Industry Professional
Our Digital Identities
Blockchain may be the right answer for security
- By Jaikishan Rajaraman
- Mar 01, 2018
Blockchain, the backbone technology behind Bitcoin,
has grown exponentially since its inception
in 2008. Since 2013, Google searches of “blockchain”
have risen by 1,900 percent and according
to Accenture, 90 percent of banks worldwide are
now exploring blockchain technology. Among them is India’s Yes
Bank, who recently announced a number of blockchain implementations
that support vendor financing for their clients.
The potential for blockchain technology in India is vast. Speaking
at the BlockZero conference in Mumbai last December, Neha
Punater, head of digital strategy, innovation and fintech at KPMG
India, highlighted the technologies’ potential to “crash cycle time”
and reduce costs across the board. With many now arguing blockchain
technology may provide better security, transparency and efficiency,
it’s easy to see why blockchain technology is being used in an
increasing number of industries beyond financial services, including
telecommunications, media and the public sector. In fact, it’s not only
India’s businesses that are set to benefit, but millions of people too,
thanks to the unique set of attributes that make it a useful tool to
help secure our digital identities.
The process of identifying a person has been hugely disrupted by
the digital world. Historically, identity has been fairly straightforward.
For example, a government institution could verify the name
and address of a citizen by conducting identity checks with banks
or telecommunication providers. As these organizations are regulated
to “know their customers,” they are able to corroborate the information
held by the government institution and therefore verify the
identity. Digital identities need to function in a similar way, but it’s
much harder.
Without tangible, in-person interactions, it can be difficult to
establish trust and ownership in a digital world. This is where the
blockchain comes into play. Blockchain technology allows people,
independent of each other, to rely on the same shared, secure and
auditable source of information for managing identity. When used in
conjunction with a mobile authentication service, blockchain could
be the key to securing our digital identities.
Blockchain Basics
When a user’s information is added to the blockchain, it is inserted as
a single block containing the user’s identity attributes and the user’s
public key, all signed with the user’s private key. At this stage, the
level of confidence in the user’s identity is at base level. Other entities,
such as a bank or electricity provider also represented within the
blockchain can establish relationships with the user by signing the
particular attributes of the user that are relevant to that relationship.
As more relationships are established for each person within the
blockchain, confidence in the accuracy of the attributes, hence the identity
of one’s self grows. As more transactions take place involving that
individual, the “reputation capital” of the identity also grows. In other
words, confidence in the identity’s accuracy increases as does confidence
in the trustworthiness of the person behind it. And, if any of the relationships
change, this will be recorded in a separate block with a cryptographically
signed timestamp that is visible to the entire blockchain.
The Combined Power of Blockchain
and Mobile Authentication
One critical aspect of any modern, digital service is finding the right
balance between convenience and security. Security in the blockchain
is upheld with public and private keys. The public key is used to identify
the user and the corresponding private key is the credential that the
user needs to keep protected. The public key is almost equivalent to
a user ID, and the private key equivalent to a password or biometric.
However, a public key is not a convenient “user ID” and the private
key is not something that can be easily remembered, such as a password,
or unique to that person, such as a biometric. Securely storing
the private key to ensure that it can’t be used by others, while being
able to easily use it to verify the associated identity, is a real challenge.
One solution is to introduce the concept of a wallet through
which each person can confirm their attributes and manage their
public and private keys. This wallet could be identified through a
more convenient user ID, such as the user’s mobile phone number
and be unlocked using conventional multi-factor authentication. The
individual can then prove that they own their private key and verify
their identity.
Mobile authentication services are an ideal framework for supporting
such wallets. Put simply, mobile authentication ensures the
person accessing an account is really who they say they are and by
adding two factor authentication the user is asked to verify their
identity via their mobile phone via a pop-up challenge to enter their
PIN or biometric password. This happens whenever the user logs into
their accounts, providing a very simple, convenient, and secure way
of authenticating themselves and asserting their identity. The combination
of a platform for administering the wallets and blockchain for
administering the identity is a perfect solution to providing digital
identity and in a way that is “conveniently secure.”
This article originally appeared in the March 2018 issue of Security Today.