(bright upbeat music)
- Hello, and welcome to a special edition
of Microsoft Mechanics with Microsoft's Identity CVP
Joy Chik, to cover a brand new solution called
Verifiable Credentials that uses blockchain-based
underpinnings and cryptographic keys to ensure
that you're in control of your own identity online.
So Joy it's been a while,
welcome back to Microsoft Mechanics.
It's great to have you back
and speaking about one of our favorite topics: Identity.
- Thank you, it is great to be back.
- So this whole topic of owning your own identity
is more relevant than ever, now we've all heard stories
or maybe even experienced times where
our identities may have been compromised
or even stolen yet in the digital environment
it's hard to retain ownership of your identity
once you've shared it.
- Right, and that problem compounds every time
you give away personal information
in exchange for a service,
like a bank account numbers and a proof of education,
or even an employment.
And once you give it away, you can't take it back.
It is part of your growing digital footprint.
Think about all of the services that you sign into
every day to enable day-to-day transactions,
or your school ID, or employer-issued IDs.
Once you share your information
it is now in the custody of those different institutions.
It is hard to keep track of the different accounts.
You can no longer control the data associate with them
and you can't take them back.
- Okay, so how do things change then
with Verifiable Credentials?
- This is one of the most exciting
and transformative areas of innovation
that we are contributing to at Microsoft.
A Verifiable Credential is a piece of information
that a third party can validate digitally.
In partnership with the open standards community,
we are implementing an approach
that's based on the W3C standards for Verifiable Credentials
and decentralized identifiers,
to help you share your Verifiable Credentials
without giving up your privacy.
No one company or institution can control
or store your information centrally.
You can revoke your Verifiable Credentials at any time.
- Okay, so how does it all work?
- Let me explain with a real-world example.
There are three parties in this chain of trust,
the issuer, the subject, and a verifier.
The issuer of creates the Verifiable Credential.
This can be an organization or entity
that asserts information about you
like your employer or university.
In this case,
the issuer is the United States Department of Defense.
The Navy MilGears program is piloting a solution
to digitally issue Verifiable Credentials
to each service member.
They are the subjects
who can now easily prove their skills
to an accredited institution, what we call the verifier.
This way, the subject can present credentials
issued directly from the source.
And as a result, hopefully accelerate their career.
- Okay, so can we see it?
- Yes, let me show you this in action.
So here, MilGears
has made its Verifiable Credential service
available to service members through their portal.
To retrieve credentials as a service member,
I just need to securely authenticate.
And then once I'm signed in,
I can access my services history, training,
education and the credentials.
I'm going to pick up where I left off.
Now, if I scroll down,
you'll see the individual digital record
that the DOD is attesting in the Verifiable Credential;
in this case, my high school graduation status.
To accept and activate the credential as a service member,
I can scan the QR code with a supported authenticator app.
And in this case it's Microsoft Authenticator.
This stores a unique private key,
although you cannot see it on my screen,
it is signing me in with biometric proof.
Scanning the QR code stores the verifiable credential
in the digital wallet on my device.
Next, to complete my university application
as a service member,
I need to submit my military credentials.
On a participating university site, in this case Trident,
I just need to sign in with my usual username
and a password.
And in my case,
I know I need to get my high school diploma verified,
so I will click there.
I will click here to verify, and that pops up a QR code.
So I was scan that, and if I'm there,
I'm prompted to approve the request on my phone
by tapping accept.
And once I approve it,
the university can now access my verifiable credentials
within seconds.
And the beauty of this approach is your authenticator app
keeps a record of every time you share your credentials.
- Okay, so for this process to work
clearly there must be incentives then for each party?
- Yes, everyone benefits in this scenario,
the issuer in this case MilGears,
gains a more efficient process
by verifying service member information.
They also don't bear the risk
of storing sensitive personal data.
That data stays with the subject.
The verifier, in this case
the university, can trust the subject's information
because it comes directly from the issuing source.
So they save the time and the cost on background checks.
And as a subject or service member,
I have control over my information
and it can revoke access to it at any time.
As long as issuers and the verifiers
participating in this approach,
you can prove anything about yourself
while retaining full ownership of your digital footprint.
- And that's great because for this approach to take off
there has to be a high level of convenience
really for all parties involved.
But what's enabling the issuance
and verification processes to work?
- Under the covers,
we're using a blockchain-based distributed ledger
with crypto keys as an intermediary.
To participate in this process in Microsoft implementation,
the issuer uses Azure AD with Azure Key Vault
to register a key pair to the blockchain.
The verifier does this using the Verifiable Credential SDK.
During this process,
each party gets a unique Decentralized Identifier,
or DID, that gets written to the ledger
along with the associated public key.
The subject uses the authenticator app
to generate a crypto key pair stored on their device.
Once they accept that first credential,
it is registered on the blockchain with the DID
that is also associated with their public key.
- Okay, so this then allows all three entities
to be looked up in a trusted manner,
all while protecting their privacy?
- That's right, so for example,
when the service member
approved the request for verification
by scanning the QR code,
it's passed to the credentials to the university.
The university were then able to verify the service member's
DID and the issuer's DID by looking up the public keys
in the distributed ledger.
