00:00:14Credential Sharing in Data Management
00:15:46Web Wallets and Credential Storage
00:22:43Verifiable Credentials for Energy Sector
00:34:05The Exciting Potential of Verifiable Credentials
درباره این اپیزود
Credential sharing is complex and exciting. Take a listen to our guest, Dan Stemp from JNCTN, in this installment of Making Data Better. We discuss JNCTN's credential sharing platform and its major use cases.
Discover how managing digital identities supports the work of critical industries, from power generation to healthcare. We unpack the intricate relationships between those who rely on credentials, the individuals who hold them, and the authorities who issue them.
Dan tells us the story of his firm's evolution from card personalization bureau to today's digital credential management scheme. We discuss the firm's clients' transition from physical tokens to digital credential presentation. Of course, we discuss wallets because they are the natural containers to hold verifiable credentials and we address JNCTN's proprietary approaches, the W3C, and big players like Apple and Google.
Implementation of systemic systems is never easy. JNCTN has multiple stakeholders to convince. We examine enterprise adoption and the leverage points that resonate with the relyingn parties, the risk owners, who deploy these systems. It's not just about risk mitigation and operational efficiency.
So, take a listen as Dan, Steve, and George share their enthusiasm for verifiable credential sharing and the breadth of applications ahead.
انگلیسی
ایالات متحده آمریکا
یادداشت ها را نشان دهید 🔗
رونوشت 🔗
WEBVTT
00:00:14.192 --> 00:00:22.631
Welcome to Making Data Better, a podcast about data quality and impact it has on how we protect, manage and use the digital data critical to our lives.
00:00:22.631 --> 00:00:29.286
I'm George Peabody, partner at Lockstep Consulting, and thanks for joining us With me is Lockstep founder, steve Wilson.
00:00:29.286 --> 00:00:29.908
Hi, steve.
00:00:30.961 --> 00:00:32.226
Hello George, happy new year.
00:00:32.226 --> 00:00:36.729
I hope it's some off to a good start for you and great to be talking with you again.
00:00:38.180 --> 00:00:45.850
After a great start, we're actually expecting, finally, our first snowfall in Boston over the weekend, so I'll be getting into the hot tub after I do all the snow shoveling.
00:00:45.850 --> 00:00:59.770
So, steve, today we're going to take a look at the power of credential sharing, some examples of what's possible when we address safety and security concerns through the use of the right credentials, presented at the right time.
00:00:59.770 --> 00:01:11.722
And to do that, we're fortunate enough to be looking at a company that operates what we're calling credential management service and system that has to work with all the stakeholders in its system.
00:01:11.722 --> 00:01:21.909
What is really intriguing about this model where you do everything, where you are a credential management service serving everybody?
00:01:21.909 --> 00:01:26.468
You've got to work with all the parties, all the stakeholders, in the identification process.
00:01:26.468 --> 00:01:34.248
So you've got to get the party that's taking the risk, what we call the relying party on board, whether it's the physical or digital worlds.
00:01:34.248 --> 00:01:44.430
The provider has to make it easy to grant access to a service, speed the process, log each of those accesses, trust the validity of the credentials presented.
00:01:44.430 --> 00:01:57.489
In other words, the relying parties want the ability to control access, know what each credential presenter is, who each one is, subject, referred to as what they're certified to do, and again to log each of those interactions.
00:01:58.519 --> 00:02:06.188
Then the service provider has to get the capability into the hands of the subjects, the holders and presenters of the credentials on board.
00:02:06.188 --> 00:02:14.848
So they've got to answer the question of what's in it for the subject easier to get into a building or is it easier to access an online service?
00:02:14.848 --> 00:02:25.008
Maybe it's putting a QR code in front of the guy at the gate instead of a booklet full of stamps that say that someone's been certified to do a job?
00:02:25.008 --> 00:02:28.348
And the third party, of course, is the issuer of the credentials.
00:02:28.348 --> 00:02:36.925
Think about a registry motor vehicles or an educational institution or a training company that provides certification.
00:02:36.925 --> 00:02:46.348
Those credentials have to be in the hands of the subject to be presented to the relying party in order to make a complete loop of the transaction.
00:02:47.560 --> 00:03:01.729
One of the beauties of the service provider that does all the work is that they got great visibility into what users are doing on all hands, whether it's the relying party, the subjects themselves, the folks who are presenting the credential.
00:03:01.729 --> 00:03:14.048
And given that visibility, given the fact that they're seeing interactions everywhere, they can actually respond to new changes, new requirements pretty quickly and push that capability out.
00:03:14.048 --> 00:03:34.788
Steve, let's illustrate this in the context of identification and credential sharing through talking with, I'm happy to say, junction, a New Zealand company that has assembled a solution that addresses the needs of each of those three parties the relying party, the party taking the risk, the subject and the credential issuer itself.
00:03:34.788 --> 00:03:40.074
So to do that, let me welcome Dan Stemp, who is Junction's chief customer officer.
00:03:40.074 --> 00:03:41.478
Dan, welcome.
00:03:42.118 --> 00:03:42.360
Thank you.
00:03:42.360 --> 00:03:43.724
Hey, look, thanks for having me, guys.
00:03:43.724 --> 00:03:51.967
I'm really excited to talk today about the work that Junction's doing and look verifiable credentials as a whole.
00:03:51.967 --> 00:03:59.626
Look, it's such an exciting topic and we kind of refer to it as the you know and lots of other people do is the new gold rush.
00:03:59.626 --> 00:04:08.812
You know this idea of owning your own information and being able to use it whenever you need to use it, knowing who has access to it.
