Papers

A DID for Everything Attribution, Verification and Provenance for Entities and Data Items 5 white paper from Rebooting the Web of Trust VIl by Shaun Conway, Andrew Hughes, Moses Ma, Jack Poole, Martin Riedel, Samuel M. Smith Ph.D., and Carsten Stécker Keywords: decentralized identity, Internet of Things, autonomic data, verified claims, identity, blockchain, self- sovera o computing, indety 4.0, el tening, dt chain rovenance, ouit trals ABSTRACT The decentralized identifier (DID) is a new and open standard type of globally unique identifier that offers a el for feti-so0p portablo digtaldeniy that doc ot dspnd o any cntalsd auheriy an that can never be taken away by third-parties [14]. DIDs are supported by the W3C community [14] and the Decentralized Identity Foundation (DIF) |16]. They are the "atomic units" of a new layer of decentralized identity infrastructure. However, DIDs can be extended from identifiers for people to any entity, thus identifying coerying. W can s DIDs o bl us dntilyend manag oblets, machine, o gonts rough thet digtal g o can oxpan them o otions, o vent,and oven o pur o abjcs,whic s rlr 00 decentralized autonomic data (DAD) items [1][3]. ‘The paper will present novel use-cases for DIDs and DADs and propose a new cryptographic data structure that . . H 202 b (9> CIVIC g Protocol <52 SOVITIN N Labs PED " = " PTBVENTURES EX QP us interlinked nap e [ 1] . = TIERION mm Microsoft Sponsors for the Rebooting the Web of Trust VIl Design Workshop o A DID for Bveryting 10 .

s a self.contained blockchain of DADs. This enables the verification of the provenance of a given data fiow. It builds on a prior paper [1] and an associated reading [2] DIDs are only the base layer of decentralized identity infrastructure. The next higher layer (where most of the value is wnlocked) is verifisble claims. This is the techuical term for a digitally signed electronic data structure that conforms 0 the interoperability standards being developed by the W3C Verifiable Credentials Working Group [15]. When a DID and henee DADS of the resultant data are extended to machines and autonomic data. the provenance chain of the data flow cun provide the basis for verifiable claims and attestations about the data flow as well as the besis for a reputation. WHY THIS MATTERS Today, the Internet is probably best described as » network comprised of all interconnected entities, traditionally referring to human users and computers. When we add connected entities and deviees in the so-called Tnternet of Things (ToT), the number of addressable elements s in the tens of billions, with an estimate of 75 b connected 10T devices in 2025 [4]. Software services, such as algorithms and bots, further extend this universe of identifiable entities, The resulting combinatorics of possible connections betwoen any given sat of entities is an impossibly largo mumber. Yet in today's user journeys or business environments, agents (whether human, machine, or software) increasingly need to communicate, sccess or transact with a diverse group of these interconnected objects to achiove their goals in both the digital and physical worlds. This requires a straightforward and ubiquitos method to address, verify, and connect, these clements togother. Deinition of ntitye Something that has a distinct and independent existence cither in tho real or the digital world. Examples of an entity are:

= Living Organism

• Physical Object

• Locations or Bents

“ Machines and Devices in the Internet. of Things (IoT)

• Digital Asset, Data Set, or Agent Human or object identities are stored in multiple centralised or federated systems such as government, ERP, loT, o manufucturing systems. From the standpoint of eryptographic trush verification, each of these centralised authoritios serves as its own root of trust, Au entity trailing along a value chain is interacting with multiple systems. Consequently, a new actor in any given value chain has no method to independently verily credentials of a huma

n or attributes of either a physical object or data item (provenance, audit trail). This results in the existence of complex validation, quality inspection, and paper trail processes, and cnormous hidden. trust overkead costs are added to all value chains and services. 0719 ADID for Exerything 1.0 2

To be a truly global solution, easy to e and still safe from hacking and sovereign interforcnce, such a scheme mast include;

« preservation of privacy

• security from tempering

• reliable trust verification

« assuranco of risk

« independence from any vendor-defined naming APT

• one-to-one mappable onto each entity. Therefore, a universal addressing, trust-verification system and associated interoperable protocol must be utilised, empovering every form of entity Why it Matters for People Today when entitics want. their identities to be confirmed they transfer information such as a birth cortficate, physical address, or social security mumber to multiple third parties, who start to validate the same data in different contexts for KYC and authentication processes. “The parties to which they sent that information retains it, meaning the data is out there in silos, creating risks in terms of data loss, privacy broaches, and use of inconsistont data and forcing companics that might not want to bein that position to store that information. Tt also enables businesses to harvest people's personal data for commercial purposes, which does not necessarily reflect the intentions of the individual people. ‘This situation results in big problems for hurmans such as broken health care records. Patients will need a universally addressable healthcare record system that is controlled by the patient itself, that consistently stores all relevant verified health care data, and that is able to share this data with doctors that need to connect with it. To enable tho doctors or algorithms, they need a data-flow provenanco to verify the integrity, quality, or roputation of a healtheare record to decide on treatments and give the patient confidence abont the proposed treatments. Why it Matters for Businesses Deinition of Digital Twin: A digital twin is a digital representation of either a real-world or digital entity. A digital twin exists over the life-cycle of an entity from planing, manufacturing, testing, birth, and operations to decommissioning and rense. The more past and present data. are related and anlysed, the moro knowledgo can be deployed to drive significant improvements on an individual entity or system level. Tt is estimated that by 2022 the ToT powered by digital tvins will save consumers and businesses worth §1 trillion a year in asset maintenance |5 ‘The notion of digital twinuing for objects, machines, and agents is becoming relevant to an increasing number

of human services and Industey 4.0 use cases. This is the result of the growth in digital services, connections, and 011719 A DID for Everything 1.0 3

data streams from the Tnternet,of Things (IoT) devices that increasingly drive integration with machine learning algorithms, resulting in graph-type data chains for processing the 10T data streams,

Today, digital twins are captured in siloed, proprietary 10T solutions by individual corporates that do not ovn the physical object over the life-cycle and even do not intersct with parties using the object further down a value ehain. Decentralized solutions are liberating the digital tins from silos and establishing more valuable and interoperable verifiable attributes about entitics and the data chains they connoet with

Why it Matters for Objects, Machines and Agents

There is no widely adopted anthentication or verification systems in place to provide the equivalent of KYC (know-yonr-customer) for non-human entities, that is: KYA (know-your-agent), KYB (know-your-bot), KYM (know-your-machine}, or KYO (know-your-object).

