Craxel's Digital Trust Platform, Data Security and Your Identity - Part 1

There is no dispute that the digital economy requires a new approach to protecting individual user data. Digital trust continues to erode as we see daily news reports of organizations failing to keep information safe. Emerging technologies like blockchain and distributed ledger are being viewed as potential solutions for securely managing the elements of an individual's identity. Self-sovereign identity, i.e. a scenario where consumers control access to and sharing of their data, is gaining mindshare as a way to solve the data privacy problems and restore digital trust. Self-sovereign identity may also provide the foundation of digital trust required for digitally connecting the world's population. But enabling self-sovereign identity remains out of reach because of the inability to securely organize and exchange identity information at scale without trusted intermediaries.

At Craxel, we are turning the data layer into a trust layer through our Digital Trust Platform (Black Forest Distributed Ledger "BFDL" + Black Forest Database "BFDB"). Our platform leverages innovations in searchable encryption and massively parallel consensus to offer new approaches to securely organizing and exchanging data. Specifically, our ability to efficiently organize and search encrypted data, combined with the high degree of granularity and massive scale of our distributed ledger, presents an incredible opportunity to deliver self-sovereign identity. The flexibility and granularity enabled by our Digital Trust Platform's application layer encryption uniquely enables self-sovereign identity. BFDB and BFDL never see decrypted data and do not have access to the decryption keys. This is the innovation that allows an individual to control access to their information and not some database administrator.

An identity managed by the Black Forest Digital Trust Platform is comprised of a graph in BFDB and one or more ledgers in BFDL. The graph contains the attributes of a user's identity, e.g. birth certificate, birth date, SSN, etc. Each attribute has a security label that identifies a security compartment. Attributes in a given security compartment can be encrypted separately from attributes in other compartments. You can think of this notionally as a "top secret" set of identity attributes, a "secret" set of identity attributes, and publically available attributes. However, individuals can have as many security compartments as they want, each independent from each other and from other individual's security compartments. Since BFDB and BFDL do not have the encryption keys for these compartments, a hacker that breaks into the BFDB and BFDL servers can't access any encrypted identity elements without stealing the encryption keys from elsewhere. Yet, applications with access to the right keys can quickly query the identity graph. Access to elements of a user's identity is simplified to the problem of key release.

An individual also has one or more ledgers in BFDL. This provides an immutable and encrypted record of their identity information and the root of trust for their identity. In fact, the individual's identity identifier is bound to a ledger in BFDL, secured by at least one unique public/private key pair. BFDL never holds the private key(s), which the individual controls. Nothing can go into the individual's identity ledger without a digital signature from the private key(s). Whomever has the private key(s) controls the identity. Even multi-signature is supported, providing protection against lost keys and for mapping to complex use cases such as those involving power of attorney and trustees. Since BFDL can support millions to billions of trustless and immutable ledgers, each individual can have their own identity ledger linked to a graph in BFDB.

With Craxel's Digital Trust Platform the secure search, storage, and exchange of identity information becomes quite simple:
• The user creates an identity ledger and receives a unique identifier controlled by one or more public/private keypairs. (This is essentially decentralized PKI and fits nicely with the W3C Decentralized Identifiers (DID) draft specification).
• The user provides information and uploads accompanying documentation
• The user securely sends that to an attestation provider (identity authority) and receives a signed attestation confirming a range of things depending on the use case, e.g. they have a driver's license in particular state, they are who they say, etc.
• Service providers can rely on the attestations for any presented identity, but the actual user information is never revealed or shared with the service provider.

Summary
Craxel's combination of immutable identity records, the ability to securely manage an individual's identity graph with multiple security compartments, and the ability to securely exchange identity information with identity authorities and service providers delivers the foundation of a revolutionary self-sovereign identity management capability. Global self-sovereign identity can become a reality because of the unprecendented privacy, security, performance, and scale delivered by our unique technology.

This post addresses how we efficiently and securely architect a robust self-sovereign identity system. In Part 2 of this post we will address some specific requirements and how our Black Forest Digital Trust Platform uniquely delivers the properties required for a complete solution.