Legal Trust Anchors for ZTA: The eIDAS 2 Proposal and the Role of EBSI

Okay, good afternoon everyone. Thanks for an invitation to share a few minutes talking about trust in a zero trust session, which is very, very, very interesting for me. I will be discussing if, does this work, okay? I will be discussing a set of matters we are being developing the last few years. In this case I'm talking about zero trust architectures, but not all of them, but those that are based on the new SSI self-sovereign identity paradigm, which is something we are building in a European project called European Blockchain Services infrastructure.

I'm here representing that project as well. And of course this has already been discussed and I'm only bringing this, this, this slide to to, to make this mark, which is that even if we deploy this zero trust approach, it is a, it happens something similar as when we are deploying blockchains that are supposed to be trustless trust machines. The fact is that if we need to rely on any assertion, on any claim, any attestation, we still need something we call trust frameworks and trust tanks. And this is probably the insight that we are trying to share today.

Even if we are, we move from the classical approach, and this is something that has already been said, has been happening from at least the last 15 years, at least in in, in the place I work. What we see is that we need to rely on what we call . So first I will introduce briefly the self-sovereign identity orientation. This is something that it is quite a challenge in Germany where there is a very strong association and very strong industry approach for, for this concept.

This is an evolution, a philosophical evolution of the classical identity management approach where we are moving from centralized identity management, even from we are moving away from identity federations, which is what we currently have implemented in the European Union. And we are moving into a new approach where we want the user to be the control, the at the center of control of the identity assertions here, the concept of identity is not the classical one.

It is not only my name, master master surname, my second surname in Spain, we, we have it and or even my unique identity number or employee number, but it is a wider concept where we implement the possibility of sharing other identity attributes. Namely date of birth is a classical one.

In fact, we are discussing a lot of use cases where we want to have the proof that a person is older of age, but any other identity session I'm bringing here only a slide with the, one of the philosophical approaches for this, which is the Chris produced by Christopher Allen, a very well known person here I guess, which talks us about the different pillars that we need to implement on identity management. We should be called or recognized as sovereign. Personally I prefer decentralized identity management as opposed to self-sovereign identity management in in Spain.

In fact, we've had a lot of discussions, political discussions have to say about this. And in fact, I am, I am the convenor of C C C JTC 19 working group one, which is devoted to decentralize identity management and we are producing in fact a technical specification for the centralized identity management based on DLT or based in blockchain. I know that there are other approaches, but this is what we are doing. So this is not any kind of conflict in any case.

The idea, and this is important in in political terms and legal terms in, in the European Union because we are, we take care really to care about GDPR and personal data protection. We are thinking that we are seeing that we have new technological approaches that can allow us to do identity management but with privacy enhancing approach. And this is important because essentially what we are changing is the connection between reli party as we will see immediately and the issuer.

Therefore contrary to any, any other federated identity management approach in this kind of approach, there is no this, there is no such connection. So the relying party does not contact at any time with the issuer. This means that the relying party will need to trust the accession as such in itself without being able to verify anything. This means that SSI approach is very, very, very aligned with CT trust architectures. There is a quite strong connection.

In any case, this is not really important for, for us, the important thing is that we have already started to implement this kind of approach, so we've gone further. We've not just adopted the philosophical approach, but we have created at the European Union level a first project to implement this as high architecture. Here you can see a slide which has been taken from the EPC materials of course with the per permission.

When you can see the diploma use case here, you can see at the center of the equation a holder, which is a student that has a digital wallet with a set of credentials in, in the EPC approach, this student has been able to create her decentralized identifier under her exclusive control because it is generated and store and never leaves the wallet and then the holder with her wallet is able to ask for different univers to different universities.

The issuance of digital credentials, in this case the digital credentials are for diploma academic diplomas then to share this information with verifiers and here if you look at the, at the at the diagram, you will see that the verifier is only relying on a blockchain or you could expand this into data registry to trust the information which is provided by the issuer.

So in this case, what we are doing is to create new approach where we use the blockchain, but this is just an example, okay, so we can have a verifier relying on the information which is presented by the holder as issued by the issuer because we check a blockchain with proper information. It is in this, this is interesting because it provides us with a lot of benefits. So ironically this has been promoted originally from the United States, but it fits pretty well with the European Union approach and other regions in the world approach for protecting privacy.

And it provides us with lots of, lots of benefits and these benefits are both from the industry perspective and from the governmental perspective. For instance, the SSI identity provider, which is the credential issuer, ceases to intervene identification process, meaning that we reduce the exposure to the specific types of attacks and this is something that costs money. So we have less compliance obligations reduce this thing called the big broader risk or even the digital federalism risk or the digital capitalism civilian risk.

This is nice for us specifically if we, if we are governments because when we are issuing credentials we don't really need to know who is actually consuming them. This model also allow for disclosure. I know that Christina Yeshua and her colleagues have been discussing this, so nothing additional to say and the best thing of all is that the base identity in the sense of the dis identifier is not, is not something you can suspend, you can revoke so it provides control to the user.

So this is a kind of philosophical approach that in my opinion will allow naturally zero trusts identity management because it works in a different way as the classical infrastructure. In this case, we cannot rely on our gatekeeper that checks your identity when you access the network and then just trust this, I will just trust the credential for each transaction and credentials, as you will see, will provide us with specific information, specific contextual information, specific location information, specific device information and event device binding.

Therefore, it constitutes an approach which is particularly good for zero trust architectures. What happens that as usual for this to be used in regulatory environments, particularly in governments and in highly regulated institutions like finance institutions, probably we need legal recognition.

