So my name is Jalen Milner, and I am the lead identity at the IOTA Foundation. Um, I'm also the project lead at the Tangle Identity project under the Tangle E working group. Uh, today I will present establishing trust between people, organizations, and things.

Which is part of the Tangle Identity project. So I'll go through the problem, then I'll introduce the solution, which is digital identity. Then I'll deep dive a little bit into the actual Tangle Identity implementation and IOTA as a background technology. And then lastly, we'll dive slightly into

the Tangle E working group which is hosting this project. So now in 2020, we're living in a more connected world than ever. We have people working from home, uh, due to Corona unfortunately. People are more socializing from home, and we're more reliant on the internet.

Yeah, more than ever. So yes, the disconnected world is, uh, yeah, we're very happy that we have the internet to achieve this, but it's also very difficult to, uh, yeah, transition to this new way of working and socializing, and there's actually a kind of missing layer

on the internet, and that's online identification. All right, so we have online identification for people is currently a missing layer on the internet. So how it's currently done is that I have over a hundred accounts spread over, yeah, different internet websites, which all have a username and password.

And the username is kind of my identifier specifically for that one website, and a password proves that I am in control of this account. Secondary to that, we have social media accounts which kind of bring more data about me as a digital identity. It shows maybe stories that I share.

opinions that I share videos pictures all of that, but it's very easy to fake these things. They're not reliable to base an identity upon. Similarly, for companies, they have the same struggle. They can't really identify themselves online. You have the websites that you can visit,

of course, you can identify employees by the email addresses, but it's still difficult to really trust that you are directly in contact with a specific company online. And what this leads to is that we have a few problems online, and that's that there's no verifiable

data about digital identities, which leads to poor security. It's very easy to fake someone's identity, and that is basically giving us fraud and a general distrust on the internet. Probably everyone has that feeling that everything you read online, you have to kind of criticize because you are, yeah, it's often

incorrect or someone lies, or it's very difficult to trust anything online. And this problem will once again become more prominent when we are starting to work towards a world where IoT is more prominent. We would like to create smart cities which make decisions automatically based on

information provided by IoT devices. And we can assume that there's this law of big data, right? That if you have a lot of data, then the general consensus of this data, the combined conclusion, is often correct. But if we would like to make localized decisions based on this data, such

as how do I create optimal traffic flow on a very specific intersection in this one city, then you have to base your information only on the local sensors that are around that particular intersection. So what's very important is that we have to trust the actual data coming from a very few

IoT sensors, and this again is where a need for digital identity comes in, or what we call identity for things, where devices can identify themselves, can prove where they are manufactured, what kind of software they're running, and potentially even create and gain a reputation.

And then their data becomes much more trustworthy, much more valuable, and therefore we can make decisions based upon this. So really, to improve the internet, we really need a layer of trust for that, and that's exactly what digital identity would like to provide. We, we have this concept, came up, digital

identity, and it's, it's a very easy idea to create one online profile to allow online identification. And instead of using a password, I use a public, a public-private key encryption to kind of prove that I own an identity. And if you're not familiar with it, the

actual user experience would be something like scanning a QR code, and as long as you have control of your phone, you kind of prove your identity. But there are many different ways that you can prove your identity, such as a two-factor authentication and other related authentication mechanisms. But that's

only like the username equivalent. There's a second layer to that that we're trying to build with digital identity, and that is sharing verifiable information about this identity. And it's basically like a signed digital certificate, also called verifiable credentials. It's a certificate which is, which has a

statement about this identity, which is signed by a trusted third party on this particular topic. So we could have a diploma that I had as a student, and uh, is signed by a university. So the university is the trusted third party here, and this is a verifiable, yeah, verifiable

data about me as my identity so we we uh over time this this concept evolved and uh a new term came up self-sovereign identity coined in 2016 and it basically set some ground rules for how such a system should be built where the focus shouldn't be on enabling