00:04:08.812 --> 00:04:13.770
This is important stuff and we're really excited to be in this space.
00:04:14.961 --> 00:04:16.446
We're so excited to have you on the show, dan.
00:04:16.446 --> 00:04:22.351
We met on the other side of the planet for you and me at least, is Antipodeans.
00:04:22.351 --> 00:04:28.932
We had a great time at Identiverse in Las Vegas with George last year.
00:04:28.932 --> 00:04:30.987
It's fantastic, isn't it?
00:04:30.987 --> 00:04:36.180
You go to the other side of the planet to meet people that are almost next door we also.
00:04:36.180 --> 00:04:45.266
When we were chatting, we found that we three have been in adjacent areas of business now for decades, so I found the history of Junction really fascinating.
00:04:45.266 --> 00:04:48.012
Could you recap that for us right now?
00:04:48.916 --> 00:04:50.000
Yeah, yeah, look, I'd love to.
00:04:50.000 --> 00:04:59.086
And, george, I'm going to pinpoint a word that you just used in your intro there with visibility, and it's a key part of Junction's learning.
00:04:59.086 --> 00:05:03.204
And, again, the word I'm going to use quite often during this is journey.
00:05:03.204 --> 00:05:13.002
Through Junction's journey, we had a lot of learnings when we owned a large scale card production and personalization bureau.
00:05:13.002 --> 00:05:24.345
So we were in the business of delivering physical identity tokens to individuals to showcase who they were, whether they had a particular skill or qualification or work authority.
00:05:24.345 --> 00:05:59.805
So, having that visibility of the information that we were producing for individuals and having that visibility of those individuals themselves and what they did with those physical tokens hold them in plastic card wallets, information in the vanilla folders we had this insight into how we could create better user interactions for these individuals by using emerging technology like verifiable credentials and building software was not new for Junction as an organization.
00:06:00.375 --> 00:06:15.805
As part of our card bureau offering, we had an online ordering tool, so essentially an online portal for our customers to input data around the individuals who were receiving these physical tokens and the information that was going on these tokens.
00:06:15.805 --> 00:06:24.721
So think firearms license and what your authorities were under your firearms license, what classification of firearms you're allowed to hold on to.
00:06:24.721 --> 00:06:30.158
This is all information that we would print onto a physical token for an individual to put in their wallet.
00:06:30.158 --> 00:06:41.963
So we saw the opportunity to create these digital interactions, of those physical user interactions that people will be having out in the world.
00:06:41.963 --> 00:07:00.439
And specifically, we've taken a focus on our high hazard industries and really that's just out of need and necessity, because we have heard that there are problems and we've had people approach us within those industries that they have problems and they think we can solve them.
00:07:00.439 --> 00:07:13.199
So yeah, coming from the card bureau industry has given us a massive amount of insight into the amount of credentials that people actually hold on to, and it's not just one to three.
00:07:14.134 --> 00:07:21.807
We see all those common areas which are really, conceptually, it's an analog to digital conversion, isn't it?
00:07:21.807 --> 00:07:29.783
You take information from sources of truth, you have some way of quality assuring that information and then you package it on behalf of subjects.
00:07:29.783 --> 00:07:34.663
They then hold it in a plastic card or a digital wallet.
00:07:34.663 --> 00:07:42.740
I guess Can we dig into this sort of infrastructure and that common ground, what you've had to build and what you've had to leverage.
00:07:42.740 --> 00:07:53.745
And I guess we could also ground this conversation relative to COVID, because we love what you guys did relative to COVID, so maybe you can use that to illustrate and underscore how your infrastructure works.
00:07:54.836 --> 00:07:55.940
Sure infrastructure.
00:07:55.940 --> 00:08:01.355
Firstly, we've got to build something that's scalable.
00:08:01.355 --> 00:08:08.495
If it's not scalable, if it's not secure, it's not something that we want to have as infrastructure behind us.
00:08:08.495 --> 00:08:12.706
Because this needs to be scalable, it needs to be secure.
00:08:12.706 --> 00:08:17.185
So at the core of all of this really is data.
00:08:17.185 --> 00:08:22.809
It's important to understand again the journey of what we've built.
00:08:22.809 --> 00:08:30.247
But kind of underneath it all, we have set of tools for people to interact with us.
00:08:30.247 --> 00:08:34.706
We have a digital wallet for holders to hold verifiable credentials in.
00:08:34.706 --> 00:08:44.981
We have an issuing platform that allows issuers of credentials to create a credential catalog and issue those to individuals.
00:08:44.981 --> 00:08:52.268
We have an admin portal for enterprises to use to consume that data.
00:08:52.268 --> 00:09:05.700
So, whether I employ 200 people and I want an overview of the credentials that those 200 people have, we have an admin portal that allows you to access that information, all permissioned by the individual.
00:09:05.700 --> 00:09:23.957
So an enterprise can't always be looking for a request when they need to access information around an individual and their work authorities or skill sets and I want to caveat this all the way all the time this is under permission from the individual.
00:09:23.957 --> 00:09:53.937
So let's take that MIQ type scenario Managed isolation and quarantine, a piece of work we did for the government during COVID here in New Zealand and specifically around the border workforce, the individuals who are working in these highly regulated environments, compliance high environments where they needed to showcase that they were the right people with the right skill set to be working in the environment.
00:09:54.394 --> 00:10:08.288
So let's take a managed isolation and quarantine facility where you've got hotel staff, defense staff guarding the gates, a health staff coming in and out and performing health duties within these environments.
00:10:08.288 --> 00:10:11.405
You've got caterers, you've got repair people.
