Sign Arkansas Banking Business Letter Template Mobile

Industry sign banking arkansas business letter template mobile

everyone I'm very glad to be presenting here at this premiere identity event today we weren't looking forward to this event happening in Toronto but with the circumstances obviously it's not to turn online but it's been quite awesome to do these online events and we've gone through this with our own webinars that we've been running and we're actually you we're seeing people from all over the world that are coming and they're interested in the stuff that so that we're talking about so it's been awesome to really expand our reach and you know we're all about community we're all about learning and researching and sharing what we know when talking about what we're passionate about so it's been quite nice to connect with people all over the globe so welcome wherever you're from today and I'm very glad that you could be part of this event my name is Matt cirglod I'm the founder and CEO of northern blog so where to Ragno based technology service company and we're focused on solving problems using the centralized identities and blockchains and so my presentation today is titled using verifiable credentials for access management now access management is a massive industry like I'm sure most of you know and a cover is both digital and the physical realms and the organization's tend to often use many access management systems internally all across the businesses so it's a normal practice to use many different applications because many of them are built for specific use cases so they solve specific problems however having all of these systems throughout the business does add some complexity and risk to synchronizing all of the systems together and whenever problems arise massive deep dives our audits are required to really understand what happened so I want to explore with you today how verifiable credentials which are a standard for expressing and exchanging claims which are verified by third parties can be used for access management there's a lot of benefits through it no viable credentials have been gaining a lot of acceptance in traction so for those who don't know there they were developed and they're becoming an evolving standard within the World Wide Web Consortium so we started off in the blockchain space in 2017 we've worked on a multitude of enterprise trading systems that use blockchain and we've recently made some investments into self sovereign identity realizing that it solves many problems with our existing solutions so the existing decentralized solutions that we're building could really benefit from it but it also opens up a multitude of benefits beyond the centralized solutions for people organizations and societies as a whole and so our first digital identity project was a perfect concept we did with the Ontario government that showcased how a blockchain can be used to give citizens of Ontario back control of their personal information but kind of got us thinking about the centralized identities but then late last year we officially crossed paths with the soul fire and identity community after we took on a project that facilitate private firearm transfers in the US so we really realized the importance of preserving privacy for firearm owners and it got as deep into the full SSI stack which really excited us and what really excited us was that the underlying technology of self sovereign identity is ready for early adoptions by businesses so we're at kind of an inflection point right now we're currently working on two implementations of self harm and identity you had verified low credentials which is a big piece of self solving identity the first one I just mentioned which is the BSC one was very transfer and then the second one with very vexed is more of a b2b business case that uses verifiable credentials to onboard businesses to a decentralized ecosystem for aerospace parts just the about our association so we joined the Dayak earlier this year really to help bridge real world policy and governance to the solutions themselves that we're building we also joined the trust O'Reilly Foundation as a founding member to contribute towards the advancement to the four-layered governments and technical sack and which we'll cover a little bit later in this presentation but also remember the open Digital Trust working group as part of the Institute of International Finance and to give back to our local community and push forward as a society option and we founded as a site to run over this February and so for those who are interested we have an event coming up next week on June 24th where we'll be focusing on use cases of self serving identity for b2b transactions and we have some great guests from very tax our clients in the aerospace and defense sector and we also have representation from the University of Arkansas who are also members of the Tres over IP and they're doing a lot of cool stuff with both SSI and blockchain so you can find out more info about this through the northern block website twitter accounts or just by googling a society around them so let's start with an introduction to verifiable credentials like really a core innovation that will lead us to think a bit differently about access management we like to use stories to explain these concepts because you know we think stories are just a great way to explain concepts that seem complicated or jargon sometimes so let's get into it let's meet Jimmy so Jimmy is about to start a new job at a company in Toronto so Jimmy just moved to Toronto from Vancouver before his job start date and find a good deal on an apartment rental so should we contacted the real estate broker had a good initial conversation we're done and the broker will now need you need to provide certain information so that they could assess his eligibility before renting the unit to him so Jimmy is being asked to provide his legal name and age which could be found on a piece of government ID Jimmy's being asked to provide a proof of him being employed as in a signed