Do traditional IAM systems have a future?

1. Introduction to the topic and brief presentation of esatus AG

I would like to welcome you from Berlin and would like to give you a kind of „pioneering impulse“, because I am currently at the IT Security Law Day of the German IT Security Association, TeleTrusT, which can be described as a pioneer in IT security. My impulse deals with the topic of Decentralized Identity and represents a very important, fundamental architectural component that can be easily integrated into existing IT landscapes. As we have seen, the topic of AI also provides a certain amount of cause for concern and for action in the area of decentralized identity.

The term Self-Sovereign Identity – SSI for short – has already been mentioned in the introduction. Let’s take a look at what SSI now means and what the community has to say about it.

I would like to start by briefly talking about esatus AG, because we are often seen as an SSI or Decentralized Identity start-up. However, we have been on the market for three and a half decades – back then, digitalization was still referred to as IT! esatus deals with all topics relating to development operations, identity, security and especially decentralized identity. We are also very active internationally in various programs and community projects that many people around the world are working on.

Since 2015, esatus has been committed to the topic of Decentralized Identity, which we saw as an obvious solution. However, we have since realized that it is more of a marathon and that implementation is still in the starting blocks. There are currently still a few „waiting positions“ due to EU legislation.

2. Artificial intelligence and deep fakes

As we heard this morning from one of the previous speakers from California, AI naturally offers us better solutions for some exciting topics. On the other side, the „dark side“, this of course also gives rise to very different threat vectors.

Some of you have probably already seen the video „This is not Morgan Freeman“, which shows very strikingly how you can put words into the mouth of a person – in this case a person of public interest – that they know nothing about. These are so-called „deep fake AI videos“. I also just received a video from a colleague that clearly shows how Chinese influencers are now optimizing their work by simply producing deep fake videos that they can use 24/7 to soundtrack their community, even though they may be lying on the beach…

We therefore assume that we cannot build any kind of mutual trust in the online world if we do not carry out mutual authentication to know who I am actually talking to on the other side. This threat is very real, as these examples illustrate very well.

3. Architecture models and Zero Trust

There are of course great architectural models, and we have already heard a lot about them from the previous speaker, Ms. Roth.

In the area of authorization management and access control, there is the so-called zero-trust architecture model, which means that I must always assume that my systems are already compromised, that the attacker is already in my networks and that I have a problem. In other words, what we call traditional perimeter protection – a network secured by a firewall, etc. – is being completely called into question and converted to a zero-trust architecture model. The American government is now also very strongly demanding this.

It is essentially a NIST-defined architecture model, which you can see here on the slide.

Zero Trust means that, in principle, every access to a system, whether machine to machine or by a person, must always be authenticated and that this authentication decision must always be made individually. This can be done by a policy engine, a policy enforcement plan or similar, which will not be discussed in detail here.

So the basic assumption is that we no longer have comprehensive perimeter protection, but that we have to authenticate every type of access in principle, at the time when it takes place and at the – let’s call it that – mini-perimeter of the application where it occurs.

The German Federal Office for Information Security (BSI) also very much welcomes this approach. However, Zero Trust is not standardized, it is very difficult to implement and maintain because you always have to define a policy that sets out the rules according to which you can access the system. This naturally requires a great deal of maintenance.

4. IAM and Decentralized Identity

Anyone who is familiar with Identity and Access Management (IAM) knows that an authorization concept has always had to be in place that defines „Who is actually allowed to do what in which system?“ We heard the frightening words from California from a previous speaker: „If I dump all my secret content into the AI, how am I supposed to do access control?“ An important impulse and an exciting challenge, because this is exactly the situation we have to deal with at the moment! It is therefore necessary for us to develop an authorization model or concept, which must then be transferred to a zero-trust architecture and maintained.

If we now ask ourselves how this can be made possible and what factors facilitate the implementation, the terms SelfSovereign Identity and Decentralized Identity come into play.

If you ask companies whether they already use Decentralized Identity, i.e. whether they work with verifiable credentials and digital wallets, the probability that the answer will be „yes“ is extremely low. This is because it is a paradigm that first has to take hold, i.e. it first has to be perceived as a relevant factor in architecture models for companies and public organizations. Although our own company is using it for some customers and ourselves, it has not yet been rolled out across the board.