00:10:11.405 --> 00:10:26.322
You've got this highly compliant environment where, under the New Zealand Health and Safety Act, the person who's controlling that business unit needs to make sure that they are taking the best duty of care possible to make sure the right people are undertaking the right jobs.
00:10:26.322 --> 00:10:31.719
So, essentially, people are qualified, people are skilled, people have the right credentials to be in that environment.
00:10:31.719 --> 00:10:41.600
We needed to provide a value to this government department for them to make sure that the right people were coming in and out.
00:10:41.780 --> 00:10:49.335
The right compliance ticks were being ticked and that was relating to particular credentials around that individual.
00:10:49.335 --> 00:10:56.095
It happened to be obviously identity individual credentials that needed to be health credentials.
00:10:56.095 --> 00:11:10.860
They needed to be health and safety training credentials, as well as work authorities something as simple as a site induction All of this information we were able to provide to the government, or the government to issue the credentials to individuals.
00:11:10.860 --> 00:11:16.927
They already had existing databases that held the truth around this information.
00:11:16.927 --> 00:11:25.224
So say, for instance, think the COVID immunization register there was already a point of truth around COVID immunizations.
00:11:25.794 --> 00:11:41.517
We simply took that data and created a verified credential out of it, issued it to the individual, made the mechanism to hold it in a digital wallet and then, from a verification point of view, the same digital wallet tool has the capability to check or validate credentials.
00:11:41.517 --> 00:11:45.936
So the defense force at the gate was scanning QR codes of individuals when they were coming in.
00:11:45.936 --> 00:11:52.697
Rulesets were created in those environments that ABCD credentials needed to be showcased.
00:11:52.697 --> 00:11:57.524
Our tool allowed that to simply return a result of you meet requirements.
00:11:57.524 --> 00:12:02.115
Where you don't meet requirements based on the verified credentials that you had sitting within your wallet.
00:12:02.885 --> 00:12:03.889
Then got it.
00:12:03.889 --> 00:12:06.095
There's a lot of parties involved there.
00:12:06.095 --> 00:12:22.504
What matters to the most and we think I'd love to discuss this further with you, but we think that the relying party, or the party that's on the hook for most of the risk in these transactions and these interactions, is almost like the silent partner in a lot of discussions.
00:12:22.504 --> 00:12:28.524
But what matters to all of those stakeholders, especially the relying party, what are they telling you matters?
00:12:28.524 --> 00:12:29.888
Is it things like logging?
00:12:29.888 --> 00:12:30.750
Is it visibility?
00:12:30.750 --> 00:12:31.712
Is it performance?
00:12:31.712 --> 00:12:32.916
What is it?
00:12:33.806 --> 00:12:34.607
It's all those things.
00:12:34.607 --> 00:12:40.791
It's all the things that people are screaming out for Efficiency, productivity.
00:12:40.791 --> 00:12:57.778
Time is so important to individuals and what our tool and our solution allows people to do is essentially take a lot of that time controlled back, particularly in this environment that we just discussed about managerisation and quarantine.
00:12:57.778 --> 00:13:00.524
What was important to them was time.
00:13:00.524 --> 00:13:12.418
These individuals, every time they turned up at the front gate, needed to showcase a set of credentials that took time to validate and make sure they were true before that individual came into that environment.
00:13:12.418 --> 00:13:15.333
So A I needed to know when that person came in.
00:13:15.333 --> 00:13:21.177
I needed to know, at the point in time that they turned up, that they had the right credentials to actually be in this environment.
00:13:21.177 --> 00:13:26.465
There's logging, there's validation that the right people are undertaking the right tasks.
00:13:27.246 --> 00:13:41.479
That audit trail is really important because if something goes wrong, I need to showcase, from an audit trail point of view, that I put everything in place to make sure that I was doing my job correctly as the essentially custodian of this environment.
00:13:41.565 --> 00:13:44.524
And that can be totally translatable to a construction site.
00:13:45.407 --> 00:13:53.221
If I'm the lead can a contractor on a construction site, it's my responsibility that people coming in that environment I kept safe when they were there.
00:13:55.950 --> 00:14:17.524
So what this tool allows people to do is give them peace of mind that the right people are turning up with the right skills and qualifications, and verified credentials is the perfect way to do this, because it's not just me trusting that a piece of paper, a plastic card, some sort of proof that I have to validate whether it's true or not, is really up to me.
00:14:17.524 --> 00:14:37.465
So giving the technology and allowing the technology to make those decisions for people and give them that peace of mind is really important and gives them so much control, validation, but also, most importantly, it gives them time back because they can get back to actually doing what they should be doing, as opposed to spending time validating information.
00:14:37.465 --> 00:14:46.504
And for my Q-workers, what was taken the minutes before we were able to come and give them the solution we're literally able to reduce to seconds.
00:14:46.504 --> 00:14:51.618
So we're also able to reduce a whole bunch of admin staff and behind the scenes.
00:14:51.618 --> 00:14:54.524
Whose job was it to go and validate that this information was true and real?
00:14:55.025 --> 00:15:12.399
So you've got the ability for holders of these credentials to present themselves quickly and to get approved quickly, and you've got strong audit trails to show that the correct rules have been followed and that the correct data has been presented by the correct people at the right time 100%.
00:15:12.399 --> 00:15:16.054
Now we've talked about wallets already and you're obviously using a wallet.
00:15:16.054 --> 00:15:18.481
Is that a proprietary junction wallet?
00:15:18.481 --> 00:15:24.917
Is it part of your solution and how do you feel about the operating system wallets like Google and Apple, the built-in wallets?
00:15:25.986 --> 00:15:28.796
It is a proprietary piece of tech that we've created ourselves.