letter of employment from deployer and proof of sufficient showing his enough money for at least half a year's rent so Jimmy has a valid driver's license from back home in British Columbia which does contain his legal name and his age and like most Jimmy he carries this card with him in his wallet however Jimmy doesn't have anything on him to prove that he's employed or that he has sufficient funds so he's going to need to go get those so to get the proof of employment Jimmy goes to the office to ask the HR manager for a letter of employment so at the office the HR manager prints out an official company letter for Jimmy and this letter indicates his start date and his position with the company so Jimmy takes the letter stores it in his beautiful paper folder and leaves the office so now to get the parental funds Jimmy needs to go to the bank or he just opened up a new account so at the bank I represented and prints a statement Virginia that displays his bike balance within his checking account so Jimmy takes the paper statement stores it in the same beautiful paper folder and leaves the bank now that Jimmy has everything he needs he goes to the broker presents the original copies of his driver's license employment letter and banking statement and the broker verifies the original documents makes photocopies of each of them for their records and now satisfied with the documents the broker tells Jimmy they'll need a couple of days to process everything and they'll call him call Jimmy back when they're done so Jimmy goes back home with his documents leaving the photocopies with the broker so two days later Jimmy gets a phone call from the broker who says you know what everything checked out and we'd love to rent the apartment to you so Jimmy goes back to the brokers office to sign a rental agreement so he gets a copy of the fully executed agreement while the broker keeps a copy for themselves which they just keep alongside Jimmy's other documents and they're their folder so Jimmy puts the copy of the agreement in the same folder with his bank statement which will throw him through a drawer in his desk and that's time a lot of things are done today let's see how this could be different like the same scenario how we can do this a little differently with self-serving identity and verifiable credentials in the mix so many things would stay similar with us aside but much better as you'll see so Jimmy would still have a wallet when he set up a physical one you would have a digital self sovereign identity wallet on his smartphone instead of a physical copy of his driver's license Jimmy's driver's license would be in his SSI wallet in a digital format instead of getting a printed copy of his employment letter Jimmy could ask his HR manager to send a digital copy directly to his wallet so that he didn't have to go to the office himself and you know what he didn't have to sort of print out afterwards either now Jimmy would make the exact same type of request to his bank for the bank statement the bank would issue to the bank statement in a digital format right into his wallet alongside the other pieces of information that he's been storing there so knowing Jimmy has everything needed the real estate broker could send Jimmy a proof request and really this in the real world could all be done in an automated fashion so Jimmy could just self-serve on a website for example to initiate this process so a proof request is sent to Jimmy upon receiving the request a notification would pop up in Jimmy's wallet so the detailed information is shown here in the blue box the real estate broker is not really expecting to receive complete paper credentials or documents that contain pieces of information but instead only the information itself at a minimum level so knowing here's all the information and being comfortable sharing it with the real estate broker Jimmy accepts the request so the broker would then immediately received information on their end so after receiving Jimmy's information that proves his eligibility to rent out the apartment the broker would happily decide to rent it to him so the broker executes the rental agreement signature on their end and then sends the agreement directly to Jimmy's SSI wallet so Jimmy refused the agreement inside his wallet and accepts it by signing with his digital signature so then the fully executed agreement will be stored in Jimmy's wallet again alongside all these other documents in his possession the broker would have the same agreement in their system alongside the very limited information at this point that they have about June they don't have photocopies of all these documents they have very limited information as seen here in the gray box that's it simple is it so how does the real estate broker know if the information Jimmy provides through his SSI wallet is valid and trustworthy good question so some sovereign identity enables a new model called the verifiable credential model or here the verifiable credential trust triangle which makes what this very simple process we saw possible so no matter what type of credential this triangle involves the same three primary roles so the first one are the issuers which are the source of these credentials so every credential has to have an issuer of the credential most issuers will be organizations or government agencies that could issue things like passports or financial institutions for example which could issue credit cards or statements like we just saw in jimmy's example and so forth holders will be the ones that request credentials from issuers and they'll hold them in their wallets and then they could use these credentials and present them when being requested by their buyers so although we commonly think of individuals as holders holders could also be organizations or even things such as an IOT device and the third one the verifier on the right verify it could be anyone seeking trust assurance such some kind about the holder of a credential severe fires request the credentials they need and then follow their own policy to verify their authenticity