Otherwise we specifically in cross domain or in cross organizational domains, what we will find is that we will be facing a lots of difficulties to be able to accept this kind of credentials without in establishing identity federations and in zero trust probably we want to rid of all the burden around creating delegated identification systems and delegating I creating identifi federations.

In fact, in the European Union we have a long experience trying to create a big governmental ion, which is called the EITs one, which is being right now review and therefore we understand what the limits are and believe me, there are lot of limits when we want to implement identifications. For instance, in my case, even if I consent, it will be very difficult for me to get the German medical doctor having access to my Spanish I medical information to design.

We need, as I advanced before different kinds of Tristans to this, I want just to introduce our technical work. We are about to publish immediately in ISO TC 3 0 7 joint working group four. This is a technical report that we, I, I've fled as project leader the last four years and it is about an overview of the different truss we you can find in DLT based identity management systems. Here you can see the different true stanko. We've identified five through stanko.

The first one is the legal true stanko, which at the end of the day is the legal basis that will allow us to recognize us to wealthy credential. Then we have data to stanko something which is for instance, well known in the truth of IP environments where you get repositories of information you can trust. For instance, a data to STANKO could be a university which has been licensed to issue a particular type of credential we want to use in our zero trust approach.

It could be an enterprise talking about issue credentials to their workers and cryptos are the classical we have for PKIs for managing publicists, for instance, cybersecurity stanko would cover all the processes we need to manage the infrastructure and finally we would have social through stanko, but this is less important if we go to the legal through stanko, which is the the discussion for today. I want to talk just few minutes about the e i regulation. The first regulation we have, we had in the European Union for producing a big governmental identity federation was approved in 2014.

It is now under revision because it has different limitations. It's difficult for a private company, for instance, to use than I dash one identity system. On the other hand, IDAs is based on identity federations on the negative identifications and therefore it introduces a lot of privacy issues and in fact the European Commission has found that a new approach is needed where we want to interchange not all our identity information, but just specific identity attributes. This makes a lot of sense in zero trust architectures.

When you want to check for instance that I am a lawyer having access to your organization so you can make me an offer with a benefit or a discount because of my lawyer attribute. In this sense, the European Union has created, has proposed at least the European Commission, and this has been discussed, right, right now between the council, the, the, the European Prime and the European Commission, they have proposed a big legal tostan for this, for this new type of identity rotation, which is something we call the EI two, and it has two big important pieces.

One piece is a kind of service slash product to be issued by governments or by other organizations under the authorization of a government, which is called the European Digital Identity Wallet. I know that there has been, and tomorrow there will be more talks about this.

Please, please attend. It is very interesting. It is a big, big, big piece of the trustworthy infrastructure we are developing in the European Union. In this case, the important thing is that it is not only something we will be given voluntary, we, but we will be authorized to use because the, it will be mandatory admitted by different types of entities, including a lot of private sector providers. In this sense, this is something that in the few years, in few years, can allow us to create zero trusts architectures where we trust the information contained within this identity wallet.

And to this end, and this is where the legal thing comes, comes about, the European Commission has created a legal resign for what they call electronic attestation for attributes. This is something that from a technical perspective, we will be calling a very far credential In this case, the legal term for this is electronic of identity attributes and as always in the European Union we have with with the legal recognition of electronic services, we have two levels. One level is non-qualified and it means that you have the right to go into court.

The second level though, it means that when this ation of attribute, this very far credential has been issued by a qualified to service provider or by a, a public entity body responsible of the authentic source like a public register, then it will have the same legal regime, the same legal validity and effect as it has been issued in paper. This is a big transformation tool we can use and therefore it means that we will be able to use this into our processes.

We will be able to install zero trust approaches for making real business even with unknown customers or future customers and of course it will help us going further. The limitations we currently have with federations of course, and this is my my li last slide. It means that we need to implement a trust tank system. Something that in trust world is con a trust spanning protocol. We need to convey trust, we need to inform about what credentials are trustworthy.

This is the purpose for instance, and there are, I have to admit that there are, there are different, different technical approaches, but in the epsy approach, the what we are doing is to use a blockchain which is owned by member states or by companies designated by member states where we publish in a kind of layer one system all the information that you will need as a rely party to make an informed decision about the of algorithm.

Therefore, if I am a company and I want to give someone a benefit because this someone is able to prove that he or she's a lawyer, instead of calling the college or the professional association and check checking this in real time, what we'll do I will do is to check in the public blockchain whether this entity has been authorized to issue this kind of credential, whether the cryptographic material of this entity is current, whether the legal recognition is complete.

Therefore you can see epsy as a distributed to model which goes further the typical centralized model federated to model and therefore something which could be used in the future for our zero trust architecture approach. Many thanks. Thank you. Do I have any questions from the floor? We didn't get one question online. I asked for clarification. Why isn't it implemented in e i S two and S D G? I'm not sure that might have been during the self-sovereign part of the discussion.

Well, the, the, the it two approach is quite sub sovereign because in itself, because it it, it contains an article that says that the user must be in under exclusive control. Full controlling fact is the, the, the proper term that is used in the purpose regulation of the European digital identity wallet. It means that the, the, from a legal perspective, the architecture should be ssi. It is true that SSI can be implemented with blockchains without blockchains or there are many, many technological approaches.

We, in Epsy we defend an approach based on, on blockchain. Maybe perhaps later we can discuss why, but at the end of the day, the approach is quite SSI as opposed to the current approach where your identifier is provided by someone.

So yeah, it makes sense. Okay, great.

Well, thank you. Nice job, Ignacio.

Okay, Thanks.