00:15:28.796 --> 00:15:31.524
We're kind of operating with two wallets at the moment.
00:15:31.524 --> 00:15:41.417
One is a progressive web application, so essentially it's a cloud wallet, but we also have a native wallet both on Android and Apple.
00:15:41.417 --> 00:15:45.235
Really important to kind of see why we have two.
00:15:45.235 --> 00:15:54.279
A web wallet or a progressive web application allows us to push updates, you know, instantaneously to that platform for our users.
00:15:54.279 --> 00:16:00.756
So when it comes to increasing functionality, it's not reliant on that individual having to go and update it on the app store.
00:16:00.756 --> 00:16:04.193
We're able to kind of push some of these updates straightaway to it.
00:16:04.193 --> 00:16:11.197
Obviously, it has some downfalls to what a native app would have and, for instance, offline capability.
00:16:11.197 --> 00:16:26.673
Our progressive web application relies on the internet, whereas the native app doesn't necessarily rely on connectivity to transfer credentials to individuals, so that validation can still be done in environments that are important to junction.
00:16:26.673 --> 00:16:28.918
You know, like sectors, forestry, etc.
00:16:28.918 --> 00:16:35.524
They work in environments where there is no internet capability, so that validation of a credential still needs to happen.
00:16:35.524 --> 00:16:39.524
So our native app allows us to do that via Bluetooth.
00:16:39.524 --> 00:16:44.476
So there are some cool things in both and important.
00:16:44.476 --> 00:16:50.321
But when it comes to the operating system wallets, you know your Google wallets and your Apple wallets.
00:16:50.321 --> 00:16:51.504
We're big fans of those.
00:16:52.106 --> 00:16:58.524
We believe here at Junction in the ecosystem where the user should be able to choose where they store their credentials.
00:16:59.407 --> 00:17:07.525
If I want to store it in my junction wallet, because I have all of this other cool functionality and great tools to utilize, then I should be able to do that.
00:17:08.288 --> 00:17:12.444
But if I want to store that credential in my Apple wallet or my Google wallet, I should be able to do it as well.
00:17:13.287 --> 00:17:22.525
And that's what our journey is with Junction is to help these issuers of credentials and give them a mechanism and a platform to be able to do that.
00:17:22.525 --> 00:17:26.525
So if you want to issue a credential to somebody, you can issue it to them.
00:17:26.525 --> 00:17:28.515
They can hold it however they want to hold it.
00:17:28.515 --> 00:17:35.258
And if that's within Junction, then fantastic, because we've added value with the toolset that we've created within our solution.
00:17:35.258 --> 00:17:46.974
But if I want to hold it in my Apple wallet and keep it in my Apple wallet, I should be able to do that as well, and that's what we believe in and I suppose that comes back to well, how do you do that?
00:17:46.974 --> 00:18:09.555
And standards are a big part of this, and the W3C standards around verifiable credentials is a big part of this and we're big believers in that to drive adoption so that someone can turn up somewhere and claim a credential and hold it in a junction wallet or in an Apple wallet, and we want that capability for people.
00:18:11.624 --> 00:18:17.282
And, to be clear at this point, the ability to put a credential into an Apple wallet is not present.
00:18:18.527 --> 00:18:18.887
Not true.
00:18:18.887 --> 00:18:23.165
We have done some experiments where we've proved this within Junction.
00:18:23.165 --> 00:18:37.548
Not in a valid market, though, so we haven't got it actively being used within a marketplace, but I suppose, just like any organization, there's a whole bunch of research and development going on to make sure the stuff is entirely possible.
00:18:37.548 --> 00:18:55.873
Another example is pushing into another quasi-wallet, which would be the Microsoft Authenticator app, proving that there are multiple ways to issue these credentials to people, and it doesn't have to be through proprietary wallets like a government wallet or a Mastercard wallet.
00:18:55.873 --> 00:19:06.469
These credentials should be following open standards where they can be consumed by any type of wallet, and I think that's really important for people moving forward that choice.
00:19:07.982 --> 00:19:11.251
We see the same pros and cons playing out in Australia.
00:19:11.251 --> 00:19:23.913
One of the world's preeminent state government credential wallets is the New South Wales Digital Drivers License a project here that's close to my heart and that's been extended for COVID credentials.
00:19:23.913 --> 00:19:30.163
But a whole lot of other trade qualifications and building permits and working with children's checks and so on.
00:19:30.163 --> 00:19:42.346
The ability to update that wallet quickly is something that makes it very difficult for New South Wales to move to Apple or Google, because there's a whole lot of momentum and inertia with those big projects.
00:19:42.346 --> 00:19:46.817
And, of course, the ability for finer-grained functionality in the app.
00:19:46.817 --> 00:19:55.327
When you've got a proprietary wallet integrated with the app, it's a lot easier to be sharing information, to be streamlining data sharing and so on.
00:19:55.327 --> 00:20:05.592
So I think it's a really nice design problem about the choice of wallet and I myself am prepared to think that we'll have a choice of wallets going forward for quite a long time.
00:20:06.300 --> 00:20:09.269
And I think a key thing here is all of this is good.
00:20:10.160 --> 00:20:15.731
The use of verified credentials is good, no matter how it's done, whether it's in a proprietary wallet.
00:20:15.731 --> 00:20:21.490
I think we will get there and again, there's a massive journey for people to take on.
00:20:21.490 --> 00:20:40.967
We've gone through a long history of showcasing who we are and validating the skill set that we have via paper and physical plastic tokens, and if I take the example of the work we're doing within the energy sector, for 40 years I've used a green passbook.
