Sybil-Resistant Self-Sovereign Identity Utilizing Attested Execution Secure Processors and Zero-Knowledge Membership Proofs

Through digital transformation, lots of personal data are captured, but individuals often do not have ownership or control over them. This results in the emerging Web 3.0, where people demand data sovereignty. There are actually two conceptually related terms, data sovereignty and digital sovereignty. This paper first explains these two concepts in terms of their points of focus, guiding principles, laws and regulations requirements, and then analyses the requirements and technical challenges of their implementation. To understand the emerging trend shift in digital sovereignty towards individuals taking control of security and privacy preserving over their own digital assets, this paper conducts a systematic review and analysis on Self-Sovereign Identity (SSI), which is a user-centric decentralized model and autonomy for an individual to self-determine the access and use of one's identity and credentials. The review covers existing SSI solutions and points out that an efficient key management system, the scalability and interoperability of the solution, and a well-established standard are some of the challenges for SSI deployment. Finally, the paper concludes with open issues about digital identity, including dynamic attributes, persona, and attribute ownership, that challenge the current reference architecture of SSI as well as its implementation.

Mobile phone touch screen devices are equipped with high processing power and high memory. This led to users not only storing photos or videos but stored sensitive application such as banking applications. As a result of that the security system of the mobile phone touch screen devices becomes sacrosanct. The application of machine learning algorithms in enhancing security on mobile phone touch screen devices is gaining a tremendous popularity in both academia and the industry. However, notwithstanding the growing popularity, up to date no comprehensive survey has been conducted on machine learning algorithms solutions to improve the security of mobile phone touch screen devices. This survey aims to connect this gap by conducting a comprehensive survey on the solutions of machine learning algorithms to improve the security of mobile phone touch screen devices including the analysis and synthesis of the algorithms and methodologies provided for those solutions. This article presents a comprehensive survey and a new taxonomy of the state-of-the-art literature on machine learning algorithms in improving the security of mobile phone touch screen devices. The limitation of the methodology in each article reviewed is pointed out. Challenges of the existing approaches and new perspective of future research directions for developing more accurate and robust solutions to mobile phone touch screen security are discussed. In particular, the survey found that exploring of different aspects of deep learning solutions to improve the security of mobile phone touch screen devices is under-explored.

Current approaches to managing digital identities struggle to meet the demands of ongoing digital transformation. They either create fragmented identities tied to specific online services, making it difficult for users to manage, or they raise concerns about being locked into corporate identity providers and data protection issues. Additionally, they provide limited support for machine-verifiable identity attributes. This reliance on third parties for managing machine identities can put companies at a market disadvantage. Therefore, there is a pressing need for a unified identity management solution that allows for the portable and interoperable use of verifiable identity data across services. The recently announced European Digital Identity Wallet marks a significant step forward in digital identity management. This initiative aims to provide EU citizens with a unified, secure, and convenient way to access both public and private online services, thereby enhancing the efficiency and security of digital interactions and prioritizing user needs. Self-sovereign identity (SSI) forms the basis for such a wallet-based identity ecosystem that supports electronic market growth. However, as a relatively new concept, SSI still lacks a unified theoretical analysis and a thorough exploration of its value propositions for digital ecosystems and networked businesses.

This paper addresses the implementation of an eye detection mobile application for unlocking mobile devices using its built camera as an eye tracker. The implementation allows a real-time face and eye detection of a mobile phone user. The idea behind our development was the creation of a preventive model for the benefit and safety of mobile users, including disabled users (e.g., users with arthritis). The product is a visual application that detects the pupils and can simulate the mouse cursor on the screen to unlock the device. Although some screen lock methods have been already developed, our project aims to complement the security in mobile devices. Moreover, with a new mechanism to unlock mobile devices it would offer a more robust alternative in terms of safety of such devices. Evaluation results suggest our implementation is a promising alternative for security in these devices.