and validity so in the example we just went through the issuer is where the company that Jimmy is employed with and the financial institution that he banks with the holder is Jimmy himself and the verifier in this case was the real estate broker so these three groups are all using systems enabled by a and SSI infrastructure such as the wallet that Jimmy has would be enabled by this SSI infrastructure so using some sovereign identity an issuer could sign an issue credentials did the holder the holder that presents them when being requested by a verifier and there's a key difference here between proofs and verifiable credentials whereas proofs contains certain pieces of information that could come from different verifiable credentials such as from the driver's license an employment letter or a bank statement also the information in a proof doesn't necessarily need to actually contain the values from a verifiable credential which is interesting so information exchange could be done in a way more private way and we call this a zero knowledge proof by H a holder or only needs to present the minimum amount of information a verifier needs so in Jimmy's case not necessarily his full driver's license already even his age only if he's over 18 or not so the infrastructure there is powered by at blocking certain information of the issuer is written to the marching so that when a verifier receives a crew they'll be able to query the blockchain to find out four things one who issued which piece of information - if the information was actually issued to the holder themselves three if the information was altered or changed by the holder in between hundred and four if the information is still valid upon receipt so as the sign Abel's a trust over IP stack since the trust is built right into the system here and for that reason there's no need for integration between the issuer and the verifier it's a decentralized architecture so it doesn't need to be any integration between the issue and the verifier as long as their systems are compatible with this trust over IP infrastructure it's a little more on the stress over IP because it's really a crucial part to this whole model so last month northern bloc and 28 other founding member organization launched the trust over IP foundation which is a new project hosted within the Linux Foundation and with a goal to enable the trustworthy exchange and verification of data between any two parties on the internet so we're really grateful and honored to have this opportunity to contribute to the trust over IP foundation and it's awesome to work alongside best-in-class industry and identity people to bring this noble scale trust to the Internet so the vision we all share is embodied in the trust over IP stack a dual stack design so directly acknowledges that Trust is an outcome of how we as humans organize ourselves and the technology we use to convey information between ourselves so we placed governance here on the left and orange so in other words implementing trust over IP based solutions should begin with business requirements then move to policy requirements transparently communicated in governance frameworks only then should you choose the technology components required to implement those policies so governance is quite important here and which is why it's placed in front and Technology so to quickly explain this stack I'm starting with the bottom layer layer one although Technical Trust is machine to machine implementing technical trust still requires humans to design code test and certify these systems so this is the job of layer 1 utility governance so the utility governance frameworks that specify the policies under which a utility in our example we were using a blockchain is implemented and operated such that it could be trusted by the higher levels on top so layer 1 is about this strong cryptographic roots of technical trust so the roots of trust and then layer 2 is about the branches it's a live digital wallets the digital agents all these things needed to secure and perform secure peer-to-peer connections using either public identifiers or peer-to-peer identifiers so layers 3 and 4 where human trust is established and maint ined so on the technical side of the stack layer 3 is the home of this verifiable credential trust triangle that we just discussed which in this design here is laid out flat flat process it makes a little more clear that there's no need for a relationship to happen between the verifier and the issuer to trust the credentials being presented it's almost any digital credential that will be issued by multiple issuers or accepted by a wide range of bear fires needs a credential governance framework so the governance framework defines what issuers will issue what credentials under what policies to what holders with what levels of assurance and so forth and then finally layer 4 is specifically designed to enable digital trust ecosystems so entire families of applications and credentials that are not only to not only designed to interoperate technically but which share common ecosystem governance framework so using verifiable credentials for access management so in the Jinni what we went over Jimmy was able to use their final credentials to authenticate himself and then for the real-estate broker to authorize him to take lease of the apartment so now in the enterprise world access management is very costly in complex thing to manage and company's focus on parameter definition to put in security measures and policies right then parameters are becoming harder and harder to manage so we're seeing a lot of CIOs and CSI oh is leadership organization spending a lot of time and money to manage risk around access management of their parameters so security isn't limited to four walls of an organization it needs to cover an ecosystem and the same thing can be said about assets assets aren't sitting within the four walls in the organization either so information security needs to manage security across all these various components so applications could be sitting on premise