邱駿 | Blockchain for Decentralized Identity | Taipei Ethereum Meetup @ COSCUP 2019

the track of the track and so I'm the host of the track but also the best speaker and today we're gonna talk about the sound interesting implication about ethnicity okay so cuz I know there were not so much so so many people talk about identity especially self suffering I hate it so what this means is identity that is totally controlled and owned by the user to customers so so so this is alright and this is linked to this slide so so you can just scan this Toronto and you can tell it a slice and you will make this make this bit easier since I'm talking English okay so today I'm gonna talk about all the white parts first of all I'm going to introduce this community the definition of it and what are the components and elements I'm sorry about that the decisive bones is kind of small and and the second kind of talk about the architecture and this third parties organizations like what organization are behind SSI push meds and the most important thing is what artist specifications of implements these are going to be hahaha how can we make the happen and the sound okay so let's talk about what these should everything celebrate slope today's talk to this fob is actually the resource is actually from my previous article so if it downloads slide you can actually link to this article is in Chinese yeah it's easier to make so we all have experience that we asked who are you so think about it palm tree how did you answer to this question let's not wait when someone ask you is your answer in your job your job title or did you answer your ID card number or need to answer maybe some event ID for example the post about winning close company but you try to enter the Coast Guard banner if someone asks you hey what's your ID right so the identity itself is actually depends on a scenario so depends on where you are and what the people are going to talking to who are they interact with so this digit identity is kind of sort of things it's an identity that expressed and stored in digital form okay for and it's actually depends on the scenario situation you I am trying so there's a really famous article talk about the the evolutions of the ditch doesn't it and it's the most we can from three years ago and it has four phases so the first phase is called centralized centralized I think if that means well the identity is actually stored in the giant deputies okay okay so so why do we why she would need a these identity for this is hope because the triple where triple top you what about web system ever is coming up so we always have we started use email or study sir some internet for buying stuff sort of things so this gentleman has a large demand was the popularity of the trip bah-bah-bah and we actually had Dominic talk about his certificate authority and essentially the first attempt that people tries to make their website transport be right we have to trust at work somewhere we are serving white people are using so so CA is established to be responsible for the issuance and of the certificate okay so you can see mister diagram here so we have a CA probably wait and we have different levels of PCA so the room CA would probably have like 50 plus Mercier's and we have intermedia slips so aside the hierarchical structure okay so the SIA was issued the certificate to the website domain domain owners and then we are we don't people who what try to try to access the Internet X is the service so the reason we can trust the website is because they have a small block sign on the way URL address so the only problem to see it is it's really centralized and it's a hierarchical so what if the roof CA is not transport that means well it's not trustworthy on the top and we cannot cross every second second level of C is behind that right so and when we try to use the internet and Internet services that means we have to trust each single website for example I'm using Facebook a pump right so I have a Facebook account by nano a motors are using I'm using using in YouTube so as long as i am using more services my identity is actually broken therefore a great job because it's spreading here in there it's pretty hard use it's pretty hard for me to manage so hannity is controlled by the domain honor the means well if Facebook tries to shut down my my County there's nothing I can do it about the user may have to register for thousands of services for the same time so people start to think about hey well um tell me what can we do about the an easier solution is to make an alliance so what if for example gesture is a service at this domain and these domain is actually forming a federation it's a federation so I'm using service from server Hey that means I've meanwhile I think did access to different servers this is called federated identity that means these services are forming a group which allows me to access every single servers that service so that it I needed to be managed by the collation of several organizations so the first Federation is called the Liberty Alliance it's in 2001 is Levis on the the micro system company which invented Java but however identity outside Alliance as you can see these two probably these two services now they didn't join the we didn't join the alliance so if I tried to connect to the service here I still have to register right so it doesn't really solve the problem so now let's look to the next phase so this is where you know we are currently in the user centric identity finished right now so please I hope if we try to out get some tickets from kick your tix for one spot for example do we have to register okay it takes account we don't right we can actually signing via Facebook okay the reason we can do that is because there's a protocol they suspect the specification under the underlying the with the registry process so each services needs to work together to valid the same scent of respect to verify identity across services for example I can sign in and use a Facebook probably so developers are here right I really heard about OAuth or feed off or open ID this sort of sort of things probably you have been using some api's from those except the there are two main thing our focus here the fifth thing is called user consent that means whenever the other service is trying to access Maya to my data and they have to ask for my permission for example well this type is not really a good example but when Facebook tries to access your email account they actually try to they were asked you but we always keep click yes anyway that's another story they're you selling your data and the other thing is called interoperability the means your kit you can use the same account among these different types of types is for services so this is one per user centric user centric equals concerns so here are some examples I hope an idea you all can't be so but does this solve the problem not really right this users are still dependent on centralized services our IDs is still kicked by Facebook gift I give up pick up YouTube Google China whatever so this service is actually had the power to