00:20:40.967 --> 00:20:46.758
It's called the Green Book and it literally is a green paper-sized passbook that holds onto information around.
00:20:46.758 --> 00:20:50.309
You talk to our Vistar who you are and what you're entitled to do.
00:20:50.309 --> 00:21:05.411
So when you turn up to the geothermal power station gate, you hand over that green book and inside is handwritten, rubber stamped signature information around site inductions or working at the heights, training or qualifications and skills.
00:21:06.279 --> 00:21:37.068
We've got a long way to get to our utopia because we've had this long history of this paper-based roof and there's a mindset that needs to change within industries and organizations as well, and I think that's a big part of it too is actually embracing this technology, and it's up to people like me and our organization to convince people the value of this type of technology and why we should move to this.
00:21:37.068 --> 00:21:52.048
So, again, that goes back to the challenge of that closed-loop environment where you are literally selling this and educating people at all levels at the issuer level, at the holder level and at the verifier level.
00:21:52.599 --> 00:21:53.584
Let's get to the business piece.
00:21:53.584 --> 00:22:03.030
So it's the relying party who's paying, it's the enterprise that's paying for this, it's the party that has the risk exposure, correct, correct.
00:22:03.030 --> 00:22:08.271
What do you find to be the leverage points in your argument for adoption?
00:22:08.681 --> 00:22:11.048
Look, there's a couple of important things here.
00:22:11.048 --> 00:22:21.030
Traditionally, how these guys, or how these organizations and enterprises, these relying parties, have dealt with this information is very manual.
00:22:21.030 --> 00:22:29.568
So if they haven't done a database, that's maybe in a spreadsheet somewhere, it's in some siloed database that has a piece of the puzzle.
00:22:29.568 --> 00:22:42.711
So being able to give them a toolset where we can access some of that siloed information and bring it into a platform where it's visible all at once is hugely important to them.
00:22:42.711 --> 00:22:49.393
We're talking about organizations, especially in the energy sector, who have a high-value asset.
00:22:49.393 --> 00:22:58.788
They have a highly hazardous environment in a power generation site where they need to make sure that the right people are undertaking the right task.
00:22:58.788 --> 00:23:07.611
So when that person turns up at the gate, they need to make the quickest decision possible to get that person on site to undertake their work that they are supposed to be there.
00:23:07.611 --> 00:23:14.384
So that's validation of their identity, validation of their skills and qualification and their work authorities.
00:23:14.384 --> 00:23:23.750
If that takes time, there's a trickle-on effect and for six weeks of the, every generation site is shut down for cleaning and maintenance.
00:23:23.750 --> 00:23:26.547
Time is crucial through a period like that.
00:23:26.547 --> 00:23:33.303
So they need to, ahead of time, make sure that the right people are turning up or going to be turning up.
00:23:33.303 --> 00:23:44.724
So that's where our platform comes into play, where, as an individual who contracts to you as a company, I can give you access to particular credentials for a particular period of time or to allow us to say stop.
00:23:44.724 --> 00:23:48.048
That allows you to make those forward-planning decisions.
00:23:48.048 --> 00:23:56.388
So in six months' time, if I'm still sharing with you, you can validate that I've got the right skill set to hire me to come and contract and do this work.
00:23:56.388 --> 00:24:06.269
Now, as soon as I untie the box and say I'm no longer sharing with you, you no longer have access to those verified credentials that I was once sharing with you.
00:24:06.269 --> 00:24:14.905
Having that, from a privacy point of view, none of these organizations want to be holding on to information they shouldn't be holding on to.
00:24:14.905 --> 00:24:42.496
So it takes so many boxes from efficiency, productivity, privacy and compliance that the seller isn't actually too hard when you show the value and you show the time saving To the extent where these enterprises are so happy to pay for the people who are coming in and track with them because it actually saves them so much more money than what it does at the cost of it all.
00:24:43.621 --> 00:24:57.732
I just want to expand on that particular example and use one particular use case that the industry the energy industry has highlighted to us here in New Zealand Prior to us coming along, an individual's information wasn't managed that well.
00:24:57.732 --> 00:25:08.311
So if I work for a large generation company and jump ship and go and work for another large generation company when I turn up, my new boss wants to know what I'm skilled and qualified in.
00:25:08.311 --> 00:25:17.470
If that is too hard, or if I don't bring everything with me because I can't remember everything, my previous organization has paid for my training.
00:25:17.470 --> 00:25:19.564
Maybe they feel like they own my training.
00:25:19.564 --> 00:25:20.988
It's mine, by the way.
00:25:20.988 --> 00:25:21.849
I did the training.
00:25:21.849 --> 00:25:22.932
I should be able to own that.
00:25:23.259 --> 00:25:30.986
But because there isn't this easy way now to give this credential to the individual, they turn up to a new environment, shrug their shoulders.
00:25:30.986 --> 00:25:37.505
A new boss says well, I need you to have this skill, so I'm going to send you on a training course tomorrow At the cost of double training.
00:25:37.505 --> 00:25:39.891
That individual already had that skill set.
00:25:39.891 --> 00:25:42.728
They just didn't keep it with them, didn't have it.
00:25:42.728 --> 00:25:44.324
It wasn't easily accessible.
00:25:45.259 --> 00:25:50.465
That cost to the energy industry is around $10 million a year that double training costs.
00:25:50.579 --> 00:26:01.912
So for spending $50 million a year on training, $10 million of that, 20% is wasted double training individuals because it's too hard to validate their skills or training qualification.
00:26:01.912 --> 00:26:17.728
So automatically by implementing this across an industry and hats off to the New Zealand energy industry world leading in the fact that, as an entire industry, they've said hey look, there's no IP in health and safety, so we just want to make sure that people go home safe.
