Blockchain and the Battle to Secure Digital Identity

The emerging technology of blockchain is a promising way to verify transactions without compromising your digital identity.

Think about how fragmented your digital identity already is: Every time you enter a password or PIN, you’re leveraging some element of your digital identity wherever you are. Every time you pay with a credit card or give your Social Security number. Every time you digitally sign a contract.

This holistic digital identity is tied to your physical appearance, financial status, speech, property, and creditworthiness, making it an extremely valuable asset. Unfortunately, as pieces of our digital identities are handed over to everyone from retailers to government agencies to employees, they are more vulnerable than ever.

Enter the blockchain era. Any organization can deploy blockchain—a relatively new technology and methodology that holds great promise—to build trust among users. In its purest form, blockchain enables businesses to instantly make, approve, and verify many types of transactions by leveraging a collaborative digital ledger and a network of pre-determined individual blockchain contributors or curators. Once a transaction or other data is recorded to the secure blockchain ledger, cryptography takes over, and the barriers set by verification can drastically reduce the chances of data theft.

There are two types of blockchains that are often mentioned: permissioned private blockchains and anonymous public blockchains. Both types of blockchains have their own advantages, but private permissioned blockchains have an extra layer of protection - the participants in a transaction are known and traceable. Would we be willing to let blockchain act as a clearing house or enforcer of our complete digital identity? Consider some different scenarios in which blockchain can play a role.

Private blockchains aka 'enterprise private blockchains' : This type of blockchain is already being researched. Through blockchain, a specific financial institution can verify and facilitate stock purchases in real time, but after completion, these transactions can also become part of the digital identity and be protected by the blockchain. In this way, the information is not placed in a separate, isolated account behind the bank's firewall, but can be verified immediately, referencing other digital identity elements. This will also allow the bank to retain a certain level of authority and management.

Public blockchains are also called 'classic blockchains' : As the Internet of Things develops, public blockchains can act as ledgers in scenarios where only certain digital identity elements are needed and central authorities are not essential. For example, buying a burger through a drive-through service. The combination of blockchain and Bluetooth beacons can verify the car with identity information, verify the Visa checkout app running on the car console, transmit it to the restaurant payment system, and debit the appropriate amount from the bank account. This process does not require the full digital identity as part of a known or closed network, only sharing and accessing a portion of the digital identity related to the sale.

Private shared blockchains aka 'industry private blockchains' : This is a hybrid type of blockchain that can be a satisfying medium for financial institutions or stock exchanges, as digital identities and transactions are managed by a 'circle of trust'. Changes don't need approval from many people, this private shared blockchain is readable and modifiable by all, but this keeps power from being consolidated in the hands of a single institution. So in the stock purchase example, a number of interrelated industry stakeholders - perhaps a bank, stock exchange and the US Federal Trade Commission - need to approve the transaction before it becomes a verified part of the blockchain and someone's digital identity.

These scenarios may be theoretical, but there are already many real-world applications that leverage blockchain. The Leonardo da Vinci School of Engineering in Paris uses blockchain to verify and protect diplomas. The Royal Bank of Canada is experimenting with blockchain to verify and protect cross-border remittances. Blockchain is even being used in smart contracts to manage solar ownership and transactions on small grids. Whether it’s being used between private financial institutions or the public Internet of Things, blockchain is securing digital identities and all the elements of life.

Blockchain participants still need to take some security measures to store, federate, and effectively utilize digital identities under this architecture. All solutions that leverage blockchain rely on the integrity of the information on the blockchain ledger. While the ledger itself cannot be corrupted, fraudsters will focus on attacking individual users. It is critical for all blockchain users to implement strong two-factor authentication. Data encryption is also key, as is device-level security, such as trusted execution environments (TEEs) or secure elements (SEs) that can protect against potential man-in-the-middle attacks.

Once these security priorities are addressed, blockchain technology will realize its full potential as the guardian of our precious digital identities.