I would like to provide a little more background information here and illustrate the basic idea behind Decentralized Identity: ideally, you have an electronic wallet app on your smartphone, a digital wallet so to speak, in which your digital credentials are stored. The common international term for this is „verifiable credentials“. This can be an identity document, i.e. an ID card, a doctor’s certificate, a diploma, a certificate, an employee ID card, a bus ticket or a concert ticket. Everything that you usually have in paper form could be transferred to a credential and made available in your own wallet. This way, I have complete control over who can request such data and then receive it from me.

Via this wallet and the credentials, the end user regains a more powerful decision-making position with regard to their data.

For example, if the company esatus wants to see your electronic identity document, it will send a request to your wallet. If you know esatus and can understand why the company needs the document, you will release it. However, if you walk past a coffee shop and they want all your credentials in exchange for a free cappuccino – then of course you won’t release them. Basically, the idea is that you can release your data to authorized interested parties in a self-determined way.

We call the whole topic Decentralized ID. It used to be called SSI (Self-sovereign Identity) because of the self-determined decisions I can make. The community was not so happy with this for various reasons and therefore prefers the term decentralized identity management.

The construction is therefore very simple: there is someone who can make the justified statement: You are an employee of esatus. The person sends you a corresponding credential to your wallet. You can then identify yourself to third parties as an esatus employee and they can verify that the credential was issued by esatus and has not been revoked in the meantime. This ensures a very high level of security.

This paradigm and the mechanisms behind it are identical regardless of the use case. Whether it’s healthcare, travel or banking – someone always makes a statement, packs it into a data package and this can then be reused elsewhere.

This is also underpinned by so-called Decentralized Identifiers (DIDs), which are pseudonymous characteristics, so to speak, with which these connections between the identities are established, which we will not go into at this point.

Sovrin was a pioneer in this area, building a network and presenting the principles of SSI very clearly, with a focus on the authorization of the end user by means of the decentralized ID. The user can make decisions and can also delegate rights to people they deem authorized (e.g. in the case of a child who is not yet legally competent or an elderly person who is no longer capable of acting). It is about maximum privacy and that the end user decides on their own data.

5. The European Digital Wallet, eIDAS 2.0 and the ARF

We now have the great good fortune – and at the same time the curse – that this paradigm has now penetrated so far that it is seen as a relevant approach at all regulatory levels. There are currently efforts to raise the eID law for Europe, the so-called eIDAS regulation, to a new level 2.0. Inherently linked to this is that there should be a European Digital Identity Wallet. This means that eIDAS 2.0 should not only enable personal identification and regulatory signatures, but also the management of precisely those non-sovereign documents that I have just listed. Ideally, both the proofs issued by the administration itself and the proofs issued by private-sector companies (employee ID cards, admission tickets) should be managed in the EU Digital Identity Wallet.

However, some complexities still need to be resolved: it is not ideal for lawyers or political decision-makers to write technical specifications. This has led to a group of experts drafting the Architecture and Reference Framework (ARF) for the EU. This sets out technical framework parameters that will later ensure interoperability. Whether this will actually succeed is another matter, and I will come back to this in a moment. But in principle, it would be possible to use this ARF to create an architectural basis for the use of interoperable EU wallets. Version 1.2 was announced a long time ago, but is now massively delayed. This provides an indication of the speeds that can be expected here.

The trust ecosystem is fundamentally not a simple matter, as many different relevant roles are required. I am only mentioning the trust service providers here, which can play a major role based on eIDAS 1.0 so that they can issue certificates. Anyone wishing to delve deeper into this highly complex model is welcome to read about it in the publicly accessible ARF. It is important to understand: we are not starting from scratch, there are already eIDAS 1.0 and existing services that run under it. This includes the electronic ID card in Germany, which has not yet become a successful model because it is neither useful nor easy to use, i.e. it cannot be used almost anywhere. Basically, the aim is to make everything very simple for an EU Digital ID Wallet and to maintain the highest level of security.

