TELL US ABOUT YOURSELF
Since 2013, I have been researching issues around digital identity and trust at the Fraunhofer IAO in the Team Identity Management and I am located in Berlin, Germany. The Fraunhofer Institute for Industrial Engineering IAO works together with companies, public-sector bodies, and institutions to develop strategies, business models, and solutions for digital transformation.
In my research, I take on a socioeconomic and user-oriented perspective. My area of research involves identity management, IT-security, privacy, and blockchain/DLT. These areas are important for building trustable ecosystems.
Before my work at Fraunhofer, I studied politics and administrative science as well as management. I received a Ph.D. in economics at the Georg August University in Göttingen.
Currently, the TRAIN project that I am a part off is being supported by NGI eSSIF-Lab. Prior to this, I worked on several other European and national-funded projects, including LIGHTTest, FutureID, ONCE, ENTOURAGE, and SkIDentity.
What problem does TRAIN project solve?
Self-sovereign identity (SSI) technology is said to bring a bright future for digital identity management. There is a lot of research and testing on SSI-powered technology to ensure trustworthiness and safety for all participants.
TRAIN focuses on the trust challenge of SSI from the perspective of the verifier of credentials. Verifiable credentials (VCs) are standardised, digital certificates that make it easy to share information online in a private and secure way. Deciding which VCs are exchanged across all European digital wallets is an important user-controlled promise of SSI because it enables trust.
The aim of TRAIN is to establish a root of trust in an open ecosystem through trust registries. Trust registries offer a way for these parties to utilise the benefits of this network but also provide means for them to build their own trust network on top of the open system. Trust Registries are one of the critical components of machine-readable governance frameworks. Through this component, holders can avoid coercion by verifying the verifier; verifiers can discern offline which issuers they trust; issuers can communicate to holders which governance framework they are associated with. It will lead to additional safety and confidence for all participants.
Certain institutions can publish the trust schemes they use to compile and publish lists of trusted issuers (trust lists). These could be industry sectors (e.g. an organisation of European banks) and non-profit or governmental organisations. Basically, anyone can publish trust lists, but the service providers (verifiers) using the system can decide which trust list for issuers they deem practical for their domain of trust.
The TRAIN approach has several advantages. It follows a decentral path that suits the SSI procedure. The final trust decision remains with the verifiers that can decide whether to rely on other authorities to support them transparently. Central gatekeepers are avoided and everyone is still able to issue credentials, just as everyone can easily publish their trust lists as Trust Scheme Publication Authorities (TSPAs).
While allowing for this, TRAIN introduces a transparent and trustable infrastructure that supports participants of the SSI ecosystem to define which issuers they deem trustable. Verifiers are supported in setting up self-defined trust policies that define certain credentials that are issued by specific entities that are incorporated in specific trust lists. TRAIN adds a flexible trust layer to SSI, enables scalable and automated trust management, and is fully in line with the open and decentral SSI approach.
How did NGI support your project?
TRAIN is based on the work of the EU H2020 research project LIGHTest. LIGHTest ended in 2019 and developed a generic infrastructure for trust management based on DNS as a root of trust. This overall architecture had been evaluated and was successful in the first number of pilots. TRAIN picked up the concepts of LIGHTest and developed these further for the specific context of SSI applications.
NGI eSSIF-Lab allowed us to connect to other actors in the SSI ecosystem and learn about their specific requirements and challenges. Hence, NGI eSSIF-Lab didn’t only provide us with funding that was needed for additional development work but to connect to relevant SSI actors and so allowed us to integrate TRAIN into the SSI standards, for example, regarding the Levels of Assurance (LoA) behind certain credentials, allow for automated decision-making and ease the handling of trustable credentials from different issuers.
What are your next steps?
We are currently working in various structures on the extension and standardisation of the first results that have been produced thanks to the NGI eSSIF-Lab funding. One is the Trust over IP Foundation (ToIP), which has committed itself to building a holistic architecture for digital trust on the Internet. Here, we are contributing to the trust registry specification working group. Next
Then, the OpenID Foundation is enhancing the OpenID Connect for Verifiable Presentations (OIDC) protocol to support W3C verifiable credentials (VCs) and decentralised identifiers (DIDs). OpenID Connect is being enhanced to transfer presentation definitions from the verifier to the holder and verifiable presentations from holders to verifiers. implementation guidelines describing how issuers, holders, and verifiers can utilise the TRAIN trust scheme approach.