A DID (Decentralized Identifier) for Everything DIDs as Unified Identifiers Zero-Trust Computing Inverted Computing Architectures dDID (derived-DID)
DADI (Decentralized Autonomic Data item) ededan o ‘https:ligithub.com/SmithSamuelM/Papers
Early 2015 began designing decentralized reputation systems with data and algorithm provenance.
Needed decentralized identity infrastructure (2016+) hitpsifgithub.com/SmithSamuelJPapersfbloblmasterfwhitepapersfidentity-System Essentials.pdf
Which led to decentralized identifiers (DIDs) (W3C) (2016+)
hitpsilwac.ceg.github lofdid-spect itps:ljwsc.ccg githublofdid primer)
httpsifidentity.foundation (68 Organizations) httpsiliwww.hyperledger.orgiprojects Indy Aries Ursa
Followed by verifiable credentials (VCs) (W3C) (2017+)
ttpsifew.w3.orgTRive data-model
Combined with zero-trust computing (2017+) hitpsilgithub.com/SmithSamuelM/Papers/bloblmasterfwhitepapers/ManyCubed.pdf
Which led to decentralized autonomic data (DAD) (2018+)
(RWOT6)
Which resulted in data flow chains with data & algorithm provenance (2018+) htps:/igithub.com/SmithSamuelM/Papers/blobjmaster/whitepapers(A_DID_for_everything,pdf (RWOT7)
Distributed and Decentralized Computing Systems distributed = computation happens at multiple sites non-distributed = computation happens at one site distributed distributed centralized = computation controlled by a single entity contalzad decentralized decentralized = computation controlled by more than one entity computing system may be some combination of centralized . (decentralized) and distributed (non-distributed). 52 decentralization may occur to a degree. § 4 system decentralization may lie on a spectrum of strongly 1 decentralized to weakly decentralized. non-distributed non-distributed centralized decentralized Number of Controlling Entities Decentralization
https: //wic-ccg.github. i0/did-spec/ Scheme - did:example:123456789abcdefghijk s DID Method DID Method Specific String did: method: idstring did:dad:Xq5Yqal6L48pfefu7IUhL@IRaU2_RxFPOAL43wYn148= did:dad:Xq5Yqal6L48pfefu7IUhL@IRaU2_RxFPOAL43wYn148=:blue did:dad:Xq5Yqal6L48pf@fu7IUhL@IRaU2_RxFPOAL43wYn148=?who=me did:dad:Xq5Yqal6L48pfefu7IUhL@IRaU2_RXFPOAL43wYn148=:blue/my/stuff?name=sam#/foo/@ DDo = DID Document. Resolver lookup provides meta-data about DID.
Decentralized Distributed Data Streaming Applications Decentralized = controlled by multiple entities
Distributed = spread across multiple compute nodes
Maintain provenance (chain-of-custody) for distributed data under decentralized control undergoing various processing stages that follows perimeter-less diffuse trust (zero-trust) security principles.
Zero-Trust Computing? Resources: NIST: Developing a Framework to Improve Critical Infrastructure Cybersecurity 04/08/2013 Zero Trust Model for Information Security, Forrester Research. https:/fwww.nist.govicyberframework Zero Trust Networks 2017 Gilman & Barth https:/www.amazon.com/Zero-Trust-Networks-Building-Untrusted/dp/1491962194/ref=sr_1_1? s=books&ie=UTF8&qid=1499871379&sr=118keywords=zerostrustnetworks
Never trust always verify No such thing as zero trust Really its diffuse trust when verified Diffuse trust perimeter-less security model
: Security Models Locality Trust Yy Zero Trust Hard shells around Soft bodies Hard bodies everywhere Remore Remte Untnsted | Internet Tusted femole emole e Gient Untusted Tusted £ Tent [ Lol eI ouz Bl Internet Hopiction Ptz e Gateway Sner | Trusted Sener Hoplcaton Sever 3 Sever Tanert gy Server Privileged Fopment Server Sener
Diffuse trust perimeter-less security principles: 1 The network is always hostile both internally and externally. Locality is not trustworthy.
Diffuse trust perimeter-less security principles: 2 By default, inter-host communication must be end-to-end signed/ encrypted and data must be stored signed/encrypted using best practices cryptography. Data is signed/encrypted in motion & at rest.
Diffuse trust perimeter-less security principles: 3 By default, every network interaction or data flow must be authenticated and authorized using best practices cryptography. Verify every time for every thing.
Diffuse trust perimeter-less security principles: 4 Policies for authentication and authorization must be dynamically modified based on behavior (reputation).
Behavioral verification rules.
Diffuse trust perimeter-less security principles: 5 Policies must be governed by diffuse-trust distributed consensus. Decentralized control.
Diffuse trust perimeter-less security principles: 6 By default, each data flow including all transformations must be end-to-end provenanced using decentralized identifiers (DIDs) and hence decentralized autonomic data items (DADis). Dadify everything.
