As we know , there are other technologies and companies looking for DI solution. Since many of them are popular technologies or huge company with significant investment, we should consider them as risks for our work. At least we have to be aware of what comes new via them to this ecosystem. So a classification is required.
1- Companies with centralized Identity on the way of decentralization (GAFAM)
Cloud identity refers to a set of technologies, protocols, and practices that enable managing and controlling user identities and access to digital resources in cloud-based environments.
It empowers organizations to securely authenticate, authorize, and manage user access across cloud services and applications. Cloud Identity leverages the power of the cloud to centralize identity management, simplify administration, enhance security, and improve user experience.[1]
Cloud Identity is an Identity as a Service (IDaaS) solution that centrally manages users and groups. You can configure Cloud Identity to federate identities between Google and other identity providers, such as Active Directory and Microsoft Entra ID (formerly Azure AD).[2]
Identity management, access controls, and governance are foundational security pillars for organizations of any size and type. As you migrate to and modernize on AWS, your security and IT teams can adopt modern cloud-native identity solutions and Zero Trust architectures to securely support hybrid workforce productivity, provide builders and customers access experiences with less friction, apply and audit permissions toward least privilege, and help meet stringent compliance mandates.[3]
Meta wants to raise the privacy bar higher by de-identifying users while still maintaining a form of authentication to protect users and our services. So, it leveraged the anonymous credential, collaboratively designed over the years between industry and academia, to create a core service called Anonymous Credential Service (ACS). ACS is a highly available, multitenant service that allows clients to authenticate in a de-identified manner. It enhances privacy and security while also being compute-conscious. ACS is one the newest additions to our privacy-enhancing technologies (PETs) portfolio and is currently in use across several high-volume use cases at Meta.
At a high level, anonymous credentials support de-identified authentication by splitting authentication into two phases — token issuance and de-identified authentication. In the token issuance phase, clients contact the server through an authenticated channel to send a token. The server signs and sends it back. Then, in the de-identified authentication (or token redemption) phase, clients use an anonymous channel to submit data and authenticate it utilizing a mutated form of this token rather than a user ID.
We’ve greatly simplified the nuances in the protocol. The signed token (token issuance phase) and redeemed token (de-identified authentication phase) cannot be linked. This property enables the server to authenticate the client in the second phase without knowing which specific client the token belongs to, thus preserving user privacy.[4]
Apple provides your organisation with various identity services to help you manage passwords and usernames securely — both across your workplace and in the cloud. Apple uses security measures like authentication, authorization and identity federation, so that individual users can access their favorite apps and other resources without, for example, the additional hardship of setting up usernames and passwords for each one.[5]
Apple uses Keychain App to protect sensitive data. Keychain can contain various types of data: passwords (for websites, FTP servers, SSH accounts, network shares, wireless networks, groupware applications, encrypted disk images), private keys, certificates, and secure notes. But pay attention that Keychain is not a blockchain-based App!
Microsoft Entra Verified ID: Microsoft has been actively involved in decentralized identity solutions. They have developed technologies like Decentralized Identifiers (DIDs) and verifiable credentials to enable self-sovereign and decentralized identity management. It has contributed to open-source projects like the Decentralized Identity Foundation (DIF) and is working on initiatives such as the Microsoft Authenticator app. Microsoft Entra Verified ID Service is an issuance and verification service in Azure and a REST API for W3C Verifiable Credentials that are signed with the did:web method. They enable identity owners to generate, present, and verify claims. This forms the basis of trust between users of the systems.
2- Competing Technology
IBM: IBM is another company that has shown interest in decentralized identity. They have been involved in standardization efforts and have explored the use of distributed ledger technologies for decentralized identity solutions. It is including IBM Verify Credentials, which allows organizations to issue and verify digital credentials using blockchain technology.
Decentralized Identity Foundation (DIF): DIF is an organization focused on developing open standards and protocols for decentralized identity. They work on emerging standard specifications and open-source code to drive the development of decentralized identity solutions. Members include Companies like Microsoft, IBM, and Consensys.
Evernym: Evernym company specializes in self-sovereign identity solutions and offers the Sovrin Network, an open-source decentralized identity network built on distributed ledger technology.
1Kosmos is a company that focuses on distributed identity solutions. They aim to provide secure and privacy-preserving identity management using decentralized technologies. BlockID is A distributed identity cloud service that unifies identity verification and passwordless authentication. 1Kosmos BlockID is a fully standards-based platform for complete user authentication. BlockID takes the strengths of decentralized identities, and adds layers of security, user biometrics, and hardware-backed YubiKey authentication to effectively protect access to systems. It is a certified solution for NIST 800.63.3, UK DIATF, FIDO2, iBeta DEA EPCS, ISO 27001 and SOC II. Compliant to GDPR standards. [6][7]
DID Alliance: DID Alliance is an open industry association for decentralized identity (DID) services that ensure the credibility of digital identity.
3-Marketing
Market Growth Challenges: Expanding the service’s market can be difficult.
Identity programs often need to fill a supply/demand gap in a marketplace, needing to persuade both users and service providers to join their identity ecosystem, rather than use existing or alternative services. This can be true whether the service is centralized, federated, or completely decentralized.
This means that often, digital identity services take much longer to scale than originally planned. Without sufficiently attractive and useful services onboard, the case for signing up may not be clear to citizens, and without sufficient volumes of verified users, service teams may not see the value in the identity service, and may wait for growth. Without sufficient uptake, for new services, the work required to make services truly self-service based on the trust in the identity, can be harder to justify. [9]
4- Environmental cost
5- Funding: A particular scarcity risk, due to lack of funding.
References:
[1] https://www.loginradius.com/blog/identity/what-is-cloud-identity-and-its-benefits/
[2] https://cloud.google.com/identity/docs/overview
[3] https://aws.amazon.com/identity/
[4] https://engineering.fb.com/2022/03/30/security/de-identified-authentication-at-scale/
[5] https://support.apple.com/en-ie/guide/deployment/depa64848f3a/web
[7] https://www.yubico.com/works-with-yubikey/catalog/1kosmos-blockid/
[8] Travel Identity of the Future—White Paper; Technical Report; ShoCard: Cupertino, CA, USA, 2016
[9] How to control your biggest risks in digital identity