Ken Ebert: A Stepwise Approach to Deploying Decentralized Identity

Okay. So what we're going to be talking about today is a step-wise approach to getting through the, the effort to take decentralized identity and some of the cool things that have been developed and put those into a, into practice. We're gonna talk about the ecosystems and the roles and the people that are involved in that. We're gonna talk about the closed ecosystem and an open ecosystem. We'll deal with business considerations, governance, and then communicating your message. These are all important aspects about how we want to get to and, and actually deployed solution.

Let's talk a little bit about the trust triangle. Everybody's seen a diagram that looks something like this before, but this talks about the decentralized identity system and how they're comparable to physical credentials. Trusted issuers are the, the anchor of the system. They're the ones who create and pass the credentials over to an individual who can hold them. The individuals hold their credentials. They determine to whom and where they want to share them. And in what manner they want to share things, whether they want to reveal everything or just a little piece of it.

And these, the last part are the independent verifiers that are the ones who are looking at the credential to see if it provides sufficient trust in the issuer and the persons whom they were issued to do business or to interact in a safe and secure way. When we look at a system, we need to make sure that all of those roles are put together and in a way that builds the trust and allows us to, to provide benefits to the people, participating in the system. When we look at a closed ecosystem, a closed ecosystem is a simple one.

It's one where you don't rely on the entire world already having adopted decentralized identity. The, the simpler the system you make, the more likely are to be successful in getting your initial deployment to go. If you can control who the issuers are, it in the simplest case, it's you, your organization is the one who's going to issue the credentials.

If you issue credentials and you know what the credentials are going to be like, you are establishing the initial trust and, and setting up a system where the credentials can be passed to the, the people who are going to hold them, and then verified. At some point, if you define a set of holders for your initial deployment, you want to pick a group that you have some relationship with already, so that you're able to help ease them into the process of having a digital credential that they're going to have on in their, their mobile agent.

If you also control the verifier or you or a partner company, then you have the full representation of all the roles in a very simple system that is easy to get deployed and easy to adjust and, and adapt. As you figure out what's going on. If you're managing all three parties, you have a better chance at success.

If you, on the other hand, put together, for instance, a mobile wallet, but you don't have people who are going to issue credentials to your wallet. The wallet sits empty until someone decides to issue credentials, and you can participate if you have an issuer in a wallet, but nobody who's going to verify the credentials. You don't have the whole ecosystem.

And again, your system will stall and waiting for out to external partners to come along, to help close the, the loop and make it all happen. In this diagram, we have cloud agents to represent a company, a partner organization. So the company is here and it has a backend system. A partner organization has a cloud agent and the employees are having mobile agents to interact. This is kind of a very basic simple ecosystem that has only three types of agents represented.

It has a, a ledger such as the NDCO nodes or the sovereign network, or many of the other networks that exist. It has a backend legacy system and only one integration to be performed. That is a very simple system. And the simpler, the better at the beginning, I recommend in working with our clients at NDCO, we've had a number of them who have had a successful approach. And part of that is by focusing in, on an initial prototype first, to get familiarity with the system and how decentralized identity works.

If you do a small scale prototype, you'll learn from that experience and be able to apply that in either a trial system or going to production. Once you're in production, you can make any adjustments that you need as you, as, as you scale the system out. But that closed ecosystem provides the whole set of interactions that are needed to derive value from the credentials.

Once you've got your closed ecosystem working, and it's fairly simple, even as you start implementing it, our, our many of our current customers, even if they're at the prototype stage, start to find additional, uses more people who can verify additional issuers variations on the credentials, that all make sense and can expand your system.

When you expand your system, you want to do that step-wise so that you're first bringing in another verifier so that instead of being a single verifier, you're one among many, this allows you to in a controlled way, expand your governance, expand who is going to participate in how they're going to benefit from the system. Other issuers, you might be a single issuer.

You might find other organizations within your own company, other departments that may be interested in issuing specific types of credentials, or you might find partners or other organizations who want to participate in your ecosystem. As you add them in the ecosystem becomes more rich and more diverse. There's more credentials to be held and to be presented and verified and used. You may determine that you want to expand your base of holders. You may start with a, a small set, a subset of your customers or employees, and then expand the group after you've proven the technology.