00:26:17.728 --> 00:26:26.231
So what we want to do is we want to give a solution for everybody to be able to validate that Now who they say they are and have the right qualification.
00:26:26.231 --> 00:26:31.069
We want them to be able to turn up to a training environment and receive a verifiable credential straight away.
00:26:31.069 --> 00:26:36.942
So we're working with all of these separate parties to create this efficiency and this productivity.
00:26:36.942 --> 00:26:51.189
And it's working for them because automatically show off the back, thus saving millions of dollars because all of a sudden, this information is visible and the information for the individual is transferable and they can take it with them.
00:26:51.189 --> 00:26:52.291
That's so empowering.
00:26:52.661 --> 00:26:54.587
So let me be clear about that at the end.
00:26:54.587 --> 00:27:11.231
If I'm working for Power Generation Company A and then I decide I want to go move to South Island and work for a company B, the junction wallet that I have that's containing my credentials can that just be valid as soon as I get to my new place of employment?
00:27:11.480 --> 00:27:12.249
Oh, 100%.
00:27:12.249 --> 00:27:13.200
Those are your credentials.
00:27:13.200 --> 00:27:16.568
If they've been issued to by somebody, you still hold them.
00:27:16.568 --> 00:27:17.371
You can take them with you.
00:27:17.371 --> 00:27:25.609
The fact that you've been sharing with your employer while you've been working for them is just so that they can utilize those credentials.
00:27:25.609 --> 00:27:27.226
They need to utilize those credentials.
00:27:27.226 --> 00:27:31.830
You're their worker, you have a particular skill set.
00:27:31.830 --> 00:27:35.088
They need to know that that's valid when they're sending you on work.
00:27:35.088 --> 00:27:46.571
So having access to when those credentials expire is hugely important for them, Hugely important for you as an individual as well, especially when you do want to take them with you somewhere else and showcase them to somebody else.
00:27:46.571 --> 00:27:48.366
So, within the energy sector, I can do that.
00:27:48.366 --> 00:27:52.068
I can take all my credentials with me to new employer and I can showcase them.
00:27:53.039 --> 00:27:57.048
How do you assure the new employer that the credentials are legitimate?
00:27:57.750 --> 00:27:58.551
Great question, george.
00:27:58.551 --> 00:28:07.770
And within the energy sector in New Zealand that's not an issue because what they've done is that this is a recognizable form of currency within the sector.
00:28:07.770 --> 00:28:16.347
So if someone is turning up with junction wallet and there are credentials in there, you can be rest assured that those credentials are true and valid.
00:28:16.347 --> 00:28:23.467
Now I'm going to caveat that with we give the ability for individuals to upload their own credentials to claim a credential.
00:28:23.467 --> 00:28:31.368
But what we've done with that is we've implemented a trust matrix, so essentially it's a red, amber, green traffic light system.
00:28:31.368 --> 00:28:50.771
We know that we're not going to get absolutely every issuing authority on board from day one, but it's important for these individuals to carry credentials with them that maybe haven't been digitized yet, so they haven't got to the verifiable credential status where they're issuing a digital driver's license.
00:28:50.771 --> 00:28:58.490
We don't do a digital driver's license here in New Zealand yet, so an individual working in the energy sector needs to showcase that they have a driver's license.
00:28:58.490 --> 00:29:02.750
We can give them a mechanism to showcase that as a verifiable credential.
00:29:02.750 --> 00:29:08.191
But it's caveated on this trust matrix, a red, amber, green traffic light system.
00:29:08.191 --> 00:29:14.412
If it's been issued from the licensing authority, it's a green verifiable credential.
00:29:14.412 --> 00:29:17.686
If I have self-claimed this credential.
00:29:17.686 --> 00:29:19.571
Its flagged is red.
00:29:19.571 --> 00:29:24.963
So anyone I'm showcasing it to can clearly see this trust matrix, clearly see the levels of the trust matrix.
00:29:24.963 --> 00:29:39.667
And what we've done there is again, I'll go back to this journey is we're building so that when that licensing authority comes on board they have the ability to turn all of those red credentials.
00:29:39.667 --> 00:29:44.270
And we do have an amber status which has been endorsed by the organization you work for.
00:29:44.270 --> 00:29:55.172
So if I'm endorsed by a large generation company here in New Zealand and I'm showcasing that to somebody else, they can be rest assured that it has been validated by another authority.
00:29:55.172 --> 00:30:00.270
And then again it's up to them, their own business decisions on how much they trust that.
00:30:01.099 --> 00:30:02.243
All of this comes down to trust.
00:30:02.284 --> 00:30:05.246
At the end of the day, trust is the underlying thing to everything.
00:30:05.246 --> 00:30:08.228
How much do you trust this that I'm showing you?
00:30:08.228 --> 00:30:30.170
And all we've done is give them a mechanism to be able to validate that trust, but also for the issuing authority to be able to come in and say actually I want to turn all of those credentials that people are claiming of mine green, because we're now on board with this movement of verifiable credentials and we want people to be showcasing our credentials out in the marketplace.
00:30:30.170 --> 00:30:47.384
We want people to have peace of mind that that is a true and valid credential, because you look across, you know, in New Zealand we've got the city councils who have just been through a bit of a scandal where an engineer signed off on a thousand pieces of work using another person's credential.
00:30:47.384 --> 00:31:03.634
So those authorities want people in the marketplace showcasing verifiable credentials to prove that it is them who has that authority, because the triple on effect is massive if someone's impersonating or stealing somebody else's credentials.
00:31:03.634 --> 00:31:04.700
So yeah, this is good for everyone.