it could be a private cloud and partner apps and public clouds and SAS apps and enterprise could have various ecosystems of contractors vendors suppliers partners customers employees require various accesses based on many many different factors applications could be accessed through enterprise computers and enterprise issued devices but also through public computers public devices IOT devices and physical access is typically not part of a convergent security strategy alongside digital and business continuity but physical access management is a massive thing as well so the way the native people manage these accesses are typically through the role-based access control method so role based access control has been the most common way that organizations have bucketed groups of employees vendors customers to specific rights and privileges and this method is typically managed within the four walls of an organization so you could see here the organization has walls around the process for a quick definition so is all based on the identity of a user or subject on the left they're requesting execution of the capability to perform an operation such as read an object or resource which could be a file so this is done neither directly or through predefined attribute types such as rural groups assigned to that user so using this method the organizations are required to spend lots of effort defining the parameters and ensuring they're protecting everything within those four Long's so ultimately in role based access control we don't think it's a scalable model for the open ecosystems and we'll see why in the upcoming slides so second method for access management this is attribute based access control so in this method the subject requests to perform operations on objects and is granted or denied access based on different things but based on assigned attributes of the subject assigned the attributes of the object on the other side or by incorporating environmental conditions or context into the decisioning so attribute based access control enables precise access control so the lies for a higher number of discrete inputs and to the access control decision that provides a bigger set of possible combinations of those variables to reflect the larger and more definitive set but possible rules to express policies so it's much larger than the role based access control method so the access control policies that can be implemented the in attribute based access control are limited only really by the computational language and the richness of the available attributes so the flexibility here enables a greater breadth of subjects to access the greater breadth of objects without specifying individual relationships between each other and each object so rule base whereas role based access and doesn't really support multi-factor decisions and really trying to do so relates the roll explosion and complexity and risk so under attributes based access control access decisions between requests by simply changing attribute values so we helped we need to change the subject or object relationships defining underlying rule sets so provides a way in more dynamic access control management capability and it really limits long term maintenance requirements of object protections so that's another problem with role based access control models is that if the access control requirements are changed they may be difficult to identify all the places where the world based implementations need to be updated and the last point here quick deployments of new policies so an X attribute based access control enables object owners or administrators to apply access control policy without having prior knowledge of the specific subjects and for an unlimited number of subjects that might require access so as new subjects join the organization or are required to gain access rules and objects do not need to be modified unlike with the role-based access control so now your affordable credential based access control you got all of the acronyms here we keep adding them it's a lot like attribute based access control however the attributes are replaced with verifiable credentials and for simplicity in this example we'll just drop the external conditions and context so with verifiable credentials we also don't need to necessarily have a walled garden because the organization doesn't really need to be defining the parameter of trust is built in right into the credential exchange ecosystem and lastly and quite importantly the verifiable credentials they come from multiple issuers right which is a major innovation here so all of a sudden we have all the benefits of attribute based access control but with the portability of credentials beyond an organization's four walls so it enables quick and secure collaboration across and enterprises boundaries so we really see this model having its roots within organizations that are geographically distributed and/or have highly mobile workforce which we're seeing more and more today it seems like a big trend another common scenario we see immediate value for this model is with an enterprise that has a lot of on-site visitors and contract service providers while requiring limited access to enterprise resources to do their work and remember in this exemplar this model could be implemented across both digital and physical realms so verifiable credential based access control is a great solution for news cases around bring your own ID as well so it becomes really powerful then it enables organizations that share security risks mabel's organizations to lower maintenance costs and strengthen their access and authorization decisioning through a lot more inputs trusted inputs and the ability to make real-time adjustments without causing a lot of overhead so that's it for my presentation thank you once again to the whole identity Northey of organizing this fabulous digital conference it's a phenomenal event and if anyone has any thoughts or questions feel free to reach out to me directly through email or Twitter or just throw any northern bloc channel online