Tn a world when objocts and machines are connected with datastroams and intelligent agents that perform transaction on behalf of the entity, the number of agent-to-agent transactions wil outerow the mumber of human transactions by muny orders, An agent, trausacting with another purty can independently verify the identifier of the this party, its attributes, and he provenance of the data sets that are involved in the transaction.

Digital twins of 3D-printed objects for safely eritical parts such as turbine of an airplane provide an important example. For these parts, it is important to have an precise andit trail about the 31 printing procass to prove that the object was manufactured in accordance to stringent; specifications. The digital twin stores design. ‘manufucturing, post processing, and quality-assurance data about the 3D-printed object. These data are coming from muliple systems resulting in a variety of data chains. With DIDs and DADS the integrity of the data chains can be verified. The verification of the datachains and the inderlying data. results in important proofs about, the provenance of 3D printed object.

Why it Matters for the World

The diverse application of decentralized identificrs (DIDs) will have substantial influcnces in broader applications on a global scale, The seamless provenance of physical objects or data items through any value chain has major implications on the risk and value properties of the processed data

Within any dynamic process, participating entities have substantial interest in the anthenticity

and trustworthiness in any individual step. Data that is accumnulated with an unforgeable wudit trail that references decentralized identilying information (Person, Device or any other Eatity) for any transformation step holds greater value then it would have without such properties.

Managing the sustainability of the commons requires mochanisms to value natural capital and to account for the externalities that ariso from hnman activities. This should atribute extractions from and contributions to the commons by organisations, organisms, machines and information. We need to identify these entities and must 0719 ADID for Exerything 1.0 1

identify both positive and negative impacts thesc entitis are having on the commons. Knowing what these impacts are enables s to connt what matters and to put a value on what counts. The promise of a overarching prevalence through the broad nse of DIDs also provides the key component, for achieving the vision of a circular economy; a regenerative system in which resource input and waste, emission, and energy leakage are minimized by slowing, closing, and narrowing enerey and material loops. This can be achieved through longlasting dosign, maintenance, repair, rouse, remannfacturing, refurbishing, recycling, and upcycling This contrasts with a lincar cconomy, which is a self-destructing, catastrophic 'take, make, dispose! model of production. CCOMPREHENSIVE SOLUTION Motivation The Decentralized Autonomic Data. paper from the RWOT Spring 2018 introduced three new concepts related to DIDs [1]

• Decentralized Autonomic Data (DADI) itemns

• Derived DID (dDID)

• Self.contained verification of data governance and integrity This paper extends these concepts with a new one, that is

• Data flows may be provenanced via a selF-referential blockehain (Tist of signed DAD items where each

subsoquent DA item ineludes the DI or dDID and associated signatnre of the provious item)

Data Provenance The concapts above lay the groundwork for dafasflow provenance that.is the focus of this paper. Tn this context provenance is used in o gencral sense. By data-flow provenance we mean a mechanism for tracing data-item content and control through a processing system, including any transformations to the data item or its governance. This includes flows with multiple sources and sinlks of dat, independently and in combination. To restate, data-flow provenance means not. just tracing control but, also verifying the end-to-end integrity of every data flow, including any transformations (additions, deletions, modifications, and combinations). In this context provenance refers fo the chain-of-custody of data items not ownership. Ownership s a more complex idea than mere control. Change of ovnership requires the previous owner to relinquish ownership und the new owner to accept ownership. Tt reverts back f not accepted. Finally, ownership implies . restriction or limitation on rights %0 it may need to be interactive or involve & third party. In English we use the term " custody’” to refer to having possession of something (under you control), but custody does not equal ownership. With

physical objects one can have unique custody that could be equivalent to ownership because a physical object is a unique thing, Hence the expression "possession is nine-tenths of the law" 07719 A DID for Everything 1.0 5

[17]. Because data can be casily duplicated, however, it may not be possible to prove mique possession of data. There is 10 way to guarantee that there is not another copy of the data. So custody of data s not equivalent to restricted ownership. With data the strongest attestation of ownership is limited to merely rights to use the dato. So transfer of ownership of data is & difforent concept: i's not ransfer of the data itsclf but the transfer of rights to use the data. An important insight from tho viewpoint of a distributed application is that an entity's influenco on the application is solly based on the digital data flows that move betwoen the entity and the other components of the distributed application. We choose to call those dati flows the entity's projection onto the distributed application. If those projections cousist of DADs and every interaetion of internal components consists of DADs then we have & universal approach for implementing decentralized applications with total provenance of control and data. within the application. A major motivation for establishing data-flow provenance is to support building and architecting decentralizod Processing systems that use a zero-trust or more correctly diffuse-frust perimeterless security model. The emerging decentralized processing peradigun for distributed upplications where the sources and sinks of data may be controlled by nuultiple entities, i.e. decentralized governance, means that traditional perimeter security models are at best, problematic. Tndeed, even the newer perimetorloss scourity model as originally formulated assumes singular governance of the network hosts and associated data [7][§]. We extend that model herein to include hosts and DADs with decentralized governance vis DIDs, An carlier paper explored the architectural issues of building distributed computing infrastructure that applied the zero-trust security model but extended it to use distributed consensus for policy governance [9]. This type of architecture wo ealled Zero-Trusi-Computing or more correctly Diffuse-Trust-Computing. A simple way of explaining the 7ero-trust seenrity model is the mantra, "never trust, always verify". The paradigm of Zero Trust Networking was first popularized in 2013 by & NIST report [7]. More recently the principles have received much broader attention including the book Zero Trust Networks |8]. The busic approach to Diffuse-Trust-Computing is o use a diffuse trust. perimeterloss seourity approach

. As previously mentioned, some call this a trustless or zero- trust security model but that s a misnomer. There is still trust, it is just diffused in such a way that socurity is greatly enhanced [3]. In this paper we further extend that model to use DIDs and DADs to provide decentralized end-to-end data provenunce. The caveats of conventional diffuse-trust perimeterless security are:

• The network is always hostile both internally and externally; locality is not trustorthy.

