Self-Sovereign Identity (SSI) IdentityBook.info special twitter.com/IdentityBookHQ SSIMeetup.orghttps://creativecommons.org/licenses/by-sa/4.0/ Tim Bouma Senior Advisor, Digital Identity Government of Canada Dave Roberts Senior Consultant, Digital Identity Government of Canada
- 2. 1. Empower global SSI communities 2. Open to everyone interested in SSI 3. All content is shared with CC BY SA SSIMeetup.org Alex Preukschat @SSIMeetup @AlexPreukschat Coordinating Node SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/ SSIMeetup objectives 08 June 2020
- 3. https://www.manning.com/books/self-sovereign-identity and IdentiyBook.info Released under a Creative Commons license. (CC BY-SA 4.0). SSIMeetup.org
- 4. Canada: Enabling Self-Sovereign Identity Identity is at the core of most government business processes and is the starting point for trust and confidence in interactions between people and their government. SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 5. The Canadian Approach and Policy Framework ● Adoption of the self-sovereign identity model within the Canadian public sector is still being realized in 2020. ● It is too early to tell how it will change the technological infrastructure or the institutional infrastructure of Canadian public services. ● This has not been an overnight process but rather, a deliberate, phased, and incremental approach over the past decade. ● Government of Canada policy outcomes for identity management, developed long before the emergence of self-sovereign identity, are general enough to enable the adoption of SSI. SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 6. The Pan-Canadian Trust Framework The PCTF, in its most current version, supports the acceptance and mutual recognition of: ● Digital identities of persons and organizations; and ● Digital relationships between persons, between organizations, and between persons and organizations. The PCTF is technology-agnostic and is defined in a way that encourages innovation and participation in the digital ecosystem. It allows for the interoperability of different platforms, services, architectures, and technologies. It will facilitate the transition from legacy identity technologies to SSI within the public sector. SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 7. PCTF Public Sector Profile: Key Milestones and Next Steps 1. Pan-Canadian Trust Framework Consultation Draft Version 1.1 • PCTF Working Group Consultation Draft was finalized on June 2, 2020 • Posted on GitHub for broader consultation and review (June 2020 to ?) • Re-starting PCTF WG Weekly Series • Focus on Thematic Issues (e.g., Digital Relationships, Informed Consent, Unregistered Organizations) 2. PCTF Assessment Worksheet • Consolidation all Conformance Criteria for each atomic process (400+ in total) • Integration of Organization Conformance Criteria (may be a separate worksheet) • Continued refinement and validation of Conformance Criteria 3. PCTF Assessment and Mutual Recognition • Continued iteration of PTCF assessment processes into a a formalized program. • Exploring alignment with other frameworks (eIDAS, Digital Nations, etc.) SSIMeetup.orghttps://creativecommons.org/licenses/by-sa/4.0/
- 8. The PCTF Model ● A Normative Core component that encapsulates the key concepts of the PCTF; ● A Mutual Recognition component that outlines the current methodology that is used to assess and certify actors in the digital ecosystem; ● A Supporting Infrastructure component that describes the set of operational and technical policies, rules, and standards that serve as the primary enablers of a digital ecosystem; and ● A Digital Ecosystem Roles and Information Flows component that defines the roles and information flows within the digital ecosystem. SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 9. PCTF Identity Domains ● A Foundational Identity is an identity that has been established or changed as a result of a foundational event (e.g., birth, person legal name change, immigration, legal residency, naturalized citizenship, death, organization legal name registration, organization legal name change, or bankruptcy). o The Vital Statistics Organizations (VSOs) of the Provinces and Territories; o The Business Registries of the Provinces and Territories; o Immigration, Refugees, and Citizenship Canada (IRCC); and o The Federal Corporate Registry of Corporations Canada. ● A Contextual Identity is an identity that is used for a specific purpose within a specific identity context (e.g., banking, business permits, health services, drivers licensing, or social media). Depending on the identity context, a contextual identity may be tied to a foundational identity (e.g., a drivers licence) or may not be tied to a foundational identity (e.g., a social media profile). SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 10. PCTF Digital Representations Currently, the PCTF recognizes two types of digital representations: ● Digital Identity: An electronic representation of an entity, used exclusively by that same entity, to access valued services and to carry out transactions with trust and confidence. ● Digital Relationship: An electronic representation of the relationship of one entity to another entity. As the PCTF evolves these digital representations will be extended to include other types of entities such as digital assets and smart contracts. It is also anticipated that in the future the PCTF will be used to facilitate the mutual recognition of digital representations between countries. SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 11. PCTF Atomic Process Model ● Atomic processes are crucial building blocks to ensuring the overall integrity of the digital identity supply chain and therefore, the integrity of digital services. ● Atomic processes have been defined in a way that they can be implemented as modular services and be separately assessed for certification. ● Once an atomic process has been certified, it can be relied on or “trusted” and integrated into other digital ecosystem platforms. ● This digital ecosystem is intended to interoperate seamlessly across different organizations, sectors, and jurisdictions, and to be interoperable with other trust frameworks. SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 12. Examples of PCTF Atomic Processes PCTF Assessment Worksheet SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 13. PCTF Dependencies The PCTF model recognizes two types of dependencies: ● The first type is those dependencies that exist between atomic processes. Although each atomic process is functionally discrete, to produce an acceptable output an atomic process may require the successful prior execution of another atomic process. ○ For example, although Identity Establishment of a person or organization