Mission: "towards a public utility for human usable centric transparency and data control as a public utility " 

Summary 

• SSI - this specification is used to extend the ANCR Record Specification into a Controller Credential for Know Your Business (KYB) interactions and governance control flows.
• the specification addresses inherent risks due to a vulnerability, with technical identifier based systems.
  • the more powerful the technology, , the higher the sensitivity, the  
• this risk is mitigated with a controller credential for proof of transparency and by the performance of data control. 
• Announcement June 9: This work group  calls for interest in ToiP community to support the development and extension of decentralized data governance for decentralized digital identity management.   
This specification, specifies how to generate a controller credential by creating an ANCR's eNotice Record, and then using this record to generate an electronic eConsent Receipt.using DiD for the generation of verifiable credentials, micro-credentials and micro-consent tokens.
• this specification has 3 key objectives 
  1. Addressing a Critical digital trust security flaw - digital security defaults for iDm systems (common baseline)
     1. Address Key Cyber Security and Data gov Liability Issues 
        1. Who control’s, how much control, 
        2. Who benefits, how they benefit  
     2. Who’s in controls cred
     3. Adding x Fields 
  2. Utilizes did’s and VC for controller credential identifier’s
     1. Adding did field
     2. Blinding identity 
  3. Scale International data gov framework for consent  online to SSI /ToiP with eConsent
     1. mapping authoritative data governance roles and human control semantics to the functional roles and semantics of the ToiP governance framework. 

DeCon for SSI: 

• • This document aims to bridge the ISO/IEC 29100  (formalized international security and privacy framework standard that is free) with ISO/IEC  27002 (formalized information security controls)  to the trust over IP governance framework.
  • The method is
    • to specify the extension of  notice records and consent receipts into micro-credentials with  DiD's to generate electronic eNotice and eConsent receipts utilizing ToiP Governance Framework ecosystem. 
  • The controller credential is an extension of the Kantara Initiative, ANCR Notice Record specification, and apart of the  eNotice record and eConsent receipt information structure used for the AuthC (authorization default) Protocol.
• to get access to the current draft - please join a work group call and request it. 

Implementing true SSI with electronic notice and consent - using international governance frameworks for hyperlocal transparency and data control

Introduction

In privacy regulations globally transparency is a key requirement.   transparency is most often represented by the requirements for notice and specifying a legal justification and purpose for processing.

...

• For decentralized digital identity, utilizing decentralized data governance to...

Governance Reference Architecture 

This controller credential utilizes a reference architecture that began with 1980 OECD Guidelines, and has been worked on for international /internet scalable data governance.  This work has driven regulatory reform and convergence internationally. GDPR refer framework for digital. 

...

 be verified and validated for legal proof and evidence. 

Terms & Definitions

The terms and definitions presented here and defined here are in addition to the references, this cover the field names specified for the controller. 

• specific to this spec, (in the annex - mapping semantics between frameworks )
•   

Auth-C: Notice Alert Protocol  

3 Vectors of Governance 

1. Personal Data Control (Gov) - (lower risk) uses micro-credentials 
   1. the individual controls the source of data and verification 
   2. attribute by attribute control 
   3. Logging the access to the attribute for processing 
2. Co-Regulation : multi-party governed - 
   1. Data trusts, where the individual + regulator and service co-regulate
   2. Logging the access to the processing 
3. Data Protection : Self-Regulated -
   1. the service provider regulates the processing of personal data
   2. Signed, verified and open code, with shared logging

3 Tiers of  Controller Assurance

0 - Self Asserted Identifier 

1. Public verifiable 
2. Digitally verifiable & Legal (service delegation)
3. Operator Controller - Certified and legal 

Specification Overview 

This specification builds upon the Kantara ANCR Record specification (and Consent Reciept)(ref) to build a notice controller credential for recording the controller and contract information in a notice. 

...

The field data for the records and receipts are specified from numerous sources, in particular the W3C Data Privacy Vocabulary, for 

Fields Added to ANCR Record to Create Verifiable Credential

ANCR Record spec - is here (enter link)

...

1. Controller Type[Ctype]:  
2. Notice Controller,  
3. PII notice controller,  
4. PII controller,    
5. PII surveillance controller , (info not provided by PII Principle) 
6. [Ctype] controller operator, 
7. Accountable Person Type

Security Considerations

how to specify the 

To address the security gap, the controller credential is presented in a privacy or security notice, prior to surveillance.

...

Human security, discovers or generates a controller credential to create human trust anchor record and credential (dial tone)independent of the Controller/Service provider. 

Type 2: Technical Trust 

Mitigation Risk

Using standard framework for transparency of control with data control defaults 

Micro-Credential 

defined as a credential specified to a specific purpose. 

...

Assessment of transparency and performance of a micro-credential to mitigate risks with SSI

 Examples

1. Security, 
   1. evidence 
      1. fraud, traceabilty
      2. permission and access control transparency. 
   2. Security of Security 
      1. schema struture and use of object identifiers 
      2. NIST - Privacy and Security Control framework 
         1. NIST Language - 
2. Auditing a ToiP implementation

Glossary

Controller Credential 

Micro Credential

Privacy Stakeholders - ISO 29100

Annex: Privacy Stakeholder Mapping to Functional ToiP Roles

Continuing of the ANCR Record Assessment to identify the controller credential,

...

References for Controller Credential, Infrastructure and Legal Framework

Reference: OPN: Open Notice  (+ Consent) Receipt Schema: Starters Guide to Unified Data Control Schema

Lizar, M. & Pandit, H.J., OPN: Open Notice Receipt Schema, 14th International Conference on Semantic Systems (SEMANTiCS 2019), Karlsruhe, Germany, 2019 [Published http://www.tara.tcd.ie/handle/2262/91576 [accessed July 1, 2020]

...