• By defuult, every network interaction or data flow must be authenticated and authorized usiug best

practices cryplography. = By default, inter-host communication must be end-to-ond signed enerypted, and data must be stored signed fencryped using best practices cryptography: Data is signed fencrypted at motion and af rest.

07719 A DID for Everything 1.0 6

• Policics for authentication and authorization must be dynamically modified based on behavior (reputation) Using end-to-end encryption and storage prevents exploits from anyone that merely has access to the network or the data-storage device. By authenticating and authorizing every network interaction or dat flow, security becomes granular. A successful exploit of onc interaction docs not. biced into any other. Compromising one daia Hlow does not compromise any other. Escalation opportunities are minimized. Many security exploits are discovered through repeated probes and experiments to find bugs, buffer overflows, o weaknesses in network protocols or softsare implementations. Dynamie policy modification that uses AT to first profile and detect anomalous behavior and then restrict the authorization of that usor prevents discovery. This adds time as a defence. Extending the model to enhance the sceurity of the policy management adds the following caveat
• Policies must be governed by distributed consensus. Distributed consensus diffuses the trust for any policy decision to a group of hosts. In order to defeat the policy, an attacker nust exploit some majority of the hosts. This makes exploits exponentially more dificult, Distributed consensus also allows for decentralized governance of the hosts. Ihis paper extends these priaciples with one more: « By dofanlt, cach data flow including transformations must bo ond-to-cnd provenanced using decentralized identifiers (DIDs) and hence decentralized autonomic data items (DADs) This additional principle allows governance over the data using a decentralized trust model and a decentralized web of trust based on DIDs and DADis. This approach enables truly decentralized governance models for distributed applications. One can combine the third and sixth caveais from ahove, to a simple summary caver:
• By defuult, data flows are end-to-end provenanced /sigued/encrypted at motion and at rest using DIDs and DADs. “This remainder of this section in the paper will explore salient issues in using DIDs and DADs to maintain provenance over each step in a data processing flow including transformations of the data 10 enable credible uses of the data for various applications while maintaining a 7ero or difuse-trust security moel. Decentralized Autonomic Data Definition First introduced in more detail here [1], & decentralized autonomic data item (DADI) is associated with o decentralized identifier [14]. This paper does not provid

e a detailed definition of DIDs but does describe how DIDs are used by a DADL. The DID syntax specification is a modification of standard URL syntax per RFC-3086 [19] 0719 ADID for Exerything 1.0 7

s such, it bonefits from familiarity, which is a boon to adoption. Onc of the featurcs of a DID s that it is a self certifying identifier in that a DID includes cither a public key or a fingerprint of a public key from a cryptographic public/private key puir. Thereby « signature created with the private key can be verified using the public key provided by the DID. The inclusion of the public part of & crypiographic key pair in the DID gives the DID other desirable propertics. These include universal uniquencss and psenodnynmity. Another way to describe a DID is that it is a cryptonym: a cryptogeaphically derived psendonym. Tn the DAD acronyin, decentraized means that the governance of the data may not reside with a single party. The term autonomic means self-managing or self-regulating. Tn the context of data, we erystalize the meaning of self-managing to include cryptographic techniques for maintaining data provenance that make the data self- identifying, self-certifying, and self securing. Implied thereby is the use of cryptographic keys and signatures to provide a root of trust for data integrity and to maintain that trust over change-in-custody and ransforsaation of that data, i.o. provenance The motivating use of DAD is to provide provenance for streaming data that is gonerated and processed in a distribnted manner with decentralized governance, Stroaming data are typically measurements that are collocted and agaregated to form higher level constructs. Applications include analytics and instrumentation of distributed web or internet-of-things (IoT) applications as well as portable reputation systems. A DAD seeks to maintain & provenance chain for data undergoing various processing siages that follows diffuse trust security principles inclnding signed at rest and in motion. Streaming data applications may impose significant. porformance demands on the processing of the associated data. Associated with DID is a DID Document (DDO) [14]. The DDO provides meta-data abont the DID that can be used to manage the DID as well as discover services affiliated with the DID. Typically the DDO is provided by a DID resolution service, The DID/DDO model is not & good mateh for streaming data especially if & new DID/DDO pair seould need to be created for each new DAD item. But a DID/DDO is a good match when used as the root or master identifier from which an identificr for the DAD is derived. This derived identifier is called a derived-DID or dDID. Thus only one DID/D

DO paring is required to manage a large number of DADs where each DAD may have a unique dDID. The syntes for & dDID is identical for a DID. The difference is that ouly one DDO with meta-data is needed for the root. DID used o create the dDIDs in the DADs. Each DAD item carries any additional DAD-specific meta-data, thus making them self-contained (antonomic). DID Syt A DID or dDID has the following required syntax:

did:method: idstring The method is some short string that namespaces the DID and provides for unique behavior in the associated 07719 A DID for Everything 1.0 8

method specification. Tn this paper we will use the method dad. The idstring must be universally nique. The idstring can have multiple colon ":" separated parts, thus allowing for namespacing, In this document the first part of the idstring s linked to the public member of a cryplographic Key pair that is defined by the method. We wil use & At-character Bascs4 URT-File safe encoding as per RFC- 4648 [18], with onc trailing pad byte of the 32-byto public verification key for an EADSA (EA25519) signing key pair. Unless otherwise specified Base64 in this document refers 1o the URL-File safe version of Base64, The URL- Fille safe version of Base64 encoding replaces pins " " with minus =" and slash " /" with underscore " %. 4 DID may have optional parts including a path, query, or fragment. These use the some syntaz as a URL, that is, the path is delimited with slashes, /, the query with o question mark, 7, and the fragment with a pound sign, _ When the path part is provided then the query applies o the resource referenced by the path and the fragment Tefers to an clement in the docnment,referencod by the path. An example follows: did:dad:Xq5¥qal.6L48pE0 £ IUNLOTRAU2_RXFEOALA3wYn148=/mom?who=ne#blue In contrast, when the path part s missing but either the query or fragment part is provided then the query and/or fragment parts have special meaning. A query without a path means the the query is an operation on cither the DID itsclf or the DID document (DDO). Likewise when a fragment is provided then the fragment is referencing an element of the DDO. An example of a DID without a path but with a query follows:

did:dad: Xq5¥qal6L48pE0FuTIVNLOTRAUZ_RXFPOALA3wYn148=7who=me

s will be described later, a query part on a DID expression without a path pat will enable the generation of dADIDs (derived DID).

