1
$\begingroup$

In a system that relies on decentralized identity, is it possible to prevent duplicate uses of the same real-life identity, i.e. same real-life person creates more than one user entity (each is associated with its own copy of identity keys) -- while remaining decentralized? E.g. without creating a list of signed-up identities, because that would mean that we have some central collection of private data, regardless of whether we keep this collection on a central server or on each node of the network.

For example, let's say that I want to create a decentralized UBI (Universal Basic Income) system that relies on a decentralized identity. So I don't want one person to create more than one user and collect more than one monthly payment per month.

If it is not possible, then what was the point of inventing the technology of decentralized identity? An identity is not actually decentralized if somewhere in the system peers that do not own the identity have access to it.

Update:

It seems like the concept of "decentralized identity" is not yet widely known. I have found two no-nonsense videos that explain this concept:

How does Self-sovereign Identity Work ?- Easy Explainer Video

https://www.youtube.com/watch?v=UjbN9ulHXIU

The Keys to Decentralized Identity

https://www.youtube.com/watch?v=gWfAIYXcyH4

$\endgroup$
5
  • $\begingroup$ While it all sounds interesting, I hold the doubt if the very idea of identity verification is harmonizable with decentralization. For example, a single computer can issue multiple DHCP handshakes and obtain multiple IP addresses, unless the DHCP server can verify the MAC address, which itself is assigned under the authority of hardware manufacturer. $\endgroup$
    – DannyNiu
    Commented Jan 29, 2023 at 0:45
  • 1
    $\begingroup$ If we knew how to do this, we would not need proof of work (and variants thereof) to allow for consensus on the blockchain. $\endgroup$
    – knaccc
    Commented Jan 29, 2023 at 2:33
  • $\begingroup$ @DannyNiu I think that in a system of decentralized identity not everything is decentralized. For example the issuer and verifier are generally centralized. But the identity holding is decentralized. We just need to make sure that there are no two different users with equivalent identities. $\endgroup$
    – rapt
    Commented Jan 29, 2023 at 15:33
  • $\begingroup$ If there's indeed an issuer, then it'll be no different from the CA/B PKI used on the Internet to secure HTTPS connections. In CA/B, the certificate authorities (CA) are the issuers, the verifiers are the browsers (B). That's why I retagged your question with [pki], as I think that's relevant for the discussion. @rapt $\endgroup$
    – DannyNiu
    Commented Jan 30, 2023 at 1:11
  • $\begingroup$ @DannyNiu The system I refer to exists between the issuer and the verifier. It doesn't have control over these parties. So let's assume that the system is a decentralized web system. In this system users exist as decentralized identity holders. Question is how to prevent one person from using his ID proof (wallet) in order to create more than one user account, but without keeping in a centralized manner (I've explained in my OP what I think that would mean) the identity data of existing users. If it is not possible, then what was the point of inventing the technology of decentralized identity? $\endgroup$
    – rapt
    Commented Feb 1, 2023 at 14:37

1 Answer 1

1
+50
$\begingroup$

First thing to ask is what in particular is an identity. It can't be a passport, because then the issuer of the passports can create multiple identities. It can't be a device, because then manufacturer of the device can create as many identities as they want. The only remaining thing that comes to my mind is human body. So the system will have to directly interact with the body somehow. It will also have to regularly inspect that the body is still alive, because otherwise it will be possible to collect identities from the dead bodies. Not only it violates the constraints, but it also creates an incentive to create more dead bodies, which is an undesired side effect.

Uniqueness of the body can be checked with a combination of a DNA test and a fingerprint scan. (DNA test alone is not enough, because identical twins have same DNA, and fingerprint scan alone isn't enough either, because there were occurrences when different people had same fingerprints). But this only allows to check uniqueness, not to prove it.

There might be a system in which the ability to check uniqueness is enough. For example, it is possible to make system like this: to get the monthly share of UBI, person P generates a key pair K_priv, K_pub, scans their fingerprints and DNA, and sends a tuple (DNA, fingerprint, K_pub) to the blockchain. The system on the blockchain assigns a random subset S of its users to be verifiers of P. Every person from S scans fingerprints of P, performs a DNA test of P, checks that P is alive, and sends this results to the blockchain, signed with their own private keys. After this, the system checks the results, and if the majority of the verifiers agree, then the system sends UBI to the K_pub.

This system is decentralized, but it has some serious problems: what if P has sent fake fingerprints and DNA to the blockchain, and gave a bribe to the assigned verifiers? Then verifiers can create the fake identity, and share UBI among the group. To decrease probably of this fraud, it is possible make set of verifiers bigger, and raise the threshold of agreement (for example, 90% of verifiers must agree, to send share of UBI). But this gets too expensive and inconvenient very quickly.

Another option is to invent a method that not only checks the uniqueness, but also proves one. For example, if a person carries a device that constantly sends data about their biological activities to the system, and the system can distinguish the signals of real bodies from the signals of fake bodies. The signals might include heart rate, breath rate, EEG, and video stream from the surroundings. Making such discriminator is technically challenging, because artificial neural networks have shown that they are capable of generating very realistic data, fooling any kinds of discriminators. Another challenge is to make a distributed system with a high enough performance, to be capable of processing these data streams.

$\endgroup$
4
  • $\begingroup$ Thanks for writing. I think that it's possible to rely on official certificates such as passports or ID cards (in countries that have them), because the certificate authority (e.g. government) is considered a trusted entity. I consider such authorities as the highest level of reliability. So my concern is NOT that the government will provide the same person with two different passport numbers, but that one person with one valid passport number will create two different user accounts. $\endgroup$
    – rapt
    Commented Feb 10, 2023 at 20:09
  • $\begingroup$ People would be reluctant to send their biometric data even to the government. Even more so, to a public unencrypted storage, even if it's not associated with a specific person (although it is, in this application). But even if we abandon your suggestion to use biometric data, and only use passport numbers: well, this is exactly what I said was what I try to avoid: exposing the identity data to all users, because it defeats the idea of decentralized identity that is saved only on the identity holder's machine, and at most is only exposed to a verifier. $\endgroup$
    – rapt
    Commented Feb 10, 2023 at 20:28
  • $\begingroup$ You have also suggested doing something like decentralized verification. I think this is the only way to go in this case. $\endgroup$
    – rapt
    Commented Feb 10, 2023 at 22:47
  • $\begingroup$ I still see many possible ways to implement such a system, each one of them has its strengths and weaknesses. The bounty is about to expire so I will give it to you. $\endgroup$
    – rapt
    Commented Feb 10, 2023 at 22:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.