What Is Self-Sovereign Identity, and Could It Impact Higher Education Cybersecurity?

Self-sovereign identity is a new idea in the world of identity and access management, focusing on giving users more control over their digital identity. The promise of SSI is that it will shift the ownership of digital identity back into the hands of individual users and give them more control over how parts of their identity will be disclosed or shared with others.

What Is a Digital Identity, and Who Owns It?

To understand SSI, it helps to contrast this new idea with more traditional ways that people and organizations handle digital identities. Let’s start with the basics of verifying identity through authentication in the following scenario:

A staff member or student we’ll call John has set up an account with the username John1175@example.edu and the password XYZZY. That username and password are credentials, a way for John to verify his identity. We all know that somewhere behind those credentials is more information, like John’s full name, mailing address, date of birth and other sensitive data.

On today’s internet, that digital identity is definitely not owned by John, even if it has personal and private information attached to it. Instead, it’s owned and controlled by the issuer of those credentials (in this case, the university or the vendor that provides the IAM solution).

Choosing Between Siloed and Federated Identities

When onboarding new students, faculty or staff, a university might issue a username and password to each of them upon arrival. That username and password are attached to some internal identifier, and that’s linked — directly or indirectly — to the entire spectrum of information that the university has about the person. In identity and access management, this is usually called a “siloed identity.”

Even if the university has a single sign-on solution and a single set of credentials for every university system, the university still owns and controls that digital identity. The user has no real authority over his or her identifying data because they don’t know what is being shared or with whom. Siloed identity systems are the most common on the internet, which is why everyone needs a password vault to hold the hundreds or thousands of usernames and passwords, a different one for every service.

RELATED: What do higher education institutions need to know about zero trust?

Federated identity, a common alternative to siloed identity, uses third parties to issue credentials and protocols such as Security Assertion Markup Language (SAML) to handle authentication and credential verification. If, for example, you’re offered the option to “login with Google” on a certain website, you’re seeing federated identity at work. With these types of identity services, the application or system you’re logging in to trusts the third-party service, called the Identity Provider (IdP).

Although federated identity keeps your password vault from growing, it doesn’t give you control over your digital identity. If it’s Google that’s issuing the credentials, then Google controls everything: the personal data attached to those credentials along with everything else. If Google is offline, you can’t log in. If Google decides for some reason not to verify you, you can’t log in. If you forget your password and you can’t convince Google it’s you, you can’t log in. Federated identity might be convenient, but it takes privacy and security control of identity out of the user’s hands.

Goals of Self-Sovereign Identity

The goal of SSI is to change the focus of digital identity so that the user assumes greater control over the identity, retaining their privacy. The user decides what information to share and with whom, and SSI also distances the user from the credential issuer, shifting the balance of power more toward the user and away from the issuer.

Before we get too deep into this discussion, it’s important to point out that, at this point, self-sovereign identity is just an idea: some technology concepts and a framework of plans on how it all should work, but no large-scale products. For higher education IT teams, SSI is something to keep an eye on, but it’s way too early to commit to the notion of SSI.

SSI and Higher Education

The goals behind SSI mesh well with cybersecurity strategies in higher education. Because SSI credentials aren’t tied to a particular issuer, students could more easily take their digital identities with them from school to school and employer to employer — including transcripts, degrees and certifications — without the current cumbersome process of verifying against each individual institution. Tasks such as transfers between institutions, even international ones, and degree certification for a job would be simplified and instantaneous in a well-designed SSI project.

Because SSI is built around privacy preservation, students could decide what information they want to share, rather than hoping that the institution follows the individual’s instructions or the institution’s own privacy policies.

SSI also could deliver benefits to institutions that participate, such as reduced opportunity for fraud and tampering. Once information is published on the blockchain, it can be cryptographically verified and can’t be modified by the end user.

Higher education IT teams that want to experiment with SSI will find much to explore. But SSI today is not like InCommon or EduRoam, where a university can easily join and gain the benefits of cross-institution federated identity services. Rather, SSI is a combination of privacy requirements, architectural ideas and technologies that are evolving based on projects and experiences. Although the idea of SSI has been around for nearly a decade, it’s still a moving target, especially in an area like higher education.