DIDs form & new elass of identifiers that can be used to replace the identifiers commonly used in distributed applications. DIDs can replace UUIDs, URTs, and Publie Keys because a DI combines the desirable features of all three identifier classes.

• UUID: A Univorsally Unique dentifier per RFC 4122 has types 1-5. Those are 16-byte collision-resistant. decentralized identifiers generated with psendo-random-number generator and optional name-spacing dats. A UUID ensbles distributed applications to create unique identifiers without central authority. Profixed name-spacing allows for sorting and searching propertics such as time order, lesical order, nesting cte.

• UR

L A Uniform Resource Identifier (URI), Uniform Resource Locator( URL), Uniform Resource Name (URN) per RI'C 3986 is of the form schemer]//[user|:passsword]@]host|:port]|/path][?query] | fragment] This provides not just an identificr but, namespacing anthority and mini-language for performing operations on the identifier and ussociated resources.

= Decentralized Self-Certifying Identifier: A Sclf-Certifying Identifier contains the fingerprint,of a public ‘member of cryptographic public/private key pair. A decentralized Self-Certifying Identificr contains the fingerprint of a public/private key pair that is generated by the user not a central registry. A Hierarchical

0719 ADID for Exerything 1.0 9

Detorministic Self-Certifying Identifir of the form sclfeertroot: path, o/ related/data provides a way to reproduce private keys without having to store them. * ‘Tupleizable Identifier. A tupleizable identifir of the form (channel, host, process, duta) tenables o routing overlay on top of TP that can be provenanced. Tndeed any computing infrastructure that. is now using UUIDs and URLs could beneficially replace them swith DIDs. Minimal DAD A minimal DAD (decentralized antonomic data) item is a data item that contains a DID or dDID that helps uniquely identify that data item or affliated data stream. In this paper JSON s used to represent serialized DAD itemns but other formats could be used instead. To ensure non-repudiable data integity (ic. that the data has not been tampered with and can be assigned to a given signing entity) a signature is appended to the DAD item that s verifiable as being generated by the private key associated with the public key in the i field value. This signature verifies that the DAD item was created by the holder of the associated private key. The DAD item is thereby both self-identifying and self-certifying because the identifier value given by the id field is included in the sigmed data.and is verifiable against the private key associated with the public key obiained from the associaterd DID in the id field. The signature is separated from the JSON serialization with characters that may not appear in the JSON. An example DAD with & payload follows: [ "id": "did:dad:Xq5YqaL6L4BpEO£uTIURLOJRAU2_ReFPOALA3WYn148=", "data": i "name": "John Smith", "nation": "USA" ) } \r\n\r\n 472392KHgZ99£0KEpSKMAYqWVES_37PS_22034L99sTHIMI1IGQPBVUTT1CUpOSCETE KCBSGCVRYOFREAR nag== As previously mentioned, the motivating use case of DAD is to support distributed stzeaming data applications, These could entail the creation of a large number of DIDs thus simplifying the reproduction of the associated public/private key pairs is an important, consideration. Ono way to accomplish this is with a doterministic procedre for generating new public,private keys pairs where the private keys may be reproduced securely from some public information without having to be stored. A hierarchically deterministic (IID) key-generation algorithmu docs this by using a mster or root private key and then generating new key pairs using a deterministic Key-derivation algorithm. A dorived key is expressod as a branch in a tree of parent,fchild keys. Fach public key includes t

he path to its location in the tree. The private key for a given public key in the tree can be securely regenerated using the root private key and the key path, also called a chain code. Only one private key, the root, needs o be stored, 07719 A DID for Everything 1.0 10

The query part of the DID syntax may be nsed to represent an HD chain code for an HD key that is derived from a root DID. This provides an economical way to specify derived DIDs (4DIDs) that are used to identify DADS. Au example follows did:dad:Xq5¥qal6L48pE0£uTIVRLOTRAUZ_RXFPOALA3w¥n148=7chain=0\1\2 The expression above discloses the root.public DI as well as the key derivation path via the query part. For the sake of brevity this will be call an extended DID, The actual derived DID is created by applying the HD algorithm with the result 41d:dad:QL27 FTHONZS2BBVETkep6H- 4HAB L 54SHONL VR 6FE= Thus a database of DIDs could be indexed by dDID expressions with each value being the extended DID. Looking up the extended DID allows the holder to recreate on the fiy the associsted private key for the dDID without ever having to store the private key. An entry in the database might look like the following; [ "did:dad: Qt27£ThHONZsa88V=Tkep6H- 4HAB LrS 4SHONL VW 6FE=" : "did: dad: Xq5¥qaL6L48pE0fuT IURLOTRAU2_RFPOALA 3w¥n148=7chain=0\1\2" } The nanespacing of the DID idstring also provides information that could be used to help formulate an HD path to generate a dDID. The following example shows two different dDIDs using the same public key and the same chain code bt with a different extended idsring. did:dad:Xq5¥qaL6LABpEO£uTIUNLOTRAU2_RXFROALA 3wYn148=:blue?chain=0/1 did:dad: Xq5¥qal6L48p0£uTIVRLOTRAUZ_RXFPOALA3wYn148=: red?chain=0/1 Some refincments to this approach may bo nseful. One is the gramlarity of dDID allocation. A nique dDID conld be used for each unique DAD or unique dDID could be used for each unique destination party that is receiving a data strean. I this case each DAD would need an additional identifier to disambiguate each DAD sent to the same party. This can be provided with an additional field or by using the DID path part to provide a sequence ‘mumber. This is shown in the following example: did:dad:Qt27£ThHoNZsa88VCTkep6H-4HAS tr54sHONL VW1 6FE=/10057 The associated DAD is as follows: [ "id": "did:dad:Qt27£ThHONZSaB8VETkepGH~4HABLLS4SHONLVHL6FE=/10057" , "data": [ "temp": 50, "time": "12:15:35" ) 07719 A DID for Everything 1.0 n