Diffuse trust perimeter-less security principles Locality is not trustworthy. Data is signed/encrypted/provenanced in motion & at rest. Verify every time for every thing. Behavioral verification rules. Decentralized control. Dadify everything.
DID = UNIFIED IDENTIFIER: 1
UUID: Universally Unique Identifier RFC 4122: UUID type1-5 ‘9866eb78-1376-11€9-babs-58ef68134€82" 16 byte collision resistant decentralized identifier generated with random number generator and optional name spacing data. Enables distributed applications to create unique identifiers without central authority Prefixed hame spacing allows for sorting and searching properties such as:
time order, lexical order, nesting etc.
DID = UNIFIED IDENTIFIER: 2 URI: Uniform Resource Identifier, URI: Uniform Resource Locator, URN: Uniform Resource Name RFC 3986 scheme: [//[user[ :password] € host[:port]][/path][?query][#£ragment] Enables specifying derived resources from central root. Mini language for performing operations on resources (ReST).
DID = UNIFIED IDENTIFIER: 3 Decentralized Self-Certifying Identifier: Contains fingerprint of public member of cryptographic public/private key pair. Key pair is generated by user not central registry. ‘http:/lwww.sigops.orglewhistory/1998/papers/mazieres.ps 1998 https://pdos.csail mit.edu/~kaminsky/sfs-http.ps 1999 Enables decentralized self-sovereignty over identifier namespace Control over namespace proven via signed assertion Truly portable identifiers If identifier is not portable then associated data and derived value is not portable
DID = UNIFIED IDENTIFIER: 4 Hierarchically Deterministic Derived Self-Certifying Identifier: selfcertroot:/path/to/related/data?derivation=parent/child/child/child Enables low friction creation of identifiers on demand without having to store private keys
DID = UNIFIED IDENTIFIER: 5 Public lookup services for identifier(s) to find meta-data associated with identifier. Resolvable identifier meta data. Public decentralized resolvers. Enables dynamic modification of identifier behavior and control
DID = UNIFIED IDENTIFIER: 6 Tupleizable (routable) Identifiers: Jchannelfhost/process/data = (channel, host, process, data) Enables data flow routing overlay for distributed data processing systems.
Decentralized Identifiers Invert Compute Architectures Conventional (centralized): Unconventional (decentralized): Server creates identifiers (GUID, Database primary keys) Client creates identifiers (DIDs) Server timestamps. Client timestamps Event ordering relative to server Event ordering relative to client or Server manages keys, vectorized relative to multiple clients or AuthN/AuthZ is indirect via client to server proxy consensual relative to distributed ledger Perimeter security around servers Client manages keys Server is source of truth AuthNJAuthZ is direct peer-to-peer Server controls changes/updates to resources Perimeter-less security around clients Signed at rest problematic Client is source of truth Encrypted at rest problematic Client controls changes/updates to resources Server's role s and party in two-party transactions Server cannot make changes between client to server and server to client. Client signs at rest Client encrypts at rest Server’s role is either: Trusted 3rd party in multi-party transactions between 2 (or more) clients and server as client Agent or proxy for a client in two party transaction with another client.
DAD: Decentralized Autonomic Data Decentralized: DID based. Governance of the data may reside with multiple parties. Trust in provenance is diffuse.
Autonomic: Self-managing or self-governing. Self-managing includes cryptographic techniques that make the data self-identifying, self-certifying, and self-securing. Implies the use of cryptographic signatures as the root of trust and to maintain that trust over transformations of that data and its control. Key management is thus a first order property of DAD. 3-Rs = Reproduction, Rotation, and Recovery:
Pre-rotation & Hybrid recovery methods.
Provenance for decentralized distributed data streaming including transformations DADi: DAD item
Minimally Sufficient Means Streaming data applications may impose significant performance demands on the processing of the associated data. Desire efficient mechanisms for providing the autonomic properties of DAD.
DID, DDO, DADi, and dDID DID = Decentralized Identifier DDo = DID Document, resolver supplied meta-data about DID. DADI = Decentralized Autonomic Data Item Issues: Managing meta-data, control, and keys for many DADis DDo lookup and caching may be expensive DID/DDo pair per DADi may not be practical dDID (derived DID) = Many unique identifiers derived from one root DID One root DID/DDo provides meta-data for many dDIDs (HD Keychain) did:dad:Xq5YqalL6L48pf@fu7IUhL@IRaU2_RxFPOAL4A3wYn148=:blue?chain=0/1 did:dad:Qt27fThWoNZsa88VrTkep6H-4HA8tr54sHON1VW16FE=
Reproduction did:dad:Xq5Yqal6L48pfofu7IUhL@IRaU2_RxFPOALA3WYn148=?chain=0\1\2 did:dad:Qt27fThWoNZsa88VrTkep6H-4HABtr54sHONIVW16FE= Simple privacy via unique cryptonym (dDID) per pair-wise relationship Simple approach to generating large numbers of public dDIDS without having to store the associated private keys.
Only store the root private key Minimally sufficient relative to more sophisticated methods such as zero knowledge proofs.