The trust infrastructure of self-sovereign identity ecosystems.
By: Ssi Ambassador
Tags: Ssi, Governance, Trust Framework, Self Sovereign Identity, Trust Infrastructre

The second layer describes the communication between agents. Within the ToIP stack, this communication is indented to be executed via a hybrid of an algorithmic and atomic architecture such as peer DIDs or KERI implementations of self-certifying identifiers as described by Ph.D. Samuel M. Smith. This means that publicly resolvable DIDs are used for public entities and private peer DIDs for individuals. The following illustration provided by Lissi provides an overview of these interactions.

SSI interactions and the usage of public and peer DIDs; Image source: Lissi

However, not all SSI implementations use peer DIDs. For instance, the ESSIF-MVP1 does not currently use peer DIDs but might add them later as deemed appropriate according to the technical specification of DID modelling. Hence, the same type of DID is used for both issuer and holder. The governing authority of layer two is highly dependent on the communication protocols used by the implementation in question. For implementations, which use peer DIDs according to the DIDcomm protocol the governing entity is the DIDcomm working group at the Decentralized Identity Foundation (DIF). Both layer one and layer two define technical or rather cryptographic trust, in contrast to layer three and four, which define human trust.

Layer three protocols support the exchange of data such as verified credentials with different types of signatures, which enable a holder to create verifiable presentations as explained in the ToIP Aries-RFC. It states that one of the goals of the ToIP Foundation is “to standardize all supported credential exchange protocols so that any ToIP-compatible agent, wallet, and secure data store can work with any other agent, wallet, and secure data store.” An issuer can issue any set of claims to any holder, which can then prove them to any verifier. The verifier can decide, which issuers and which claims it trusts.

Layer four of the stack defines the rules for a particular digital trust ecosystem such as healthcare, finance, food products, education etc. These are led by a governance authority, which already exists or is established for this particular purpose. It consists of a variety of different stakeholders such as business entities, government agencies, individuals or other interested parties. These ecosystem frameworks also define the semantics of verified credentials. The semantic of a verified credential defines, which attributes are part of it and their meaning in the particular context. If you want to join an existing ecosystem or want to know more about their work you can find the public ToIP confluence documentary hub here.

Trust frameworks

A trust framework sets the overall legal framework for digital interactions. These trust frameworks are technology agnostic and are uniquely adapted to the jurisdiction they serve. They set the rules for the recognition of electronic identification and authentication and specify the requirements to achieve a certain level of assurance (LoA).

The combination of the different governance frameworks as illustrated in the ToIP stack is sometimes also referred to as trust framework. However, jurisdictions have their own requirements for electronic authentication, which serve as the underlying trust framework. In the case of Europe, the eIDAS regulation clearly defines the requirements for authentication factors to achieve a certain level of assurance. For instance, to achieve the LoA substantial, two factors are necessary. According to the Guidance for the application of the LoA published by the CEF Digital, one out of the two factors needs to be either:

I) a presentation of an identity document or

II) verification of the possession of evidence representing the claimed identity recognized by a member state or

III) a previous procedure executed by the same member state not related to the issuance of electronic identification, which provides the equivalent assurance or

IV) presenting a valid notified electronic identification mean with the LoA substantial or high.

While these requirements can in theory also be defined in a governance framework, the incorporation of such requirements into statutory law facilitates the creation and enforcement of legally binding relationships. Hence, existing statutory law (or case-law depending on the jurisdiction) needs to be incorporated by different governance frameworks to achieve a holistic approach and enforce legal liability.

According to Tim Bouma as one of the main contributor to the Pan Canadian Trust Framework (PCTF) these frameworks intertwine and complement each other as stated in a personal interview. He suggests that policymakers have to go back to the drawing board and take a look at all the concepts to evaluate if they have the right concepts to build out a suitable framework and regulation. The PCTF “is not a ‘standard’ as such, but is, instead, a framework that relates and applies existing standards, policies, guidelines, and practices, and where such standards and policies do not exist, specifies additional criteria. It’s a tool to help assess a digital identity program that puts into effect the relevant legislation, policy, regulation, and agreements between parties.” PCTF V1.1

While the eIDAS regulation itself aims to be technology agnostic there are some aspects, which complicate the adherence of the regulation for SSI implementations. However, this is a topic for its own article. In the eIDAS SSI legal report, Dr. Ignacio Alamillo Domingo describes the potential shift of the eIDAS regulation as trust framework on Page 22 as followed: „Adopting the SSI principles imply, generally speaking, an increased complexity in trust management and a shifting from hierarchical or federated trust assurance frameworks (…) to network-based socio- reputational trust models or accumulative trust assurance frameworks that use quantifiable methods to aggregate trust on claims and digital identities.” Hence, we can already observe the suggestions and considerations to adapt the regulation to suit new innovative solutions.

Key takeaways:

Governance frameworks and trust frameworks need to be combined to form a holistic approach.

Governance frameworks of SSI implementations need to respect the requirements and specifications of trust frameworks of the jurisdiction in which use-cases with regulatory obligations are carried out.

Regulators need to evaluate existing regulations concerning electronic identification and authentication and their suitability with new identity architecture.

Governments should engage with the public sector to collaboratively explore the requirements for a legally binding trust infrastructure.

Disclaimer: This article does not represent the official view of any entity, which is mentioned in this article or which is affiliated with the author. It solely represents the opinion of the author.

SSI Ambassador

Adrian Doerk

Own your keys