And after you've had some experience, one of the things that if you base your initial system on a closed ecosystem, you'll determine the initial governance as the system grows and becomes more open you'll need to include other people, perhaps in the determination of the rules for governance, the more people you've put into your pool to discuss and determine governance, the slower, the, the process will be. That's why we recommend that you initially start with a, you determining the initial governance rules so that you're able to make them work and get them deployed quickly.

Once you have all this in place, the network effect will start to appear and, and your efforts will expand without even in ways that you haven't anticipated.

Many of the, the technologists in the room are very familiar with the technology and they get very excited about it, but they don't often consider the business side of the, of the ecosystem in looking at an initial deployment, whether it's a prototype or a trial or a production system, you wanna look at who are the people who will be involved using the system, try to be as specific as you can in your initial deployment, because that will make it more easy for you to do.

If you say, as I've heard some of the customers that I've consulted with, say that, yeah, the whole world's gonna use my system. Well, right out of the shoot, the whole world will not use your ecosystem. You need to scale it down a little bit, maybe down to your employees, or even better to scale it down to like the sales team so that you have a specific targeted group of people who are going to use the system and derive benefit from it. After you have those use cases defined, you'll want to, after the personas are defined, you'll want to go through and define the use cases.

What specific problem are you going to address? An example of that would be, how do I log in without using passwords? Instead of trying to say, I'm going to use this credential for all aspects of my business, figure out one use case that will drive the most value and set that up. Another aspect that needs time and consideration put into it are the monetization of the system. What benefits are going to be realized, specifically, call those out so that you say, if I'm operating a call center, identifying my customer takes 30 seconds.

And with the decentralized identity, I may be able to reduce that time to only five seconds. That's a concrete benefit to both your customer and to the call center staff who have to now spend 25 seconds less per call taking care of mundane operations and getting right to the heart of the problem and taking care of the customer. Also look at the funding aspects.

Funding can be initially from like an R and D budget, but in order to make it long term viable, you have to have funding that either is derived from cost savings, like the reduced time and the support center or something where additional revenue or partnering opportunities will be generated. These considerations are important because as, as you get your business case put together, the next thing you're going to need to do is figure out how the governance works. So you figured out what your use case is, what are the rules and regulations that might come into play?

And, and what would you need to consider in order to have a successful product launch and a successful long-term viability of the project? Governance helps take care of things like compliance with the global data regulation policies, GDPR CCPA, L G D P from Brazil, HIPAA Copa, all of these regulations and more, there are more, an exhaustive list would be impossible.

And the, the list is growing over time. Those aspects of how do you deal with people's personal and private data can affect how readily adoptable your solution is by the legal department, with the companies that you want to try to involve, or the governments that you're going to try to involve in, in adopting your solution. Clearly identifying the roles and responsibilities of the different participants in the system will help lay that out and make it more adoptable.

The legal in getting an agreement through, you have to have a technology solution that's obvious, but if you don't have a business solution and a legal solution that all of those other departments can adopt and agree to, then you will not have a complete solution. And in DCO, we're putting some effort into machine readable governance so that we can adopt trusted issuers into the framework without having to recompile our, our agents and be able to, in a easy way, determine what is an acceptable verification.

The trust over AP org is the area where this type of effort is being discussed in working on standardization there. Once you have your story put together, you need to communicate your message. You have two audiences to deal with. You have the internal part of your company, and in order to get the, the project approved, and you have the external customers, we often ignore this in, in a technology development organization, but this isn't a crucial part to getting your message out.

We need a clear, targeted set of people that we're trying to communicate to and identifying their pain points and what the new value proposition for those addressing those pain points will help the message resonate with the audience. The marketing department will help you with your messaging, synchronizing the effort with the press releases and the announcements, and all of the things that go into a successful product launch. They will also help with educating the entire organization or group of companies that are going to be involved in a successful launch at NDCO.

When we consult with our, our partners and customers, we are trying to help them identify a clear path toward successful product launch. And this involves all of these different aspects of, of the business. And so we've seen a number of customers who have been able to successfully go through and identify both their technology, the benefit, and how they're going to position this for their customers to adopt, and then a successful messaging strategy to help them get the message clearly communicated internally and externally with their customers.

There are many different companies that have solutions. We typically like to recommend that you get started, do something as you do something, you'll find the aspects of decentralized identity that are most beneficial to you and your customers. And you'll also be able to focus your efforts and get to something very, very quickly so that you have the experience and you have work to build on as you build out a full-fledged production system and scale that to conquering the world with, with your new product and your new offering.