giant tech companies to take charge of this new system but really puts people back in charge of their identity but this also applies to organizations and things in our particular case I'm not going to give you all the rules but few of the examples are

that the identity owner should be able to be fully in control of how it creates its identity updates it and deletes it as well it needs to be in control of who sees what data or do you decide to share your data with do I decide to share my address with

company A and maybe also company B but not company C for example it should also be based on minimum disclosure where if I only need to show my address then I don't need to provide much more information such as my birthday for example it's all about minimizing the

information required to maximize privacy and the big part of it is interoperability which is something we also take to heart and that's why a lot of standards has evolved over time in this field and that's also exactly what we have implemented the first of this standard is is the ID

and that's a standard proposed by the World Wide Web Consortium and it's already implemented 77 times and that doesn't even include our implementation so hopefully we will be number 78 but that really shows the amount of people that care about this and would

like to implement on this it shows that there's a real need for it as well and yeah so like I said the did part is kind of this online account this username and this is how it looks like as an identifier and that's not the most interesting part

but what is interesting is that this identifier can be understood by anyone reading it and it can be resolved so that means that there can be you can retrieve more information about this identity and that contains a DID document a DID document contains a list of public

keys which allow you to identify who you are but you can also have multiple public keys which you can use for different purposes to authenticate yourself to encrypt data with or to have as a backup for if you if your identity might be compromised that you have some

very protected key somewhere safely stored away that you can use to recover your digital identity in addition to that it has service endpoints and those are basically a list of ways to connect with this identity or find out more information so in the term when we're talking about

an organization it could list the name of the organization if they would like to put that publicly on the ledger it could be a way to contact them it could be a an endpoint of their server similarly for an IoT device as well for people this is often not much used

due to GDPR concerns and there are kind of three roles in how digital identity works the issuer is this trusted third party that I mentioned that signed certificates they do need to embed their identity into a distributed ledger technology which is where we use IOTA often distributed ledger technology is

known as blockchain. There's the second person that's the holder, that's the owner of the identity, the subject. They also need to embed their identity into this distributed ledger of technology. And the verifier can optionally do that. They receive information that the holder wants to

prove. So, for example, if I am stopped with my car and someone would like to check my digital driver's license, I would be the holder and the police would be the verifier who would be checking this driver's license, while the issuer would be the government that issued me that digital driver's

license. The second standard is the verifiable credential standard, also submitted at W3C, and that's really that digital certificate that I mentioned, which is signed by a trusted third party, and this is exactly how it is exchanged. So, I, as a holder, can take charge of this digital

certificate. The issuer is no longer involved. So, again, when we take the same example with the driver's license, the government would never know that the police verified my driver's license on this particular day. So, I'm in charge of who sees my driver's license.

And again, the holder could also be an organization or a device. It follows the minimum disclosure rules, which means that if I have to show my driver's license, I, for example, could just show my acquisition date and the fact that I've, uh, what kind of type of driver's license

I have, but you don't need to know my name, the day it expires, or any other information that is on there. So, that's the minimum disclosure part. You can even take it a step further with zero-knowledge proofs, and that's basically sharing no information where you just prove that

You have a driver's license and that's still valid, but the actual information in there is not used. That's the next level, so let's go into some examples. I'll start with one which is very human-based. So let's say I have my passport here as a user in the bottom

left, and I would like to sign up to a bank to make use of its services. So how it currently works is that I have to send over my passport to them, and they store it along with all the other passports that they have received before

or at least all the personal information that they have to store about their customers, which creates a honeypot for hackers. This means that they can, if they hack the bank, they have a lot of personal data of all of the customers of this particular bank, including me.

And this is often what goes wrong, and this is why we see almost daily headlines where companies are hacked and our personal data is exposed. So what we would rather like to do is actually create a setup where, for example, I have a program in the cloud running which is

enabled by IOTA, excuse me, that yeah, kind of takes charge of holding my passport for me. And what I do is I create this verifiable credential, which I sent to the bank, which basically states you have access to this passport at this cloud instance if you contact it.