) \r\n\z\n u7239aKHgz99£0KBpSKiny qwvEL_3TpS_z2034L99sTHIMITIGRPbVUITLoupo6cETE_KCBSecVRYOFRZAR nAQ== Change Detection Stale DAD items must ofien be detectable to provent replay attacks. A later re-transmission of an old copy of the DAD item must not: supercede a newer copy. Using a sequence mumber or some other identifier could provide change detection. Another way to provide change detection is for the DAD item to include & changed field whose value is monotonically increasing and changes every time the data is changed. The source of the data can enforce that the changed field value is monotonically inereasing. Typical approaches include a monotonically ineroasing date-time stamp or soquence mumber. Any older data. items resent or replayed wonld have older date-time stamps or lower sequence numbers and would thus be detectable s stele. Below s an example of an non-trivial data item that has a changed field for change detection. [

"id": "did:dad:QE27fThKoNZsaBEVETkep6H-4HABEX54SHONIVHL 6FE=/10057" ,

"changed" : "2000-01-01T00:00:00+00:00"

datan:

i

“temp": 50, "time": "12:15:35"

) } \r\n\r\n 472392KHgZ99£0KBpSKMAYqWVES_37PS_22034L99sTHIMI1IGQPBVUTT1CUpOSCETE KCBSGCVRYOFREAR nag== Change detection prevents replay attacks in the following manner. A second party reccives DAD updates that are each signed by the associated private key. Each update has a monotonically increasing changed field. The source sigrer controls the contents of the data wrapped by the signature, Therefore the signer controls any changed feld, A consistent signer will use & monotonically increasing changed value whenever the data wrapped by the signature s changed. Thus & malicious third party cannot replay earler instances of the DAD wrapped by & valid signature o the original second party because the socond party knows to discard any receptions that have older changed fields than the latest one they have already reccived. On the Fiy dDIDs in DADs One important use case for dDIDs in DADs is to identify data that is received from a source that is not providing identifying information wits the data. The receiver then creates an sssociated DID and dDIDs to identify the data. At some later point the receiver may be able to link this data with some other identifying information or the source may "claim” this data by supplying identifying information. Tn this case the dDIDs are private to the receiver but can later be used to credibly provenance the internal use of the data. This may be

extremely 0719 A DID for Everything 10 12

beneficial when shared amongst the entitios in the processing chain as a way to manage the entailed proliferation of keys that may all be claimed later as a hierarchical group. The DIDs and associated derivation operations for dADIDS may be shared amongst » group of more-or-less trusted entities that are involved in the processing chain. Data-uige dDIDs Every DAD MUST have a unique DID. A databse of DADs could be addressable by either their DID or their signature as for content-addressability. It might happen that an entity accidentally uses a public private key pair 1o create a dDID aud use it two or more times. One way Lo ensure uniqueness is to wse a random number as UUID or a timestamp and concatenate it s an exension in the DID path

did:dad:QE27£ThHONZsaBEY Tkep6H-HABEr54SHONI VW1 6FE=/UUID Auother way would be to use the signature in a content-addressable database to resolve the DAD. Pubiic Deriuntion Auother important use case for dDIDS in DADS is to avoid storing even the dDID with its derivation chain. This may be an issue when a client wishes to communicate with a potentially very large mmber of public services. Ench public service would be a new pairing with a wnique dDID. I the derivation algorithm for an HD-Key dDID could use the public key or public DID of the public service to generate the dDID then the client need not store the actual dDID but can recover the dDID by using the public DID of the server to re-derive the associated dDID. This can be done by creating a hash of the root, DID private key and the remoto server public DID to create the seed used to generate the dDID for the DAD. This also means that the dDIDs or chain codes do not have to be included in the keys preserved by a key-recovery system. Chaining DADs The provenance of data in & data. flow through a data processing system with transformation can be established by forming a lteral block chain of the data. When using DAD items to represent the data, the ehain of DADs can be represented simply in sclf-contained manner. At each step in the data flow of the originating DAD, where the contained data s transformed in any way, a new DAD is generated by the controlling entity of the transformation, This entity assigns a new DID (or dDID) to this DAD, The new DAD payload includes the DID of the DAD prior to transformation as well as the signature of the prior DAD. This links the new DAD to the prior DAD. The signature of the prior DAD provides both a hash that establishes the con

tent integrity of the prior DAD as well a non-repudiation of the controller of the embedded prior DID. All the DADs in the data flow need o be stored some place indexed by their DIDs. Given this storage, any single DAD can then be used to recall the string of prior DADs back to the originating DAD or DADs. A special case is when an entity merely wishes to establish custody of data without changing or transforming it. The simplest way to to this that the entity adds a copy of the DAD as a link in the DAD chain without changing the underlying data. This forms an assertion that. they control that link. IF they do not transform the data then merely signing is cnough to assrt control over the link or equivalenty custody of the the data for that link of the chain. A one to many data stream s just branch or fork in the chain into multiple chains. 07719 A DID for Everything 1.0 13

An example of an originating DAD and transformed DAD follows: Originating [ "i": "did:dad:Qt27£TRNONZSaBBVETkep6H-4HASEr54SHONIVWLEFE=/alpha/10057" "changed" : "2000-01-01T00:00:00+00:00" naatan: [ “temp": 50, "time: "12:15:35" ) Ne\n\r\a u7239aKHgZ99£0KBSKHNYQwVEL_37pS_z20341998THZMITICQPBVUTTLcupocEIE_KCBSeCVRYOFRZAR nAg== Teansformod t "id"; "did:dad:AbCT£ThHONZSa88Vs Tkep6H-4HASLr5 4SHONL VWL 6FE=/beta/10057" , "changed" : "2000-01-01T00:00:02+00:00", “data": [ “temp": 50, “humid": 87, "time": "12:15:37" ) "prioz”, i i "did:dad:Qt27£ThHONZsaBEVLTkep6H-4HABtr54sHONIVHLEFE=/alpha/10057" , "sign: u7239aKHgz99£0KBSKnyqwvEL_3TpS_z2034L99sTHIMI TIGRPbVUITLoupo6cETE_KCBSecVRYOFRZAR nAg== Ne\mria Wbe39aKHgz99£OKBpSKinyqvE=_3rpS_z2034199sTHIMI 1IGQPBVTJLcupo6cETE_KCBSecVRYOFRZAR nAQ== This approach is then repeated until the data flow reaches the final consumer or sink of the data as shown in the following diagram 07719 A DID for Everything 1.0 1