Digital identity is the key element of digital transformation in representing any real-world entity in the digital form. To ensure a successful digital future the requirement for an effective digital identity is paramount, especially as demand increases for digital services. Several Identity Management (IDM) systems are developed to cope with identity effectively, nonetheless, existing IDM systems have some limitations corresponding to identity and its management such as sovereignty, storage and access control, security, privacy and safeguarding, all of which require further improvement. Self-Sovereign Identity (SSI) is an emerging IDM system which incorporates several required features to ensure that identity is sovereign, secure, reliable and generic. It is an evolving IDM system, thus it is essential to analyse its various features to determine its effectiveness in coping with the dynamic requirements of identity and its current challenges. This paper proposes numerous governing principles of SSI to analyse any SSI ecosystem and its effectiveness. Later, based on the proposed governing principles of SSI, it performs a comparative analysis of the two most popular SSI ecosystems uPort and Sovrin to present their effectiveness and limitations.

Self-sovereign identity (SSI) is a new distributed method for identity management, commonly used to address the problem that users are lack of control over their identities. However, the excessive pursuit of self-sovereignty in the most existing SSI schemes hinders sanctions against attackers. To deal with the malicious behavior, a few SSI schemes introduce accountability mechanisms, but they sacrifice users’ privacy. In addition, the digital identities (static strings or updatable chains) in the existing SSI schemes are as inputs to a third-party executable program (mobile app, smart contract, etc.) to achieve identity reading, storing and proving, and users’ self-sovereignty are weakened. To solve the above problems, we present a new self-sovereign identity scheme to strike a balance between privacy and accountability and get rid of the dependence on the third-party program. In our scheme, one and only individual-specific executable code is generated as a digital avatar-i for each human to interact with others in cyberspace without a third-party program, in which the embedding of biometrics enhances uniqueness and user control over their identity. In addition, a joint accountability mechanism, which is based on the shamir (t, n) threshold algorithm and a consortium blockchain, is designed to restrict the power of each regulatory authority and protect users’ privacy. Finally, we analyze the security, SSI properties and conduct detailed experiments in terms of the cost of computation, storage, and blockchain gas. The analysis results indicate that our scheme resists the known attacks and fulfills all the six SSI properties. Compared with the state-of-the-art schemes, the extensive experiment results show that the cost is larger in server storage, blockchain storage, and blockchain gas, but is still low enough for practical situations.

The competency to use mobile devices for work-related tasks gives advantages to the company productiveness and expedites business processes. Thus Bring Your Own Device (BYOD) setting emerge to enable work flexibility and technological compatibility. For management, employees’ productivity is important, but they could not jeopardise the security of information and data stored in the corporate network. Securing data and network becomes more complex tasks as it deals with foreign devices, i.e., devices that do not belong to the organisation. With much research focused on pre-implementation and the technical aspects of mobile device usage, post-implementation advancement is receiving less attention. IS audit as one of the post-implementation mechanisms provides performance evaluation of existing IS assets, business operations and process implementation, thus helping management formulating the best strategies in optimising IS practices. This paper discusses the feasibility of IS audit in assessing mobile device security by exploring the risks and vulnerabilities of mobile devices for organisational IS security as well as the perception of Information system management in mobile device security. By analysing related literature, authors pointed out how the references used in the current IS audit research address the mobile device security. This work serves a significant foundation in the future development in mobile device audit.

The advent of blockchain technology has fundamentally changed digital identity management through secure and self-sovereign identity (SSI) systems. This paper aims to examine the social consequences of these identity systems, especially concerning the more marginalized groups such as those living as homeless or refugee populations. This works relies on literature review and personal experience gained through the VerifiD project at the UBC Blockathon for Social Good by analysing governance and implementation of systems, privacy, and regulatory issues. The paper also discusses North American cases to demonstrate the possibilities of using the system in practice and the attendant obstacles to its implementation and the ethical issues that arise.

How modeling helps in developing self-sovereign identity governance framework: An experience report

The Second Usable Privacy and Security for Mobile Devices Workshop (U-PriSM 2) was held with MobileHCI'13. The U-PriSM 2 workshop was an opportunity for researchers and practitioners to discuss research challenges and experiences around the usable privacy and security of mobile devices (smart phones and tablets). Security often involves having non-security experts, or even novice users, regularly making important security decisions while their main focus is on other primary tasks. This is especially true for mobile devices where users can quickly and easily install apps, where user interfaces are minimal due to space constraints, and where users are often distracted by their environment.Participants had a chance to explore mobile device usage and the unique usable security and privacy challenges that arise, discuss proposed systems and ideas that address these needs, and work towards the development of design principles to inform future development in the area.