But only take the data when you need it. So let's say the bank would like to quickly authenticate me for once, it will send this credential over to my cloud instance that will verify it to see, hey, does the bank indeed have access to this information?

and if the answer is yes, it will send over my passport. However, when the bank is done with the cloud instance, it will immediately invoke my GDPR rights and ask for the bank to immediately delete this information directly so it's not stored on their

servers. And if they want this information again, they just go through the same process. So the information is only exposed during usage, and the bank can only request this information as long as they are in control over their own identity. So instead of having to protect their entire databases,

the biggest responsibility of the bank becomes to protect their own identity. Similarly, in a kind of an IoT fashion, another example would be let's say we have an intersection in the middle of a city and a heavily loaded truck approaches the traffic lights

and it was just about to hit the red light. That means that the truck has to stop, and then when the light hits green, it will have to pull up again, wasting about one liter of fuel, creating a lot of carbon emissions and bad air quality in our cities.

So it would be preferred to actually give the right-of-way to this heavily loaded truck and give him a little bit more of green time. So let's assume that we would like to identify this truck, that it is actually a truck and that it is actually

fully loaded, which would be all credentials that we can give out so it can prove it's a truck due to its manufacturer having signed a credential about that, and it can prove its load by having a credential created by the company that loaded the truck. At the same time, IoT sensors in the road

can verify this information and agree yes this is a heavily loaded truck and therefore it should have the right-of-way, reducing carbon emissions in our cities. Cars cannot do this same verification step because it is missing these verifiable credentials because obviously everyone would love to

have the right of way in the green light. This kind of protection is really necessary for this to become a reality and that's why we would use digital identities in the first place. And this, this idea is easily transferable towards other use cases such as public

transportation and emergency vehicles. Right, so let's move on to Tango Identity. So we are an implementation of this digital identity standard and we are building that on a public permissionless distributed ledger technology, which means that this is a platform that we're using which is completely

public to use. So everyone can read it and everyone can write to it. Um, we're not the only ones that have done that but we are definitely the only one that can claim to do that while being feeless, which means that there's absolutely no cost

associated to using this network and it kind of creates a public common, very similar to how we breathe air. Everyone can use IOTA as a system, everyone can build their identities on top of that without any associated costs. We are the first of all those 77 implementations that

have such a setup. We are developing our implementation in Rust, which is a programming language known to be very secure and performant at the same time. It's the same low level as the C languages but it's much more secure in its memory management. We're also integrating the IOTA

stronghold project. If you're not familiar with it, I highly recommend reading our blog post about that on IOTA or blog.iota.org. But it's basically a way to create out-of-the-box security such that anyone implementing this identity solution will immediately not have to

reinvent the wheel for the security of their private keys. A last upside that we have is that we can easily combine identity with payments as the IOTA network is also used for value exchange through the IOTA token. And once you can combine identity with payments, that allows you to prove who you are

paying, and therefore we can kind of remove all doubts and many fraudulent cases such as people pretending to be your parents on WhatsApp will no longer work. Similarly with company payments, of course. So how is our progress so far? So in terms of the DID standard

implementation, we're doing really well. Uh, it's actually working right now in our in the code, uh, but it's not fully functional yet on our new network which is Grasallas Phase 2 for those that are aware of it. But this should not be a very difficult

transition for us, so we still believe we can deliver this by the end of the year. Same for verifiable credentials. It's going really well implementing that standard. We're almost there. There's just some few more hurdles to overcome, but nothing that we can't

handle before this end of the year as well. But we're already looking at further on how to improve the implementation of this identity to make it more useful for those that would like to use it, such as the ID communications on how to standardize how devices people should interact

in order to validate their identities. So how do I challenge someone to prove that they own an identity, or how do I present them with my personal information? All these messages will be standardized. The stronghold integration is in development, and we're also providing a high-level library