Linear Decentral Autonomic Data Flow — Self-contained DAD Chain Saue Tansomia Tanstomng o By o o T T o, (e | Transto. Transio Payonts [ . In the case where multiple data flows are aggregated or combined in some way such as a moving average or some type of statistical operation then the resultant DAD payload would include a list of the contributing or combined prior DADs. An cxample follows: Combined: 1{ "147; "did:dad; AbCT ETHRoNZsaB8VE Thep - (HAB L5 4s HONIVHL EFE=/ gamma /10057, "changed" : "2000-01-01700-00:03+00:00 raatar: 1 "Avg tempr: 55, “time: "12:1539" } priors", t { wian "did:dad Q27 FTHNONZ 828 V= ThepSHi- AHAB x5 4SHONLVHL6FE=/alpha/10057" et 472)93KA G299 £OKEp SNy qWVES_37pS_120341998THEMI TIGQPBVUTT1CuUpOSCETE_KCBS6GVRYGFRIAP nag= b 1{ wian: "did:dad:WA27£ThWoNZsaB8VrTkep6H-4HABtr54 SHON1 VW1 6FE=/beta/10058" , "sig": 57839aKiHgz99 20K 8pSKMny quVEE_37pS_220341998THENTT I6QPOVUTTLcUpoBCETE KCBSecVRYOFREAD ran A DID for Bvoryching 10 15

nAQ== +e 1 Nr\n\r\n s oxsperny e p8_ 42091999 WML QBRI epoGori KCaSecRIoTRGA? nAQ== ‘This can be extended Lo any arbitrarily complicated tree of processing transformations as shown in the following DAG Decentral Autonomic Data Flow — Self-contained DAD Graph il . K5

Because each DAD embeds a DID and is signed by the associated private key belonging to the DID, provenance Because each subsequent DAD in a processing fow or DAD chain contains the DID and signature of the prior DAD or DADs, full traceability can be established back to the originating DAD or DADs, preserving both data integrity and proof of control. This then is a critically enabling capability for decentralized computing DIDs and DADs. Notable are the Didery Service [10] with web [11] and command line [12] clients and the SeedQuest |13] key-recovery application.

USE CASES

General

When working with people, the proposed system could use proximity verification, implemented with software toolkits such as Google Nearby and p2pkit, to bind virtual identities to real people. This could be useful in many situations. For example, if two people met over Craigslist t0 sell a used bicyele, then the system could verify that, the to parties actnally met and transacted. Tf two people found cach other through a dating site, and followod np with & face to face mecting, then the system could verify that these people were actually in the stated city and not catfishers from Ukraine or Nigeria. Sinilarly, transactional events could build trust in & similar manner for ‘machines. For example, a cortifiod mechanic performing a tuno up on & car with a digital twin can also provide an attestation for the DID for that antomabile. A complete history of the automobile's maintenance wonld add valne for its owner

Tt should be noted that a single instance of meeting is not as trustable as an entire history of meoting many people. For a state actor gencrating a legend for a sockpuppet, this would entail an unattainable level of work to prove personhood. For a regular human being, it's relatively effortless to use the system in an organic and unobtrusive manner. Furthermore, these histories of meetings and verifications — using location data to prove it was not.in Nigoria, and time data to prove it wasn't in the middle of the night — would bo agaregated to increase the trustability of the personhood assessment.

Every resource that is reference by a URL conld instead be referenced by a DID or dDID,

• I0T: Data Stream: DID for Data. Stream / DID for individual packaging / DID for Data Transformation (Signature of on old data generator + Signature of transformer) — Storing Transformations in & "Blockehin"

= DID for APT Endpoinis: Discovery / Authentication / Transformation.

• DID as UUID replacement: Unique Identifier + Properties of Self.Certification

• DID as Resource Identifier Replacements: Derived DIDs

• Devices: Pacemaker

= Software Oracles: Stock prices from an exchange

“ Chatbots: Automated issue-management system

• Robotic Controllers: Car windscreen-wiper motors

• Locations: The place where two people met

• Software applications: Online gaming platform

• Sensors: Thermostat measuring the ambient; temperature in a home

• Messaging: Peer-to-peer chat application

= Machines: Wind turbine generating clean energy

• Digital Medi

a: Video recording of a ness report

• Store of value: Bank account

0719 ADID for Exerything 1.0 "

• Softwarc containers

• Microprocessors: Computational cloud server

• Validator nodes: A blockchain network

• Databases: Personal Healdhcare Rocord

• Events

• [Future| Biological molecule: CRISPR gene therapy

• Au array or matrix of other DIDs Use Case: Medical Imaging Workflow Timage processing is operational in many sientific and engineering disciplines. These include:

• Tmage processing methods are used to count, measure, inspoet, and analyse objects, coded information,

and/or visnal patterns. * Xeray and ultrasonic devices deliver medical images with image processing that the doctor or medical algorithm can interpret more easily.

= Xeray machines in security zones automatically inspect lnggage and clothing for dangerous objocts.

• Visual image processing for quality assurance of abjeets in manufactring systems.

