Open Source Summit Europe 2024

This talk will provide an overview of current developments in the world of decentralized identity (aka self-sovereign identity). The communities around this paradigm are growing fast, as major initiatives such as the European Digital Identity Wallet and many others are launched around the world. We will also take a closer look at the underlying technical standards, such as Decentralized Identifiers, Verifiable Credentials, OpenID4VC, and others. Finally, we present examples of concrete applications, services, and software tools that currently exist in this space.

1. The rise of decentralized identity (2-3 min): Setting the stage by elaborating what decentralized identity is and how it works.


2. Why now (5-10 min): Elaboration of trends and enabling factors for decentralized identity:

• new regulations (e.g. eIDAS2, TFR, AMLR)
  
• emerging identity ecosystems (e.g. EBSI)
  
• wallet adoption (payment, crypto)
  
• standards maturation (e.g. W3C, ISO, OIDF)
  
• OSS & developer infrastructure.
  

3. Adoption (5-10 min): Selected “real world” case studies are presented. For example:

• Public sector project in MENA with use cases in the government, education, employment, travel, etc.
  
• Banking consortia in Asia with use cases in financial services and taxation
  
• Fintech scale up with user onboarding, KYC & KYB use cases
  
• Blockchain & DeFi protocol with permissioned DEX & TFR compliance use cases
  
• Identity provider and universities with cross-border education use cases (onboarding, auth, diplomas, studentID)
  
• Public insurance authorities with cross-border use cases in government, insurance, health care
  
• Insights into EU Large Scale Pilots (EBSI, eIDAS2)
  

4. How to get started (2-3 min): Build future-proof identity and wallet infrastructure with open source software.

Explore the transformative power of open source technology in the public sector in this dynamic session. Join government leaders, policy makers, and tech innovators as they showcase groundbreaking projects, share success stories, and discuss the future of open source in enhancing public services. Learn how open source solutions are driving community-driven development, creating sustainable and resilient infrastructures, and improving accessibility and efficiency in public sector operations. This session will highlight the crucial role of open source in building a better, more connected society.

For the modern computing architectures involving multiple independent workloads and following the zero trust model, it is important that the calls between the workloads be properly authenticated and authorized. SPIFFE/SPIRE does solve the authentication part; however, it does not take into account the request context and other dynamic data. A new Internet draft called Transaction Tokens has been adopted by the IETF OAuth Working Group, which addresses the authorization part. A transaction token is a short-lived, cryptographically signed, request-specific token obtained from the new Transaction Token Service in exchange for the external OAuth/OIDC access token and other context-dependent data. The token is then included into every inter-workload call, which guarantees that only non-spurious calls between the workloads can take place. From this talk, the attendees will learn about how Transaction Tokens work, how they help to make the internal perimeter more secure, how we implemented this upcoming specification using a customized version of Keycloak, what challenges we faced and how we solved them.