00:31:04.700 --> 00:31:06.923
The same story in healthcare, I guess.
00:31:07.444 --> 00:31:14.759
professional licensing, maintenance, aircraft, aviation, Generally speaking, what's next?
00:31:14.759 --> 00:31:19.144
What are the most important use cases for this sort of technology going forward?
00:31:20.006 --> 00:31:20.126
Look.
00:31:20.126 --> 00:31:21.009
What's next is?
00:31:21.009 --> 00:31:22.914
It's a big question, steve.
00:31:22.914 --> 00:31:24.881
There's so many opportunities here.
00:31:24.881 --> 00:31:30.428
As a commercial organization, our focus is Look as a laser focus.
00:31:30.428 --> 00:31:38.569
It's a laser focus on proving in the environments that we're already in, that it works and that there's value, because the use cases are so great.
00:31:38.569 --> 00:32:02.644
This could go absolutely everywhere, but we need to prove it somewhere first, and it just so happens that we found the industry that was screaming out for a solution because they want to send their people home safe and you know the the high hazard industry, that environments where people need to have skills and qualifications in order for other people to stay alive, in order for people to go home safe.
00:32:02.644 --> 00:32:11.237
There's a great place to start with this because there is an immediate impact and it's not just a top-down approach either.
00:32:11.297 --> 00:32:16.551
I think this is something that's really important to understand and I See just briefly before empowerment.
00:32:16.551 --> 00:32:21.305
You know, like individuals holding on to their information and being able to take that with them.
00:32:21.305 --> 00:32:35.278
It's hugely powerful, and we have a use case within the United States, where we have particular sector of workers who are trying to push from the ground up with this technology.
00:32:35.278 --> 00:32:41.265
They care about their data, they care about their information, they care about their identity.
00:32:41.265 --> 00:32:44.464
They don't want people to steal their identity.
00:32:44.464 --> 00:32:49.116
They don't want people to be showcasing their particular skills and impersonating them.
00:32:49.116 --> 00:33:04.913
So they want to use this technology in the environments that they work in so that the organization they're working for is held accountable for that data and is not at the risk of being hacked, not at risk of leaking that data.
00:33:04.913 --> 00:33:18.151
So it really is a ground-up approach, for where we've found success and drive has been from industries that have a requirement, mainly around health and safety.
00:33:18.905 --> 00:33:23.412
But, steve, yeah, the possibilities are endless.
00:33:23.412 --> 00:33:28.125
You know, george, you mentioned in your intro access to solutions, access to systems.
00:33:28.125 --> 00:33:34.509
You know a verified credential could be a key for you to access a particular solution.
00:33:34.509 --> 00:33:38.538
Or, you know, have access to some digital tools.
00:33:38.538 --> 00:33:52.112
Yeah, it might mean that alignment, because of his particular credential set, gives him access to some maps that allow him to see where, you know a Power grid is is mapped out.
00:33:52.112 --> 00:34:05.000
This is really important stuff and I think, with what we're doing, we're just kind of scratching the surface with this use case of individuals showcasing their credentials for their work environments.
00:34:05.000 --> 00:34:09.152
There's so many opportunities with verifiable credentials.
00:34:09.152 --> 00:34:10.856
It really is the new internet.
00:34:10.856 --> 00:34:13.552
It's um, yeah, it's very exciting space.
00:34:14.646 --> 00:34:15.750
Well, dan, thank you very much.
00:34:15.750 --> 00:34:16.873
We're gonna have to leave it there.
00:34:16.873 --> 00:34:22.219
Wish you all the luck in this new year, and you're speaking our language.
00:34:22.219 --> 00:34:23.844
We really appreciate your time.
00:34:23.844 --> 00:34:26.132
Hey, look, thank you so much, guys.
00:34:26.233 --> 00:34:26.695
It's um.
00:34:26.695 --> 00:34:32.956
Yeah, it's been a pleasure and look forward to talk to you again If I have the opportunity, and and thanks to all your listeners as well.
00:34:33.418 --> 00:34:33.981
Let's do it.
00:34:33.981 --> 00:34:35.125
Keep up the good work, Dan.
00:34:35.125 --> 00:34:36.626
Cheers guys.
00:00:14.192 --> 00:00:22.631
Welcome to Making Data Better, a podcast about data quality and impact it has on how we protect, manage and use the digital data critical to our lives.
00:00:22.631 --> 00:00:29.286
I'm George Peabody, partner at Lockstep Consulting, and thanks for joining us With me is Lockstep founder, steve Wilson.
00:00:29.286 --> 00:00:29.908
Hi, steve.
00:00:30.961 --> 00:00:32.226
Hello George, happy new year.
00:00:32.226 --> 00:00:36.729
I hope it's some off to a good start for you and great to be talking with you again.
00:00:38.180 --> 00:00:45.850
After a great start, we're actually expecting, finally, our first snowfall in Boston over the weekend, so I'll be getting into the hot tub after I do all the snow shoveling.
00:00:45.850 --> 00:00:59.770
So, steve, today we're going to take a look at the power of credential sharing, some examples of what's possible when we address safety and security concerns through the use of the right credentials, presented at the right time.
00:00:59.770 --> 00:01:11.722
And to do that, we're fortunate enough to be looking at a company that operates what we're calling credential management service and system that has to work with all the stakeholders in its system.
00:01:11.722 --> 00:01:21.909
What is really intriguing about this model where you do everything, where you are a credential management service serving everybody?
00:01:21.909 --> 00:01:26.468
You've got to work with all the parties, all the stakeholders, in the identification process.