• Radar and visual images for earth-observation applications. Image processing can include multiple data sources, parties, slgorithms, and processing steps. An imuge processing end-user needs to be able to validate trustability and accuracy of an image data chain output data. This requirements becomes of critical importance when the output data is nsed in safoty or socurity-rolevant use cases or to make economic decision with significant commercial values involved. The cryptogeaphic DAD data structures enable a user to validate the provenance of an image processing data chain including the authenticity and integrity of the input data and the provenance of the processing algorithms, We recormimend the ereation of DAD verifiable data chains for image processing that provide s DID for every image and data processing output data set. These data. chains are then integrated with DID registries and /or digital twins that provide information about organisations, imaging devices, external data sources, and software algorithms involved in the data chain. This approach is of partieular value when validation or benchmarking data are available about the image devices and the algorithms that, azc proccssing the images. Tn combination with a reputation or validation system any user can caleulate trustability and acenracy metrics about the output data. Tn context of the medical image processing use case, the digital Lins of the imaging device include verifiable claims issued by the OEM about, the anthenticity, accuracy, and calibration of th camera as well as benchmarking information abont the accuracy of the machine learning algorithms. The followin

g diagram provides a notional example of a DAD-chain for image processing data provenance, 07719 A DID for Everything 1.0 18

Verifiable 2D medical imagining and recognition workflow — [ERT R —— [ERR-ca—— o [N R e ~ v it - oo 15 st G = i o, Py oo 2 06, T orsetpctins P ... o R v M agenl 15, e earegraese - e oy ot e o pnac, 8§ E: e e ety iy 06, et mpeor it Use Case: Proof of Personhood The root use case is to help us identify and manage our identity interactions with other people. But to do so more effectively, we need to know that an identifier is accurately associated with an actual person. The fraudulent ‘misuse of identity has a significant negative fmpact on socicty. At an individual Tovel, frandulent users conld cheat others in commercial transaction, become casfishers on dating sites, or worse. At a sacietal level, the fraudulent ‘misuse of identity through bots and sockpuppets have caused havoc in elections and through the manipulation of public opinion through weaponized propaganda. The highest purpose of the blockchain is as a kind of "truth machine". For decentralized identity to succeed, and not be co-opted as just another way to empower sockpuppets and botnets, there needs to be un equivalent to proof-of-work, a mechanism that binds physical entities to virtual identities in a way that enables accountability while prescrving anonymity. This is now being referred to as "proaf of persanhoo" One use case would be to use proxinity verification, mplemented with softare toolkits such as Google Nearby and p2pki, to bind virtual identitics to rcal peaple, in 2. way that prescrves privacy, non-corrclation, 7ero- Inowledge proofs, and pseudonymons operations. We're currently building a technology called Not_a_Bot, which provides proof of personhood through a variety of techniques. One technique is to verify that the user has actually met another actual person, in physical space... and is not a catfisher, not a scammer, and "not a bot" 1t shonld be noted that a single instance of meeting is not as trustable as an entire history of meeting many people. For a state actor generating a legend for a sockpuppet, this would entail an unattainable level of work to prove personhood. For a regular human being, it's relatively effortless 1o use the system in an organic and 011719 A DID for Everything 1.0 19

mobtrusive manner. Onee a oot personhood verification could be insnred, then trustable psendonyms conld be generated. Adding this verification to DIDs would provide trust in a trustless environment, as the DID could then provide identity and credentialing services in environments that support, or even require, pseudonymity. Decentralized Fog Computing Infrastructure The coming tidal wave of digital data due to the proliferation of digital devices will require an exponential increase in computing capacity for data integration and analysis. Currently data integration and analysis is handled predominantly in the elond. This is not. efficient. as it requires transport of data from the edge of the internet where it is created to remote data centers that are the clond for processing and then transport back fo the edge of the results of processing. In many cases the data processing can be performed in a hierarchical-tree-like bottorm-up fashion which is more cost effectively done in the ede close to the data. Likewise new applications benefit from low latency processing of data near the sources and sinks of the data. These applications also bencfit from processing the data in the edge. Currently there is lttle capacity to perform processing in the edge. Consequently an opportunity exists to build a public decontralized odge computing infrastructure. Edge computing infrastructure is called the fog. A public decentralized fog computing infrastructure provides an opportunity to scale capacity using two sided network effects where a large mumber of entities can cooperatively participate in the two-sided network both as consumers and as inportantly producers of compute. This is in contrast to the highly contralizod nature of clond computing shere a handful of producers control most of the public computing infrastructure, This stifies innovation and raises costs. A public, decentralized, fog computing infrustructure could enable the monetization of pre-existing spure capacity in the form of bandwidth, space, energy, and compute devices. This would provide lower costs and incentivize innovation. FUTURE DIRECTION Data flows can be provenanced by verifying the end-to-cnd integrity of data. with DIDs. By enabling DIDs to sign claims about other DIDs, the fidelity of these data ows can be increased further, There sre several ideas that are ood candidates for future exploration. These are as follows 1. Examine how a DID can utilize verifiable credentisls to prove verified as

pects of their identity when signing claims abont other DIDs. Such a use case could enable verified inspectors to sign a claim with their DID that they have serviced an o sensor and certify what software and hardware upgrades the sensor is using 2. Exuamine how verifiable claims and credentials can be issued for location verification. 8. Bxamine the social/network interactions beteen DIDs that sign attestations about other DIDs. 4. Examine how pairwise unique DIDs and zero-knowledge proofs could empower users to make contentions 0719 ADID for Exerything 1.0 20

comnterfactnal claims in a. privacy respecting manner. 5. Examine how the system conld help to drive non-correlation fimctionality. 6. Open discussion on other issucs such as cognitive models, optimization and AT models, and the potential use of tokenization to drive behavioral economics. 7. Examine how attestations or other types of claims on a DID can build an airibution graph that incrcases the value of the credentials associated with a DID. CONCLUSION Tmagine o world whero this proposed technology has been deployed and globally adopted. Let us paint a picture for how this might be achicved. Tmagine that this approach becomes part of a decentralized identity solution for every entity, driven by a robust and active developer community. The vision is to generate technologies that would be integrated into applications that are used in 0T, e-commerce, social interaction, banking, healthare, and 50 on. Now imagine that mabile tolephony companies agree to embed the technology into the operating systems for all smartphones, and the dominant social network providers agree to nse DIDs and DADs and proofs about the entities controling these DIDs and DADs in their algorithms for determining which content to propel. This would mean the end of phishing, The end of fuke news. This is the begiuning of new era for society, built on an interconnecting web of trust: a world in which we know what impacts we are having. The emergent, property of this now data fabric is Knowing, This is greatly needed as trust in media is at an all-time low, and centralized, algorithmic distribution have ereated a perfect: storm for the rise of misinformation, disinformation, and fake news. This is driving polarization while sinultancously undermining public trust in institutions, However, realistically, most of society's greatest challenges have no silver-bullet solution. Consider the problem of using sock puppets to weaponize propaganda. Proximity verificution is one component of a multi-pronged solution that might lielp mitigate the problem. Consider that, certain highly problematic diseases can be treated with drug, combinations consisting of antiretroviral compounds mixed with ranscriptase inhibitors and steroids. The combinations are called "cocktails," and they're so cffective that they're called the "Lazarus Effect," named for the biblical figure who was raised from the dead. Cocktails can turn an HIV death sentence into & manageable chronic condition, Just us complex and evolving h

