Self-sovereign Identity (SSI) Infrastructure for Reliable Identity Data Distribution in the 6G/IOWN Era

2.1 European Union

In the European Union (EU), the development of digital identity products and standards is progressing, particularly in the development of legislation and provision of services.

2.1.1 Widespread use of electronic identification (eIDAS regulation)

In the EU, the eIDAS (Electronic Identification, Authentication and Trust Services)^*2 regulation has been introduced [2] to provide a framework that enables mutual authentication of electronic identification cards issued in different EU member countries (Fig. 1). This enables EU citizens to securely use digital services across borders. An update called eIDAS 2.0 proposes that users can manage their digital identity information and that this can be achieved through a wallet service called European Digital Identity Wallet. This update was officially approved in February 2024.

Fig. 1. Trends in the EU.

2.1.2 Introduction of electronic passports

Many EU member countries issue electronic passports, which hold digitized personal information using biometrics or RFID (radio frequency identifier) chips. This simplifies border crossings and the use of online services.

2.1.3 Expanding use of electronic identification

In many EU member countries, the use of eID (electronic identification) for tax reporting and administrative procedures has become commonplace. This enables individuals to securely identify themselves online and conduct transactions across national borders between EU member countries.

2.2 U.S.

In the U.S., the following trends in digital identity are occurring and attracting attention worldwide.

2.2.1 Promotion of digital identification

Digitalization of driver’s licenses and identification cards is progressing in each state. In some states, digital driver’s licenses are available through mobile apps, making online identification easier.

2.2.2 Introduction of digital health passport

The COVID-19 pandemic has increased the demand for digital health passports. In the U.S., efforts are underway to electronically manage and certify vaccination certificates and health status.

2.3 Japan

2.3.1 Spread of My Number cards

A My Number card is assigned to each citizen and resident, and each citizen/resident is required by law to have a personal number (My Number). This card can also be used online, enabling the use of various administrative services and electronic applications.

2.3.2 Spread of digital certificates

Digital certificates are widely used by companies and government agencies. They are used for digital signatures and online procedures and have legal validity. The shift from paper certificates to digital certificates is progressing with the use of digital signatures, electronic contracts, and anti-counterfeiting certificates for software.

These trends confirm that digital identities are becoming increasingly popular in Japan, their convenience is being recognized, and that digitalization of identities is progressing in various government services and in daily life.

3.1 Popularization of SSI

SSI is a concept that enables users to control their identities. This approach enables individuals to have their own digital identity, i.e., a personal identifier (ID) and associated personal information such as attribute information and various certificates, without depending on a central administrator or third party.

3.2 The rise of decentralized identity

A decentralized identifier (DID)^*3 is a form of digital identity that is managed by users, rather than by a centralized system [3]. It is often based on distributed ledger technology (DLT), such as blockchain, enables users to own and manage their data, and is an elemental technology for SSI. DIDs are becoming increasingly popular, with standards organizations such as the World Wide Web Consortium developing related standards.

3.3 Development of verifiable credentials

A verifiable credential (VC)^*4 is a mechanism to securely receive certificates and information issued by various institutions and services and to link them to one’s digital identity. For example, degree certificates, medical records, and membership cards can be issued as VCs and submitted to third parties when necessary. VCs enhance the system in which data ownership and privacy are managed by the users and are often used in conjunction with DIDs, which are also an elemental technology to actualize the concept of SSI.

As shown in Fig. 2, centralized identity providers (IdPs) had managed identity information and the data associated with it, and the transfer of data was provided from IdPs to the service providers that use the data. In distributed identity management, data are managed by the users and presented to the service providers they use. This is called decentralized identity management because user data are not collected in one place but managed by each user and is attracting attention as a method for promoting the distribution and utilization of digital identity information while preventing the leakage of user privacy information.

Fig. 2. Shift to decentralized identity management.