abuse our privacy for example Google sells better ties means Mary so when some other marketers I mean marketing marketing company they can actually use GA then that means Google I'm selling our data to them for them to target in our interest targeting our what what what what what one of the things that we're for your field interested about and they're actually causing some GDP re-trigger so here's a question the real question so how do implement how can we as it has in a abortion era how can we implement and I think the debate is not controlled by the system centralized services so the answer obviously everyone knows it is distributed and distributed later blocking supply chain is the last people that's piece of the puzzle so let's take a look how can we use that so the identity that is implemented on this reputed ledger is called self subrogated so insured ssi so ssi is a dis 102 D that user can fully control and use between any services the mean the term fully control means only the one who holds a private key can access the identity it's it's a bit about cryptography the poki so SSI Sakura to digital better so this excellent give is a five really good properties so the first thing is existence that means identity it's accurate in a form of digital at the fire it's it's actually a string of alphabets and then in red the borders and it's if you can help us that if we put this dream on watching we could have have the dream protected by it from temporary no one can modify the value of the stream okay and the second thing is controllable so the the block she could used digital signature in front of you who lost the public key on the only the one can use the identity and so if you well if you protect the private key very well so no one can actually get it so you're the only one who hold it hope I didn't know one can use it this different things axes that means because blockage is decentralized of services distribute assistance it's a triplicate extinguishing so there are many many ripple clouds around the world so first this is really hard to walk every peers the same talk in the world it's the same time so it's access can hundred percent guarantee and transparency every data and every single bit it's going to be recorded on function transparently obviously and resistance okay so persistent means so when you are using some centralized server well this very likely that shutdown right it will be disrupted due to some DDoS attack or whatever but I'm watching because these minor is actually incentivized to provide a service and beverages so it's really not likely for these miners to do suddenly just going offline or shut up services so persistent protected okay so now this talk about architecture so they are actually for only four components here so the idea there so if you can think about it as saya that's at the bottommost layer which anchors our data stream in the top of it we have a management system you can figure by the sentence it's an app that allows to access our apartment it's like a digital wallet it's like wallet you're using which I can segment the coin with bigger and this third part is the publication I thought the Kitsch means whenever we want children to use a reduced private key just sign them some value then the receiver has to test your public key to verify are you really the owner basically and the poor thing is we only ever quit my dentures so there's particular one by one oh by the way this this architecture it's actually a ratcheting stack that means the operator actually realized that the bottom layer it's like a tcp/ip suit so application layer relies on the TCP layer and relies on the IQ later the physical peacefully it's a stay steady steady architecture so so here are some organizations that try to push push forward push this is a forward so for example in boot equipment trust so it's a session of workshop but I believe they're hosting every six month and try to generate some really good results out of it it'll be dropped and there's a dominant PC good which helps to draft to make this drought into a standardization and this yeah a foundation to work tries to bringing every corporation together to to to deliver on the assessed issues and there's and there's a compass so among these four organizations the most significant one is RWC proving for the chumps why because they there's published so many papers they published a lot of open source code and the athlete helping to transform the technical specifications into into a standardized Chinese tested our istea The Dispatch and even the term SSR self serving identity is invented by our Authority so it's really specific and really important so that the ID specification is largely based on the art ability sports okay so yeah five minutes left so now let's take a take a look at step one part one so the first step is called the ID so it's really simple it's just a stream that get anchored on watching and look like this okay so they actually three parts this this part is fun in this function so the ID so this is actually a universal unique ID the form of Interpol of Judo ID and the first part is okay so this is this should be used under the ID of sophistication and the second part is well how should how students how shouldn't know resolve this dream so for example now when using the sovereign launching or a finger block if I'm using a premium blocking it should be he th just just I didn't quite to specify of what resolution I should use and this is a unique string you can think of it as a hash something that you can identify the identity okay so this is a puzzle moss there so on top of it we have a second area right we have a decaying pkms layer it's got this alaska management system so you can imagine that the task of this layer is to manage the public key right and beyond that it has to store the user data for example probably some financials probably some person some personal encrypted data probably the photos the tax dynamic okay so they actually we can actually divided this into three different layers okay so the other there is something that talks to populate the bottom di di di either so if it just basically requests the bottom layer to look out to look at the ID so hey I have a di D string so could you please tell me to retrieve the document okay and then this is call here well there's some somewhere we stored it the data on a cloud for example like Google Google Cloud in WS Microsoft Azure so as there it's a it's an active duty it said this is Wally abusing so the user actually mostly interact with the wallet and then use the underlaying services so now things are getting interested so this is really a complication a publication as I said it means whenever I've tries to blogging the services the service provider has to public in me am I really that user that they out there talking to so the easiest way to think about it is when we would try to locate it website we have to type in a password right so if the password the password is actually a challenge response cycle that is a that is a challenge set by the provider for us to prove we have the user despondently