which is basically a very easy version of the libraries of identity to use. A little bit about IOTA. That's the underlying technology that we use. It's basically a new generation of blockchain, where blockchain looks like this: where we have kind of a funnel, a lot of

transactions are combined together into a block, which are then added to the chain. But there needs to be someone that decides which transactions become part of the next block, and it's basically the highest bidder wins. And therefore, blockchain has high costs associated to it and a very low throughput because these

blocks are quite limited. IOTA, on the other hand, has parallelized this entire process of adding transactions to this ledger. And as you can see, due to the fact that it is much more parallel, we kind of removed this bottleneck, and therefore there are also no fees associated to it

and the throughput is much higher. I'm not sure how well you can see this GIF in the presentation with its frame rate, but it's a presentation showing the tangle in action, uh, where new transactions are here added at the at the front. And you can see it, these

could all be individual identities created right now, and it doesn't delete at the end. That's purely for visualization's sake. So our main development is driven by the IOTA Foundation on this project. We are a non-profit foundation registered in Germany, and yeah, we have a lot of academic

references already we're working with a lot of different partners as you can see here and we have transferred over 180 billion dollars over our network with absolutely zero fees so far let's dive a little bit into tangle.ee so tangle.ee is the working group that is

hosting the tangle identity project besides that there's also the tangle marketplace project which tries to create a decentralized marketplace experience where people organizations and devices can all negotiate terms on purchasing specific services such as something as simple as transporting something from a to b

and devices can bid people can bid and they can request services like that as well in addition to these two projects we have our general working group calls which gives updates on these two projects but also showcases how the members of this working group are using this technology

and more stuff like that so they're very very awesome calls and if you're already an eclipse member it's easy to join the tangle working group so please have a look on tangle.ee to check out if this working group is interesting for you and find more information about

it uh that was it in terms of my presentation um if you have any questions that I am unable to answer during the next three minutes then feel free to contact me uh through any of these social media plugs so luckily I did already get some questions first question I got is the tangle

identity project was created quite recently do you already have some code available for early adopters to make use of yes currently the code is still hosted on the IOTA Foundation GitHub which is a IOTA ledger organization on GitHub and then the repository is called identity.rsrs standing for

Rust, it is still currently heavily in development, so I would only use it for experimentation purposes. But we are still planning to do a 1.0 release before the end of this year and uh, therefore, also start the process of pushing it towards the Eclipse working group.

The second question says, "What are good resources for learning more about digital identity and verifiable credentials?" Yeah, so there are many good resources. A good starting point is always the blog from Christopher Allen, written in 2016, introducing the term "self-sovereign identity." You'll have to Google that. At the same time, we have created our own white paper which was called "A Case for a Unified Identity" which you can find by Googling as well or you can find it on the IOTA.org website. And that actually explains the concept

quite easily. At the same time, I would check out self.iota.org for an actual hands-on demonstration where you can guide yourself through the process of using this, this new technology in Corona times to prove that you have recently been tested negative for Corona.

The third question, "What do you consider as the main challenge to implement the standard in a local government?" That's a little bit of a broad question. It's mostly about everyone having to adopt the technology and creating kind of a trust framework. So, fine, having a bunch of different

digital identities is a good start, but you also have to know how identities are attached to their physical identities, like what digital identity is associated to the municipality, to its government agencies, to the companies within this local municipality. But if such a project is guided by

a well-defined process and there's a clear vision and a clear roadmap of how to achieve that, then I think that's not an insurmountable problem.

a municipality as a start, then it's actually pretty decent to set up and there are no very big major challenges to uh to take on, so such a project would definitely be possible. Last question that I see: what is the currency in the TangoEE marketplace?

It would be the IOTA token, and that's it for me in terms of the time. Thank you very much for listening and enjoy the rest of EclipseCon.

Establishing Trust between People, Organizations and Things

Scripts