4.1 Publishing digital identity information

Network carriers, both mobile and fixed, play a variety of roles in the digital society. The provision of communication services, such as data communication and telephony, are the main services provided, and when providing these services, KYC (know your customer) and residence verification are conducted to ensure that communication services are provided to the right users without error. For users of telephone services, a telephone number is assigned, and the subscriber is guaranteed to be able to use that number. For cell phone users, communication services cannot be provided without knowing the location of the user; therefore, the location of the user must be known at all times as long as the user is in a place where communication is possible.

Contract information and information required for service provision are usually held and managed internally by the network carrier. Issuing this information in a reusable form to users and other service providers may add value to the network. For example, by issuing a VC as proof of possession of a phone number, it is possible to provide a highly reliable and verifiable certificate as contact information for the various services that currently require the input of contact information (Fig. 3). Not only phone numbers but any information presented to the network carrier when subscribing to a communication service can be issued and distributed as digital identity information of the user, which is verified by the network carrier. For example, when a user wants to withdraw money from a bank account at an automatic teller machine (ATM), it is possible to check whether the person operating the ATM is really at that location if the bank account and cell phone contract are linked in advance, making it possible to prevent a person other than the user from withdrawing money. This will make it possible to prevent the withdrawal of money by someone other than the authorized person.

Fig. 3. Identity issuance by network carrier.

GSMA (Global System for Mobile Communications Association) and other organizations have started discussing this kind of initiative [4], and the issuance of digital identity certificates by various network carriers is expected to accelerate. NTT Network Service Systems Laboratories will work on standardizing certificates that can be issued by various network carriers and demonstrate use cases using such certificates.

4.2 Secure ID Wallet

Digital identity information is managed by the user, and the user decides where and what to present. However, such information is important for both the user and service provider that uses it, and it is necessary to prevent data leakage, falsification, and unauthorized duplication, transfer, or other misuse by the user. Therefore, it is necessary to have a mechanism to protect data from attacks such as malicious software installed on the terminal where data are stored and data in the terminal’s wallet are stolen. It is also necessary to address the risk of data loss if a user loses their terminal.

NTT Network Service Systems Laboratories is developing the Secure ID Wallet, which provides a cloud-based wallet for storing digital identities equipped with a dedicated security module, as a countermeasure against these attacks and risks (Fig. 4). In the Secure ID Wallet, the wallet software is executed in an isolated execution environment on a server in the cloud using a hardware-implemented security module, such as a trusted execution environment (TEE)^*5, to protect the memory content during the process as well as protect the persistence of the content by encrypting persistent data (confidentiality). If the software that implements the wallet is modified, even if the memory and data are encrypted, the data can be leaked or tampered with. Therefore, the wallet uses remote attestation^*6, a mechanism that enables users to verify that the software has not been tampered with (integrity) from outside the system.

Fig. 4. Secure ID Wallet service.

Another important issue is to ensure security when presenting digital identity information from a wallet to an external service. In addition to anonymization and one-time disclosure of DIDs in the data to be presented, technologies, such as selective disclosure, in which only the minimum attributes necessary for service use are disclosed out of the multiple attributes described in the digital identity information to be disclosed, are being considered and standardized. These technologies are useful for avoiding risks such as user profiling by name-dropping by service providers and leakage of privacy information. However, privacy risk measures are incomplete unless measures are taken not only for the information contained in the data but also for endpoint information such as the URL (Uniform Resource Locator) and IP (Internet Protocol) address used to access the user’s wallet. NTT Network Service Systems Laboratories is developing a one-time endpoint method and VC presentation method for not disclosing endpoint addresses to external services as a countermeasure against name identification of endpoint addresses in user wallets.

To use the Secure ID Wallet more conveniently, we are also considering authentication linkage that enables secure and convenient connection to the Secure ID Wallet using information such as the authentication key recorded in the subscriber identity module (SIM) card inserted in the terminal owned by the user. We are also considering an integration function that works with other wallet services in anticipation of usage scenarios in which multiple wallets are used for different services.