Leading the way to a verifiable data network with Findy

The Findy (Finnish Hyperledger Indy) network is owned by a non-profit group of members from both the public and private sectors that has grown to include Nordea, OP Bank, the Finnish Tax Administration, Kela (the Social Insurance Institution of Finland), Nixu, Finnish Post, TietoEVRY and the Vastuu Group. Findy is governed in collaboration by the consortium members and a formal co-operative was established in May 2021, resulting in Findy becoming a legal entity. The Findy network aims to go live in 2022, with widespread adoption in Finland occurring during 2023.

Ville Sointu, Head of Emerging Technology at Nordea, says: “Findy began in 2018 and has existed as a consortium project from then on. At that time, after discussing the feasibility of joining international self-sovereign identity network initiatives, we quickly realised that global networks face challenges when it comes to scaling them to the local level. We are not able to really use data from global networks unless we have a governing rule book and contractual framework that guarantees the source of that data. Delivering these requirements from global organisations and global networks creates a huge challenge.”

“Therefore we took most of the principles of these global self-sovereign identity data networks and transferred them to a local Finnish setting. The idea was to build a similar network but with local governance tied to local laws, local trust systems and local regulations. We also wanted to make sure that we have uniform architecture with other similar initiatives globally so that we can ultimately create interoperability. The reason for the local dimension is that we needed to establish trust from the ground up instead of bringing in a global system to do the same,” adds Ville.

Proving it’s you

The concept of self-sovereign identity relates to an individual or company maintaining control of all of the credentials used to establish their own digital identity. A self-sovereign individual is able to share their credentials wherever they like without requiring permission from a third party. Currently, verifying the validity of online data in terms of its authenticity of origin and integrity of content in the same way as can be achieved offline remains a time consuming and inefficient process. It is hoped that the establishment of the Findy network will create a robust framework for sharing reliable data digitally in Finland.

Ville says: “Identity is just one small part of Findy. I would rather consider this as verified data sharing from a broader perspective. Today our data is distributed in many, many different places. For example, my driver’s license sits with the Finnish authorities, my banking data is with my bank and my shopping data is with supermarket loyalty programmes. Typically the way that we prove our identity in order to be given the right to do something is still done with plastic and paper, such as using a driver’s license as a personal ID when picking up a parcel. On a daily basis, people use various physical documents to prove something about themselves and their rights such as their name, age, qualifications and permits. Although people’s private and business lives have become increasingly digital, we still lack the corresponding tools online.”

In order to overcome the current fragmented and unaligned processes for proving identification, the Findy network aims to build a system that transfers all of a person’s various plastic and paper licenses and certificates into digital equivalents.

Ville adds: “If I’m in a digital world and I need to prove something to an online service, how can I do that so that I can present them with digital proofs, verifiable credentials and the required facts about me? For example, am I allowed to drive? Do I have a bank account? Do I have a job? Have I graduated from university? Am I able to prove these things in a digital way? This is really the question that Findy wants to answer.”

In the wallet

As well as providing a digital trust network in Finland, Findy also aims to develop best practices for building the technical offerings that will be implemented on top of the network. These include digital solutions such as certified wallet applications which will allow users of Findy to store their verified credentials in one place. Using the wallet app, users will then be able to share and control the sharing of this data between parties.

Ville says: “If you think about your physical wallet today and look at what’s in there, you might have bank cards, a driver’s license and your social security card, for example. The idea here is that the digital wallet itself is an independent solution that is separate from the actual credentials. It is just compatible with those credentials.”

Findy provides a framework and set of requirements that enables the digital identification wallets to work. The wallets themselves can be offered by any government department, bank, mobile operator or other provider that wants to offer wallet services for their customers.

Ville adds: “These wallets would then of course compete based on how usable they are and their convenience to the user. Findy will secure that there’s uniform usability across the wallets so that we don’t have separate processes of verification between different wallet providers. There should be some similar kind of standard practice for presenting those credentials regardless of which wallet you are using. At Findy, we want to establish these best practice national standards for the acceptance of verified credentials and the overall requirements for the wallet infrastructure.”

Governed by a rulebook

The Findy network itself will not store any data but rather provide cryptographic proofs that the data an individual presents from the wallet is actually valid and comes genuinely from the certification issuer. Companies and institutions approved by Findy will be bound by a rule book in order to ensure that all provided data is verified.

Ville continues: “At the local level, the Findy cooperative is able to choose which data issuers join the network and ensure that they sign certain liability agreements and the overall rule book. They have to conform to the rules of the Findy network, which are legally binding contracts in Finland, meaning it’s not only about the technology. The governance related to the rule book defines which institutions are allowed to provide a particular credential. If a data issuer misbehaves, we can revoke a credential in real time and inform anyone that previously accepted it that this credential is no longer valid.”

Keeping things interoperable

Findy’s structure is based upon ‘Trust over IP Stack’ architecture, a global framework used as the basis for numerous IT projects around the world. The trust over IP stack approach to building digital trust will eventually enable interoperability with other self-sovereign networks due to the standardisation of the architecture.

Ville says: “The bottom layer of the Trust over IP stack is the Findy blockchain. This is a decentralised network where the Findy cooperative members will each run their own verified node. This maintains the digital trust and is the baseline for making sure that if there’s a finger print and a signature for a certain credential, then that is always verified by multiple entities in the Findy blockchain. The next layer is the wallet or service provider layer where Findy is also active.”

“The idea here is that Findy is truly a neutral infrastructure that doesn’t really create any kind of business functionality or use cases per se, it’s just like an electricity grid or a highway, for example. It doesn’t get to dictate what type of cars are driving on the highway. That’s where the business value is also created.”