- And all of this happens in just a few seconds.
So it's very efficient and establishes the chain of trust
across you, the issuer and the verifier.
But this is Mechanics so we're going to show you
the key steps to get all this up and running,
starting with the issuer.
Now, while this is based on open standards
and could run anywhere from Microsoft's implementation,
you'll need a couple of services in place as the issuer.
First an Azure subscription,
and also Azure Active Directory Premium or trial,
you'll need to enable your Azure AD tenant
for Verifiable Credentials
and this assigns you with the Decentralized Identifier DID,
and also equips your tenant with a service
so that you can actually issue credentials.
And you can learn more about all of this
by the way aka.ms/DIDForDevs.
And also you'll need an Azure Key Vault and storage account.
- That's right, and then you take just three steps
to configure and issue Verifiable Credentials.
The first step is to connect your tenant
to the distribute ledger.
Here in the Azure Key Vault,
you will generate and manage a pair level crypto keys,
one private and one public.
Azure AD then publishes the DID into the public key
to the distributed ledger,
to manage signing, recovery and updates for your DID.
- Now Azure AD customers can securely manage their keys
to sign the Verifiable Credentials themselves?
- That's right.
The second step is to configure the properties
of your Verifiable Credential.
To do this, you create a rules file,
which is a simple JSON file that defines the properties
for the Verifiable Credentials being issued.
On the left are credential details
from the Azure portal and on the right is VS Code
with the two key files we need to create,
one for rules and one for the card display.
Let's start with the rules file.
You will see that it includes the credential issuers address
that's mapped to their domain address,
much like traditional identity tokens.
An issuer can choose to set an expiration for the credential
expressed in seconds.
Next, it calls out the verifiable credential type
and ties that to learning record schema.
So applications can decipher the transcript
and then map it to their own business process.
And then finally,
the issuer can declare what the user must present
to receive such a credential.
This can be self attested information
found filling out a digital form for example.
It can be one or more ID tokens,
which can come from a traditional identity system
like Facebook, Google, or a work account,
or even Verifiable Credentials from some other issuers.
- And I noticed that this one was actually branded
as MilGears, so how did you do that?
- Well that, let's take a look at our card display file
to configure the look and the feel for the credential.
As I mentioned before,
Verifiable Credentials issued to you
look like just the cards
in your Microsoft Authenticator wallet.
Issuers can customize them
using the card configuration JSON file
that you can see here.
We're able to specify the card's color, icon,
and the text strings to match the MilGears look and feel.
And I can use other fields to let users know
the purpose of the card, its attributes, and much more.
- Okay, so that's the issuer's role,
but let's switch gears to the verifier.
What do they need to do?
- If you are the verifier,
you still need to do a few things for this to work.
To get started,
you need to download the Verifiable Credentials SDK,
and then create your own DID.
You can find that at aka.ms/VCSDK.
You also need to create a QR code or deep link
and then publish to your website or include it in email
to trigger the verification process.
This QR code or deep link will trigger a process
that you can create using the Verifiable Credential SDK.
Let's look at the code that is behind the request
that our QR code links to.
This is a presentation request
to initiate that request for a subject credential.
The verifier receives a response that they can trust
by verifying three things.
Let's take a closer look at the response file
and you will see.
Proof of presentation.
You verify this by matching the signature of the presenter
with the DID of the subject in the credential.
Proof of authenticity.
You also verify the signature of the presenter
by locking up their public key on that ledger.
Proof of issuance.
You verify the signature of the issuer
by locking up their public key on the ledger.
- All right, just to be clear for the user,
it's really easy they're just using the authenticator app.
- Yes, that's right.
Once the subject is issued the Verifiable Credential
it is available as another card in their wallet,
and they can use to prove information about themselves.
- All right, and just like that the circle of trust
with this Decentralized Identity approach is established.
And I liked that you broke out of the conceptual realm
to really show how this gets implemented
with a real example of using the Department of Defense.
But where else do you see verifiable credentials being used?
What's next?
- Well starting with skills verification,
beyond what I just showed you,
imagine even broader applications
like presenting Verifiable Credentials
on your LinkedIn profile,
how cool would that be to help speed up the hiring
and onboarding process?
- Very cool I can see this really speeding up
the job application process.
- And of course, beyond skills,
there's a broad range of scenarios
where verifiable credentials can create more efficiency.
Think of industries like healthcare and finance,
where both privacy and the validating information
that people share is just so important.
- Okay, so for the people that are watching this
that want to try it out, where they go to learn more?
- To get started, you can go to aka.ms/DIDForDevs
to get all of the tutorials.
We're also looking for customers
with a skills verification use case
to join our private preview
and our Decentralized Identity blog
at aka.ms/IdentityBlog/DID
is a great way to keep up to date on our progress
in the space.
- Thanks Joy for being on the show today.
It's always fantastic to have you on
and thank you so much for joining us today.
This is a popular topic
and we hope that we've answered all of your questions
and made it real for you.
And don't forget to subscribe to Microsoft Mechanics
and keep watching the latest updates in this area
and much more.
Thanks for watching, we'll see you next time.
(bright upbeat music)