can be performed independently at any time, it is logically correct to do so only after Identity Resolution for that person or organization has been achieved. ● The second type is dependencies on external organizations for the provision of atomic process outputs ○ Examples include: a commercial service provider or a credential authentication service. SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 15. Conveyance of Process Output States SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 16. Digital Ecosystem and Information Flows ● The model makes no assumption on any asymmetric power relationship between parties. ● Anyone can be subjects, issuers, holders, and verifiers, using many different methods. ● The digital ecosystem roles can be carried out by many different entities who perform specific roles under a variety of labels. SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 17. Methods ● Methods encompass the sets of rules that govern such things as data models, communications protocols, cryptographic algorithms, databases, distributed ledgers, verifiable data registries, and similar schemes; and combinations of these. ● Methods also include systems that are isolated or have intermittent connectivity. Within the context of the digital ecosystem, Methods enable actors to interact directly or indirectly with one another without either party being bound to a particular solution or technology. SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 18. Mapping to Existing Roles Role Examples Issuer Authoritative Party, Identity Assurance Provider, Identity Proofing Service Provider, Identity Provider, Credential Assurance Provider, Credential Provider, Authenticator Provider, Credential Service Provider, Digital Identity Provider, Delegated Service Provider Subject Person, Organization, Device Holder Digital Identity Owner, Card Holder Verifier Relying Party, Authentication Service Provider, Digital Identity Consumer, Delegated Service Provider Methods Infrastructure Provider, Network Operator SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 19. Mapping to Emerging Technology Stacks Trust over IP Stack PCTF Model Layer 4: Governance Frameworks Normative Core Mutual Recognition Layer 3: Credential Exchange Digital Ecosystem Roles Layer 2: DIDComm Supporting Infrastructure Layer 1: DID Registries SSIMeetup.org https://creativecommons.org/licenses/by-sa/4.0/
- 20. Federal Digital ID Directives ● TB Directive on Identity Management Standards ● Standard on Identity and Credential Assurance Policies ● TB Policy on Government Security Legislation ● Financial Administration Act Public Sector Profile Pan-Canadian Trust Framework Guidelines and Technical Standards ● Guideline of Identity Assurance, Authentication Requirements ● CATS, ITSP.030.31 Conformance Criteria Assessment and Approval Prov/Terr Digital ID Directives Standards Policies Guidelines and Technical Standards Conformance Criteria Legislation For discussion purposes only National / International Standards (national in scope with potential for international) Legislation , Agreements, Treaties, etc. (e.g. ISO, OECD, WEF, World Bank, etc.) National / International Digital ID Assessment and Approval Focus: Program Integrity ● Public Interest: specialized to needs of Public Sector to ensure trust and confidence. ● Has been tested and revised based on AB and BC assessments ● Version 1.1 now available Focus: Products & Services ● Private Sector-driven: goal is to encourage standardized commercial products and services. ● Remains to be tested ● Version 1.0 pending. DIACC Pan-Canadian Trust Framework Other Trust Frameworks EIDAS (EU) TDIF (Australia) Kantara ● There are multiple international and industry specific trust frameworks ● Participating in Digital Nations Thematic Group on Digital Identity Alignment Assessment
- 21. PCTF Public Sector Profile Assessments: Conducted to Date Province of Alberta • April-August 2018 Initial Assessment • September 2018: Letter of Acceptance Issued • August 2019: Go-Live on My Service Canada Account Province of British Columbia • August-December 2019 Initial Assessment • Q1 2020: Letter of Acceptance Issued (Jan 2020) • Q1 2020: Go-Live on My CRA Login (Feb 2020) My Service Canada Account (Est.) Rest of Canada • 2020-202X (Est.) SSIMeetup.orghttps://creativecommons.org/licenses/by-sa/4.0/
- 22. Public Sector Profile of the PCTF: Lessons Learned So Far 1. Requires collaborative team effort with experts on the ground. • Kick-off involved in-person visit to i) gain direct knowledge of program and ii) establish close working relationship between team members. • Regular calls (and videoconferencing) between teams. • Gathered and compiled evidence using conformance criteria templates submitted for assessment. • Assessment is a discrete work stream, however tightly coupled to other work streams (technical integration, MOU, agreements etc.) • Engage legal counsel early in the process, as there will be implications for agreements and authorities. 2. Assessment process is iterative and continuously improving. • Applying best practices from other frameworks (e.g., security assessment and authorization) • Development of master spreadsheet to assess evidence against conformance criteria with traceability to policy requirements. • Evidence collected in separate documents and filed for subsequent analysis, review and audit. Final review results in a Letter of Acceptance. 3. Next Steps: PCTF is evolving for fit and purpose (we are defining the ‘state of the art’) • Continue to clarify distinction of responsibilities between departments and jurisdictions. Identifying dependencies with processes in existing programs (e.g. vital statistics, motor vehicle licensing) and other jurisdictions (e.g., federal immigration). • Maintain focus of PCTF as a business process integrity framework that complements (not replaces) existing technical interoperability standards and frameworks (e.g., SAML, Open ID Connect, Verifiable Credentials). PCTF also complements existing assessment processes or agreements (e.g., Privacy Impact Assessment, Security Assessment and Authorization, SOC2 Trust Principles). • Ensure PCTF is alignment with global frameworks, World Bank, European Union, Financial Action Task Force (customer due diligence) SSIMeetup.orghttps://creativecommons.org/licenses/by-sa/4.0/
- 23. More Info: Public Sector Profile of the PCTF is available on GitHub: https://canada-ca.github.io/PCTF-CCP/ Open Government Licence - Canada: https://open.canada.ca/en/open-government-licence-canada Twitter (Tim Bouma): @trbouma SSIMeetup.orghttps://creativecommons.org/licenses/by-sa/4.0/
- 24. https://www.manning.com/books/self-sovereign-identity and IdentityBook.info Released under a Creative Commons license. (CC BY-SA 4.0). SSIMeetup.org