BC: Blockchain
As we know , there are other technologies and companies looking for DI solution. Since many of them are popular technologies or huge company with significant investment, we should consider them as risks for our work. At least we have to be aware of what comes new via them to this ecosystem. So a classification is required.
1- Companies with centralized Identity on the way of decentralization (GAFAM)
Cloud identity refers to a set of technologies, protocols, and practices that enable managing and controlling user identities and access to digital resources in cloud-based environments.
It empowers organizations to securely authenticate, authorize, and manage user access across cloud services and applications. Cloud Identity leverages the power of the cloud to centralize identity management, simplify administration, enhance security, and improve user experience.[1]
Cloud Identity is an Identity as a Service (IDaaS) solution that centrally manages users and groups. You can configure Cloud Identity to federate identities between Google and other identity providers, such as Active Directory and Microsoft Entra ID (formerly Azure AD).[2]
Identity management, access controls, and governance are foundational security pillars for organizations of any size and type. As you migrate to and modernize on AWS, your security and IT teams can adopt modern cloud-native identity solutions and Zero Trust architectures to securely support hybrid workforce productivity, provide builders and customers access experiences with less friction, apply and audit permissions toward least privilege, and help meet stringent compliance mandates.[3]
Meta wants to raise the privacy bar higher by de-identifying users while still maintaining a form of authentication to protect users and our services. So, it leveraged the anonymous credential, collaboratively designed over the years between industry and academia, to create a core service called Anonymous Credential Service (ACS). ACS is a highly available, multitenant service that allows clients to authenticate in a de-identified manner. It enhances privacy and security while also being compute-conscious. ACS is one the newest additions to our privacy-enhancing technologies (PETs) portfolio and is currently in use across several high-volume use cases at Meta.
At a high level, anonymous credentials support de-identified authentication by splitting authentication into two phases — token issuance and de-identified authentication. In the token issuance phase, clients contact the server through an authenticated channel to send a token. The server signs and sends it back. Then, in the de-identified authentication (or token redemption) phase, clients use an anonymous channel to submit data and authenticate it utilizing a mutated form of this token rather than a user ID.
We’ve greatly simplified the nuances in the protocol. The signed token (token issuance phase) and redeemed token (de-identified authentication phase) cannot be linked. This property enables the server to authenticate the client in the second phase without knowing which specific client the token belongs to, thus preserving user privacy.[4]
Apple provides your organisation with various identity services to help you manage passwords and usernames securely — both across your workplace and in the cloud. Apple uses security measures like authentication, authorization and identity federation, so that individual users can access their favorite apps and other resources without, for example, the additional hardship of setting up usernames and passwords for each one.[5]
Apple uses Keychain App to protect sensitive data and can contain various types of data: passwords (for websites, FTP servers, SSH accounts, network shares, wireless networks, groupware applications, encrypted disk images), private keys, certificates, and secure notes. But pay attention that Keychain is not a blockchain-based App!
Microsoft has been actively involved in decentralized identity solutions. They have developed technologies like Decentralized Identifiers (DIDs) and verifiable credentials to enable self-sovereign and decentralized identity management. It has contributed to open-source projects like the Decentralized Identity Foundation (DIF) and is working on initiatives such as the Microsoft Authenticator app.
Microsoft Entra Verified ID Service is an issuance and verification service in Azure and a REST API for W3C Verifiable Credentials that are signed with the did:web method. They enable identity owners to generate, present, and verify claims. This forms the basis of trust between users of the systems.
2- Competing Technology
IBM: IBM is another company that has shown interest in decentralized identity. They have been involved in standardization efforts and have explored the use of distributed ledger technologies for decentralized identity solutions. It is including IBM Verify Credentials, which allows organizations to issue and verify digital credentials using blockchain technology. (Related BC: Hyperledger Fabric)
Evernym: Evernym company specializes in self-sovereign identity solutions and offers the Sovrin Network, an open-source decentralized identity network built on distributed ledger technology.(Sovrin has three networks for self-sovereign identity. Each network is based on Hyperledger Indy)
1Kosmos is a company that focuses on distributed identity solutions. They aim to provide secure and privacy-preserving identity management using decentralized technologies. BlockID is A distributed identity cloud service that unifies identity verification and passwordless authentication. 1Kosmos BlockID is a fully standards-based platform for complete user authentication. BlockID takes the strengths of decentralized identities, and adds layers of security, user biometrics, and hardware-backed YubiKey authentication to effectively protect access to systems. It is a certified solution for NIST 800.63.3, UK DIATF, FIDO2, iBeta DEA EPCS, ISO 27001 and SOC II. Compliant to GDPR standards. [6][7]
FIDO Alliance
The FIDO ("Fast IDentity Online") Alliance is an open industry association whose stated mission is to develop and promote authentication standards that "help reduce the world’s over-reliance on passwords". FIDO addresses the lack of interoperability among devices that use strong authentication and reduces the problems users face creating and remembering multiple usernames and passwords.
FIDO supports a full range of authentication technologies, including biometrics such as fingerprint and iris scanners, voice and facial recognition, as well as existing solutions and communications standards, such as Trusted Platform Modules (TPM), USB security tokens, embedded Secure Elements (eSE), smart cards, and near-field communication (NFC)
3-Marketing
This means that often, digital identity services take much longer to scale than originally planned. Without sufficiently attractive and useful services onboard, the case for signing up may not be clear to citizens, and without sufficient volumes of verified users, service teams may not see the value in the identity service, and may wait for growth. Without sufficient uptake, for new services, the work required to make services truly self-service based on the trust in the identity, can be harder to justify. [9]
4- Environmental cost
5- Funding: A particular scarcity risk, due to lack of funding.
References:
[1] https://www.loginradius.com/blog/identity/what-is-cloud-identity-and-its-benefits/
[2] https://cloud.google.com/identity/docs/overview
[3] https://aws.amazon.com/identity/
[4] https://engineering.fb.com/2022/03/30/security/de-identified-authentication-at-scale/
[5] https://support.apple.com/en-ie/guide/deployment/depa64848f3a/web
[7] https://www.yubico.com/works-with-yubikey/catalog/1kosmos-blockid/
[8] Travel Identity of the Future—White Paper; Technical Report; ShoCard: Cupertino, CA, USA, 2016
[9] How to control your biggest risks in digital identity