Trustworthy Attestable Decentralised Identity System (Tardis)

点击翻译按钮获取中文摘要

Identity is an important concept, it is used to represent an entity in such a way that it can be identified from everything else in the same space. In the digital world we need identities for both human entities and virtual objects, typically used before they are permitted to carry out some action or obtain data. However, the internet is not a trusted system, identities formats are decided by the owners or designers of the systems that people or other systems interact with, and security control is inconsistent at best, inexistent at worst. Digital identity has become widely used in recent years for various purposes including legal verification, and this trend is rapidly increasing. It makes use of people's online records (e.g., online purchase history, social media profile) as well as their personal records (e.g., birth date, passport number) compiled together to form an identifier. However, majority of the identity systems are centralised and hence owned by an authority. The authoritative organisations have full control over all identification data used in their systems. When it comes to data being shared in a globalised system, for instance data gathered for climate change analysis, we simply cannot have a single source of authority. The next challenge is the measurement of trustworthiness. A trust system does not imply everything flows is trustworthy, equally even if something is trustworthy, it doesn't mean it should have the power to view or access everything. The main objective of this research is to identify the gaps in existing identity systems and to fix the security concerns. Data sharing is part of our everyday life and already so many problems such as the ones highlighted above are not being prioritised. In this research we will also look into a novel way to represent identities that allows communications and data sharing on a secure need-to-know basis, using multi-dimensional properties of digital identity and the dynamic nature of the context it is in. The owner would choose which subset of their personal data to be disclosed, form a sequence of bytes (e.g. encrypted) that can be transferred safely to a decentralised system where trust could be established and trustworthiness could be determined. The receiving end would have advertised what is the minimal set of data they need for their services and the authorit-y(-ies) they use for the trustworthiness validation. The research will be divided into three main stages:1. Existing design and identify gaps. During this initial stage the project will gather the requirements that define "trustworthiness", considering testability and explainability.2. Based on results from the previous step, this stage is to seek an end to end solution for the identity crisis in the modern digital world. The proposal is to make use of new representation using bigraph as the identity representation, which when combined with Macaroons mechanism we will have a decentralised trust system where (a) users have full control of their own identities; (b) trustworthiness could be measured and verified; and (c) risks associate with centralised system such as authority abuse and security vulnerabilities could be minimised.3. Test and verify the hypothesis. We will need a purposely built decentralised system to simulate the information flows with access control in place at all the servers. A set of scenarios will be provided for the evaluation, and for each scenario a list of use cases along with the expected results will be defined. All identities will be represented using Tardis bigraph notation, and we will test out the system using the Tardis to assess its accuracy, effectiveness, security and performance.