well I feel the only the user knows a password password right if the user password is intact so we can think of it as a publication process it's about of course and this is stereo in the FDLE scenario it will become sort of more complicated because we have we cannot just use expose our private key or password so this research is going on and I actually cooked this backlink on every slice if you're interested you can check ok so the first part be required financial so what is it financial financial as probably your student ID card your ID card your driver's licenses on your membership card from a bookstore whatever so it's actually something some document to prove you will have a membership or you have the or you're going to prove you're part of the community this kind of things so so when you're graduated probably to school where each of you in credentials well for example for men to you so the only purpose is of the very Michael kantack show to replace every ID card your wallet okay so in the future we'll imagine well well that's when I went out when I take out my own digital wallet I can have every kind of potential stored in my wallet right wait am my student card I can just so sure about this dish while I said hey this is mine up to the student part so what is verify that means well it just means it's crypto prophet is totally protected by cryptography magic diplomatic that's the three points so we have clients claim is is it's a relation for example calm alice is a student from one school so this information this is a good claim to prove the relation in some manner data for example the issue of time or these days some other not so important informations and the proof prove it's basically digital signature so well so there's a more advanced spec which is called a very viable presentation this actually used seekest not use do not approve to protect the privacy of the quite answers so in it's pretty complicated I didn't give it again it fully yeah so anyway it's a more advanced topic to talk about okay my time is up alright this is summary yeah I got it so this expected to help researchers and Java developers to quickly give assent to understand what is going on huh this is I am once I didn't eat this identity and the development of SSI is really short only three four years but as you can see there are many many many significant results coming out and there are many hue locations porticoes facts continue to evolve actually no there are some team based in Taipei actually working on this direction and since this is fairly novel field information is open up scattered everywhere and it's really hard but I know Pacific market researcher is it's really hard to get information right so [Applause] yeah see ya oh no come home once they come into this party English so unity change first so right now I'm at unity and researcher and so what we're doing is we're trying to implement the specs of the ID as a suspect and we try to make a platform a of this board for customers to manage their their identity for example maintain access to different kinds of social medias only from our dashboard so numbers would be great and still under development and put away for sure is once we get some interest in us out where the we are doing something related to with you some information at the courts have to look respectable on Facebook idea who by your head protection satellite idea that's a good idea Teddy st. Francis sit here vlkabok need to talk to my wife again how does it applications Johanna company Facebook ominous another idea you need ID now see that makes it illegal they say sigh for the county nostril including way for trusting us that's at the coming of small feel so model it's it's almost okay so the professors ask about and what's it what's a reason for us to switch to statistics from the current identity architecture to SSI I think that one of the really strong motivation is the gdq i issue okay so GDP on issues means that the users data is that it's not essentially not we're protected so our data is abused by the Ajani companies they're selling our data to to the various funds of marketing companies for example appears that there's a scandal it's called a campus and everything that led to come right if you know that the team has to me how the Trump campaign to try to try president to to win a campaign and they actually abuse the Facebook data right so I think GDP autism is a great power to to remind people about the importance of privacy so so we can we can see the projects about the maple maple and some some cryptocurrencies that focusing on a privacy how do you apply different informations from being is disclosing on a DeBlasio on atomic internet so if we if we have this SS architecture that means our data is on its kit and on why not all so let's go back to the architecture so in this epidemic you can see there will be two to the fourteen parts this part is the fortune Parkinson philosophy and Almighty is accurate on walking so what's this well it's actually have a lot of fingers it has three layers so it specially cured in clout there so you will ask well if the user has to get the data where she was story which is so you have a cloud if I remember the data is encrypted by the public key of the user so the event we store data on a Google cloud or Amazon they cannot read is just access to the region because we did it spun Krypton right so of course it will make things more complicated for example on what if I tried to sell my data I had the I am the user I want I try to sell my data back to Facebook or back to you too baby so hahaha how should I worry well it's a it's another question what else you to exploit yeah so yeah just helping the because heavy medication over me also myself because back to you the slightest show the black sham my thing is like what we call interaction they that because it's anonymous or pseudonymous survey we don't have this like that I think students comments but but if FinTech action then we run to this ending product then I believe watching is not the second Internet's because Internet application basis out well American flag but once you touch the thinking a block share it soft one it's not into officer white one man because you need to deal with the Real ID so I was thinking if we this I have been like that pushing for the the faction adoption of the past few years a pal it's really not the Internet adoption story again it's not a second internet we times we love this this way help us now I believe the world has come on internets but the world is an adapted ID years the digital age is now not happening as we speak yes and then this is the way this ID come along I believe were based on math failure in the past few years I believe we need something like SSI and then we need to do we need to rethink and it's not it's not actually every Tsushima had a big enough a you and I said doc started talking takers so that gives octopuses all to contain ourselves anyway up there really interesting point of view yeah oh I was you know our longest shot so that's all Oh Janine de tráfico those chances okay yeah hi [Applause]