It should also be mentioned that there are two technological strands that are more or less hard-coded and represent a very simple model for issuing credentials: the so-called Jason Web Token or selective disclosure Jason Web Token. There is also an approach that follows the ISO standard 18013/5, the so-called Mobile Driving License Standard, which can of course also be used for issuing other types of credentials. These can be described as the cornerstones for credentials. Other solutions can also be pursued, but not in the sovereign area. It is obvious that there is a lively debate about what can and should be used. The identity community is sometimes somewhat dogmatic when it comes to the various credential formats. A lot of work has been done over the last 18 months to objectify the discussion and avoid exaggerating the religious wars.

The so-called NIScy consortium (NetCompany Intrasoft and Scytales AG) is currently tasked with developing a reference implementation of such a wallet, but this has already been delayed. It is interesting to note that the four large-scale pilots (LSPs) launched by the EU are already underway. These are, of course, intended to implement the architectural specifications, but they are neither ready nor is there a reference implementation in the wallet. In terms of sequence, this is more of a „back through the chest into the eye“, but overall a very welcome commitment.

6. Time frame

The eIDAS 2.0 law does not yet exist, the trilogue negotiations are currently underway and it is not foreseeable whether the law can be passed this year. Even then, we cannot expect anything next year. Once the law is in place, will the implementing acts follow, which will determine what the individual member states actually have to do to implement the law? These negotiations are likely to take 12 months, and then another 24 months until the law has actually been examined. Just think of the General Data Protection Regulation – there was also a so-called burn-in phase here. The law was actually passed, but there were still 24 months to apply it.

If we get something that becomes part of the reality of life for EU citizens in 3+ years, we can be happy. That’s why I’m cautiously optimistic that this regulatory measure will achieve something quickly. The industry is waiting in the wings, but is still holding back on investment due to the current lack of clarity.

7. What is the situation in Germany and worldwide?

I would first like to briefly discuss what is currently happening in Germany:

Germany is very active and, as one of the key stakeholders, has extreme market depth. The BMI has opened a consultation process on eIDAS 2.0 and the EUDI wallet, in which anyone can participate. The kick-off event has already taken place, as has an initial workshop on use cases; the next step will be to examine possible business models for the private sector. The commitment is also very welcome, but when you look at the budgets for these projects, doubts arise. According to the answers to a question from the CDU/CSU parliamentary group in the German Bundestag, the budgets for these projects have tended to fall in recent years.

esatus is of course also looking at how this system can be used on a large scale and, above all, in an overarching context. A wallet would be conceivable for companies, allowing them to place each other in a position of trust in order to exchange data or interact with the wallets of natural persons. esatus has built a solution for this. In principle, it can be assumed that participating organizations should have an org-wallet or at least the ability to issue and process credentials. Dealing with trustworthy data across organizational boundaries in different areas will be a very exciting field as soon as this takes hold.

In terms of use cases, there are no limits to the imagination. This would be a huge topic for international trade, and banks would also benefit greatly from such mechanisms when opening accounts.

I mentioned at the beginning that this is not a local issue; there is a lot of activity going on all over the world.

8. Future of identity and access management

Finally, I would like to recapitulate the importance of this topic for the IAM market.

At the last major conferences dedicated primarily to identity and access, such as the Identity and Cloud Conference in Berlin, it was clear to see the spirit of optimism that prevails throughout the IAM industry. The industry is embracing the topic and it is clear to everyone that the decentralized identity paradigm is here to stay, even in the traditional world.

I have shown a few examples on the following slide: The OWF Foundation is supporting this as an open source project and it can be seen as a kind of accolade that Google and Microsoft have become members of the OWF.

This year will see a really massive take-off. We have seen in the classic IAM world that the huge companies Ping Identity and Forge Rock have now merged under one roof. The whole IAM market itself is still growing at up to 15% annually, projected to 2028. The Decentralized Identity market – once it starts – will see growth rates of 88 % over the years. We have already seen several acquisitions in this area.

As soon as applications are launched on a large scale, the floodgates will open for companies‘ investment decisions to make this technology usable. That is why we at esatus AG have been happy to be involved for eight years and will continue to work on making the topic a major global success. It is important to us that it is not dominated by the big platforms again, but that open standards and protocols are made possible that help it to become part of people’s lives. so that it is easy to use and useful for them.