The Root of Trust? Rebooting Trust Management in X-Road®

Introduction

Enabled by rapid digitization, organizations strive to benefit from collaborative work to get a competitive advantage by delivering unique products for end customers. Businesses create supply chains to deliver products and services. Governmental agencies collaborate to provide services that help the nation’s well-being. What unites them is a business need for communication with external entities to deliver the expected value. Organizations need to know with which entities they exchange information, and to be sure that the communicating party is the one it claims to be. In turn, communication between organizations per se and their information systems (ISs) requires trust.

Trust is one of the basic concepts around which businesses and security are formed. A root of trust (RoT) is an axiomatically accepted point to be trusted. The most commonly used centralized RoT assumes that there is a third-party centralized authority the organizations choose to trust. Such authority is the key enabler and assurance of the security of the organizations’ ISs. The authority claims which entities can be trusted, and organizations rely on the accreditation and quality of the authority’s staff. The security of ISs heavily depends on the cryptography that is built over the root of trust. As a result, organizations that use ISs based on the centralized RoT are prone to a single point of failure.

Recent works have focused on developing the alternative to the centralized RoT – the self-sovereign identity (SSI) ecosystem. Self-sovereign identities are managed in a decentralized manner without relying on a single provider for storing and managing the identity’s data. The algorithmic root of trust is decentralized and founded on the trust in the cryptographic mechanisms and the algorithms’ correctness in the information system.

X-Road© is open-source software and ecosystem solution that provides unified and secure data exchange between organizations. In essence, X-Road is a data exchange layer between information systems that enables organizations to communicate securely. X-Road serves as the backbone of the Estonian, Icelandic, and Finnish digital government infrastructures. Moreover, it has been facilitating the digital government revolution in several other countries worldwide. Currently, X-Road relies on a centralized root of trust and identity management. Our goal is to propose a decentralized approach for identity management in X-Road by embracing the SSI principles. The report presents the enterprise modelling results from the perspectives of functions, processes, resources, and trust. The lessons learnt are threefold. First, we have observed how embracing SSI through decentralized IdM could affect the trustworthiness of the secure data exchange system. Second, we have defined which enterprise system components and processes should be changed to enable automated identity management. Lastly, the results show how conceptual modeling supports the current state analysis and the transformation to be made in X-Road on the path toward SSI.