# An SSI-Based Solution to Support Lawful Interception
## 6 Proof of Concept
### Case Study  
We show the main functionalities offered by our solution through a case study. In particular, we refer to the EA integration in the LI procedure of Section 4.2, which is the more relevant contribution of this paper. Note that some functionalities (such as the revocation) are not included in this case study but are implemented in the version of the software available on GitHub. In our case study, we consider an employee [PERSON] of an external agency, called NA, who was charged by the LEA to access data relative to an LI procedure on the LEMF. Initially, the three organizations involved in the system register on the Trinsic Studio platform (see Figure 4). In this registration phase, some fields have to be provided (name, region, blockchain network, and so on). In particular, a relevant field is the issuer DID, which identifies an issuer and is used to verify the credentials it releases. Figure 5 shows an example of the fields associated with the NA agency. Figure 4: Registration of LEA, LEMF, and NA Agency. Figure 5: Fields of NA Agency registration. When [PERSON] is hired by NA, he receives an \"Employee credential\" certifying its status. This credential (with its fields) is stored on the [PERSON] mobile wallet (Android app) as shown in Figure 6a. To participate in the LI procedure, [PERSON] needs the \"X credential\" released by the agency NA. As discussed in Section 4.2, to obtain the \"X credential\", [PERSON] has to prove the ownership of the \"Employee credential\". The agency NA (through the web application) generates a \"Verification\" of the \"employee credential\". This is reported in Figure 6b. Observe that optional attributes may be requested to [PERSON]. Once this Verification is created, [PERSON] can set up a secure peer-to-peer connection with NA to provide the \"Employee credential\". This is done by scanning a QR code properly generated in the reserved area of [PERSON] as shown in Figure 7a. However, not all the fields of the credential are provided by [PERSON] but just a verifiable presentation of it. For example, in the case shown in Figure 7b, the Verifiable presentation includes four of five fields of the credential. At this point, NA interacts with the blockchain to verify the validity of the credential received by [PERSON]. This is performed in the background on the web application. The snippet of the Python code that implements this function is reported in Listing 1. Figure 6: Overview of the Employee Credential (**a**) and X Credential Verification (**b**). ```
[EMAIL_ADDRESS](\"/send_verification/<string:
2 connection_id>\",
3 methods=[\"GET\",\"POST\"])
4 defsend_verification(connection_id):
5 connection_id=connection_id
6 policies=
7 credentials_client. 8 list_verification_policies()
9 policy_id=policies[0].policy_id
10 verification=
11 credentials_client. 12 send_verification_from_policy
13(connection_id,policy_id)
14 returnredirect(url_for
15('verifications_connection',
16 connection_id=connection_id))
```  
PROOF DETALILS  
AgencyNA  
This organization is requesting the following information:  
Then, NA can release the \"X credential\" (see Figure (a)a) that will appear on the mobile wallet of [PERSON] (see Figure (b)b). Figure 7: Overview of QR Code (**a**) and Verifiable Presentation (**b**). After obtaining the \"X credential\", [PERSON] interacts with the LEA to get the \"Y credential\" for accessing the data on the LEMF. Similarly to the NA agency, the LEA generates a \"Verification\" for the \"Y credential\" through the dedicated web application (see Figure 9a). Observe that, among the fields required in this verification, there is the issuer DID of the entity releasing the \"X credential\" (i.e., the agency NA). At this point, the procedure appears for [PERSON] similar to the procedure performed with the NA agency. Indeed, [PERSON] connects with the web application of the LEA and scans a QR code to provide the LEA with the Verifiable presentation of \"X credential\". However, a difference exists with the previous case.