The security of mobile devices has become an increasingly important issue especially for the mobile-payment application. Iris recognition is an emerging technology for mobile authentication owing to its high uniqueness and distinctiveness. However, it is a challenging problem because iris images acquired by mobile devices generally have low-quality and the computational resources of mobile devices are limited. In order to track the state-of-the-art algorithms in iris recognition on mobile devices under near infra-red (NIR) illumination, we organized the BTAS Competition on Mobile Iris Recognition (or MIR2016 shortly), which is the first mobile iris recognition competition of NIR images as far as we know. All the participants have to strictly comply with the evaluation protocol to assure fairness. In this competition, three participants submitted six algorithms in total and five algorithms from two participants were qualified. The submitted algorithms were trained on the newly constructed MIR-Train database and evaluated on the unpublished MIR-Test database. We rank the submitted algorithms by the evaluated results in terms of False Non-match Rate (FNMR) when False Match Rate (FMR) is 0.0001.

The development of web technology from Web 1.0 to Web 5.0 has revolutionized the way humans interact digitally, influencing identity, autonomy, employment, government, education, and culture. The modern web is now intelligent, contextual, and emotional, powered by AI, IoT, blockchain, and quantum computing. Digital identities are evolving towards decentralized models such as Self-Sovereign Identity (SSI), while governance is beginning to implement Decentralized Autonomous Organizations (DAOs). The world of work is changing through the gig economy and the token economy, although it comes with challenges in the form of digital divides and algorithmic manipulation. Education and cultural preservation are also digitized through adaptive learning and immersive technology. With this great opportunity also arises the issue of ethics, digital rights, and the need for inclusive and visionary policies. The web of the future must be not only smart, but also fair, ethical, and humane.

Blockchain technology is an emerging and rapidly growing technology in the current world scenario. It is a collection of records connected through cryptography. They play a vital role in smart contracts. Smart contracts are present in blockchains which are self-controlled and trustable. It can be integrated across various domains like healthcare, finance, self-sovereign identity, governance, logistics management and home care, etc. The purpose of this article is to analyze the various use cases of smart contracts in different domains and come up with a model which may be used in the future. Subsequently, a detailed description of a smart contract and blockchain is provided. Next, different case-studies related to five different domains is discussed with the help of use case diagrams. Finally, a solution for natural disaster management has been proposed by integrating smart contract, digital identity, policies and blockchain technologies, which can be used effectively for providing relief to victims during times of natural disaster.

The interest in Self-Sovereign Identity (SSI) in research, industry, and governments is rapidly increasing. SSI is a paradigm where users hold their identity and credentials issued by authorized entities. SSI is revolutionizing the concept of digital identity and enabling the definition of a trust framework wherein a service provider (verifier) validates the claims presented by a user (holder) for accessing services. However, current SSI solutions primarily focus on the presentation and verification of claims, overlooking a dual aspect: ensuring that the verifier is authorized to access the holder's claims. Addressing this gap, this paper introduces an innovative SSI-based solution that integrates decentralized wallets with Ciphertext-Policy Attribute-Based Proxy Re-Encryption (CP-ABPRE). This combination effectively addresses the challenge of verifier authorization. Our solution, implemented on the Ethereum platform, enhances accountability by notarizing key operations through a smart contract. This paper also offers a prototype demonstrating the practicality of the proposed approach. Furthermore, it provides an extensive evaluation of the solution's performance, emphasizing its feasibility and efficiency in real-world applications.

Mobile devices such as smartphones and tablets are widely used for personal and business uses. Compared to personal mobile subscribers, enterprises have more concerns about mobile device security. The challenges an enterprise may face include unlimited access to corporate resources, lack of encryption on corporate data, unwillingness to backup data, etc. Many of these issues have been resolved by auditing and enforcing security policies in enterprise networks. However, it is difficult to audit and enforce security policies on mobile devices. A substantial discrepancy exists between enterprise security policy administration and security policy enforcement. In this paper, we propose a framework, MobileGuardian, for security policy enforcement on mobile devices. Security policy enforcement is further divided into four issues, i.e., sensitive data isolation, security policy formulation, security policy testing, and security policy execution. The proposed framework is secure, flexible, and scalable. It can be adopted on any mobile platforms to implement access control, data confidentiality, security, and integrity.