ealth challenges must be addressed with complex and evolving multi-pronged solutions, the complex challenges of online identity require comprehensive and systematic approach using multi- pronged solutions that synergistically combine to enable disruption, change and transformation at multiple levels This paper aims help to determine what other solutions would need to be integrated, to create a "cocktail 07719 A DID for Everything 1.0 2

prescription” to address this problem. Automating the detection of misinformation is only half the problem. Preventing the weaponization of that propaganda is the other half, and this proposed technique could help provide at least part of a comprehensive cocklail prescription to address the issue of fake news

The Internet's current capacity Lo support democratic societies in making well-informed decisions is being subverted by globally networked state actors. However, there are additional benefits for this tochnology in computing, social networking, connected governmental servicos, and e-commeree — where the use of sockpuppets is more of an aggravation than a grave danger. For exumple, in terms of government service, we envision a system where elected offcials could verify how many people they actually meet and how much time was spent with them, 1o back up claims of being "man of the people". For fully transparent, politics, this system should could provide the eloctorate with an accurate sense of whether a politician has actually met with leaders of social movements or is spending the majority of time with donors, lobbyists, and political action committees,

Underlying the benefits of decentralized identity outlined above is the need for open interoperable standards to ensure the reputable provenance of the associated data flows between decentralized entities. This paper describes a novel concept.for provenancing data flows sing DADis (Decentralized Autonomic Data items) that are built upon the emerging DID standard. This approach uses and extends the advanced diffuse-trust or zero-trust compnting paradigm that is needed to operate securely in a world of decentralized data.

REFERENCES

1. https:/eithub.com,/WebOF PrustInfo/ rebooting-the-web-ol-trust-spring2018 /blob /master/ fual- documents/Decentralized AutonomicData. pdf

2. hitps://githnb com WehOFTrustInfo/ ot 7 /blob, master topies-and-advance-

readings; ZeroTrustComputingWithDidsAndDads md

1. https:/ /githnb.com /WebOFTrustInfo/ rebootingthe-sweb-of-trust-fall2017 /blob /master /topics-and-advance- readingsdid-primer.nd

2. ttps:/ wwrw.statista,com, satistics/ 471264 /iot-mumber of-connected-devices-worldwide;

5 hiips:/ fwwrw gariner com/smartcrwithgartner fgariner-prodiels-a-virtual-world-ofexponential-change,

. Redemacratizing Permissionless Cryptocurrencies, by Maria Borge, Eleftherios Kokoris-Kogias, Philipp Jovanovie, Linus Gasser. Nicolas Gailly, Bryan Ford. 2017 IEEE Enropean Symposiu

m on Secnrity and Privacy Workshops EuroS&PW, April 2017

1. ttps:/ wwrw.nist, gov sites, defonlt Hles/ documents/2017 /06 /05 /040813 _forrester _esearch.pdf

0719 A DID for Everything 1.0 2

8 hitps:/fwww.amazon.com /Zoro Trust-Networls-Building-Untrsted /dp 1491962104

1. hitps:/ /github,com /SmithSamuc!M /Papers/blah /master /whitepapers, ManyCubed pdf

2. hitpss//github.com /reputage/didery

3. hitps://github.con/reputage didery.Js

12, https://github.com reputage ‘diderv.py

13, https://github.com /reputage/seedQuest

14, hitps://swe-cog github io/did-spee.

15, hitps://swwwworg/ 2017/ vo /WG,

16 hitps:/ /identity. foundation

17 https:/ /enwikipedia.org /wiki/ Possession_is_nine-tenths_of_the_law

18, Bttpss/ /oo ot ong e/ rie3086.txt

19, hitps://tools ietf org/himl/ric3986

ADDITIONAL CREDITS

Lead Author: Samuel M. Smith Ph.D.sam Ssamuelsmnith.org

Authors: Shaun Conway shaun@ixoworld, Andrew ughes andrewhighes30000 gmail.com, Moses Ma

‘moses ma@fiturelaheonsulting.com, Jack Poole jack.w. poole@gmail.com, Martin Riedel martin@civie.com, and Carsten Stécker carsten stoccker Uinterlinked.ai

About Rebooting the Web of Trust

This paper was produced as port of the Rebooting the Web of Trust VAL design workshop. On September 26 througle 28", 2015, over 40 tech visionarics came (ogether in Mississauga, Onlario to talk about the future of dccentralized trust on the inferme with the goal of writing 9-5 white papers and specs. This is one of them. Leadership Team: Christopher Allen, Joo Andricn, Kim Hamilton Duffy, Mann Sporny, and Heather Vescent. Gold Sponsors: Civic, Protocol Labs, Sovrin, an anonymous donor

Silver Sponsors: HTC, Microsoft, PTB Ventures, Spherity, Tierion

07719 A DID for Everything 1.0 2

Community Sponsars: Blockchain Commons, Learning Machine, Legendary Requirements, Purple Tornado, Veres One Workshop Credits: Christopher Allen (Founder), Joe Andrieu (Producer and Facilitator), Shannon Appelcline (Rditor-in-chicf), and Claire Rumore (Graphical Recorder)

Thanks to our ofher contributors and sponsors!

What's Next?

The design workshop and this paper are just starting poinis for Rebooting the Web of Trust. If you have any

comments, thonghts, or expansions on this paper, please post them to our GitHub issues page: hitps:/github.com, WebOf Trustlnfo/ rwot? issues

The next. Rebooting the Web of Trust design workshop s schedulad for the weok of March 1 to March 8" in

Barcelona, Spain. If you'd like to be involved or would like to help sponsor the event, emai: Iwot-leadershipligooglegronps.com

07719 A DID for Everything 1.0 2