00:01:26.468 --> 00:01:34.248
So you've got to get the party that's taking the risk, what we call the relying party on board, whether it's the physical or digital worlds.
00:01:34.248 --> 00:01:44.430
The provider has to make it easy to grant access to a service, speed the process, log each of those accesses, trust the validity of the credentials presented.
00:01:44.430 --> 00:01:57.489
In other words, the relying parties want the ability to control access, know what each credential presenter is, who each one is, subject, referred to as what they're certified to do, and again to log each of those interactions.
00:01:58.519 --> 00:02:06.188
Then the service provider has to get the capability into the hands of the subjects, the holders and presenters of the credentials on board.
00:02:06.188 --> 00:02:14.848
So they've got to answer the question of what's in it for the subject easier to get into a building or is it easier to access an online service?
00:02:14.848 --> 00:02:25.008
Maybe it's putting a QR code in front of the guy at the gate instead of a booklet full of stamps that say that someone's been certified to do a job?
00:02:25.008 --> 00:02:28.348
And the third party, of course, is the issuer of the credentials.
00:02:28.348 --> 00:02:36.925
Think about a registry motor vehicles or an educational institution or a training company that provides certification.
00:02:36.925 --> 00:02:46.348
Those credentials have to be in the hands of the subject to be presented to the relying party in order to make a complete loop of the transaction.
00:02:47.560 --> 00:03:01.729
One of the beauties of the service provider that does all the work is that they got great visibility into what users are doing on all hands, whether it's the relying party, the subjects themselves, the folks who are presenting the credential.
00:03:01.729 --> 00:03:14.048
And given that visibility, given the fact that they're seeing interactions everywhere, they can actually respond to new changes, new requirements pretty quickly and push that capability out.
00:03:14.048 --> 00:03:34.788
Steve, let's illustrate this in the context of identification and credential sharing through talking with, I'm happy to say, junction, a New Zealand company that has assembled a solution that addresses the needs of each of those three parties the relying party, the party taking the risk, the subject and the credential issuer itself.
00:03:34.788 --> 00:03:40.074
So to do that, let me welcome Dan Stemp, who is Junction's chief customer officer.
00:03:40.074 --> 00:03:41.478
Dan, welcome.
00:03:42.118 --> 00:03:42.360
Thank you.
00:03:42.360 --> 00:03:43.724
Hey, look, thanks for having me, guys.
00:03:43.724 --> 00:03:51.967
I'm really excited to talk today about the work that Junction's doing and look verifiable credentials as a whole.
00:03:51.967 --> 00:03:59.626
Look, it's such an exciting topic and we kind of refer to it as the you know and lots of other people do is the new gold rush.
00:03:59.626 --> 00:04:08.812
You know this idea of owning your own information and being able to use it whenever you need to use it, knowing who has access to it.
00:04:08.812 --> 00:04:13.770
This is important stuff and we're really excited to be in this space.
00:04:14.961 --> 00:04:16.446
We're so excited to have you on the show, dan.
00:04:16.446 --> 00:04:22.351
We met on the other side of the planet for you and me at least, is Antipodeans.
00:04:22.351 --> 00:04:28.932
We had a great time at Identiverse in Las Vegas with George last year.
00:04:28.932 --> 00:04:30.987
It's fantastic, isn't it?
00:04:30.987 --> 00:04:36.180
You go to the other side of the planet to meet people that are almost next door we also.
00:04:36.180 --> 00:04:45.266
When we were chatting, we found that we three have been in adjacent areas of business now for decades, so I found the history of Junction really fascinating.
00:04:45.266 --> 00:04:48.012
Could you recap that for us right now?
00:04:48.916 --> 00:04:50.000
Yeah, yeah, look, I'd love to.
00:04:50.000 --> 00:04:59.086
And, george, I'm going to pinpoint a word that you just used in your intro there with visibility, and it's a key part of Junction's learning.
00:04:59.086 --> 00:05:03.204
And, again, the word I'm going to use quite often during this is journey.
00:05:03.204 --> 00:05:13.002
Through Junction's journey, we had a lot of learnings when we owned a large scale card production and personalization bureau.
00:05:13.002 --> 00:05:24.345
So we were in the business of delivering physical identity tokens to individuals to showcase who they were, whether they had a particular skill or qualification or work authority.
00:05:24.345 --> 00:05:59.805
So, having that visibility of the information that we were producing for individuals and having that visibility of those individuals themselves and what they did with those physical tokens hold them in plastic card wallets, information in the vanilla folders we had this insight into how we could create better user interactions for these individuals by using emerging technology like verifiable credentials and building software was not new for Junction as an organization.
00:06:00.375 --> 00:06:15.805
As part of our card bureau offering, we had an online ordering tool, so essentially an online portal for our customers to input data around the individuals who were receiving these physical tokens and the information that was going on these tokens.
00:06:15.805 --> 00:06:24.721
So think firearms license and what your authorities were under your firearms license, what classification of firearms you're allowed to hold on to.
00:06:24.721 --> 00:06:30.158
This is all information that we would print onto a physical token for an individual to put in their wallet.
00:06:30.158 --> 00:06:41.963
So we saw the opportunity to create these digital interactions, of those physical user interactions that people will be having out in the world.
00:06:41.963 --> 00:07:00.439
And specifically, we've taken a focus on our high hazard industries and really that's just out of need and necessity, because we have heard that there are problems and we've had people approach us within those industries that they have problems and they think we can solve them.
00:07:00.439 --> 00:07:13.199
So yeah, coming from the card bureau industry has given us a massive amount of insight into the amount of credentials that people actually hold on to, and it's not just one to three.
00:07:14.134 --> 00:07:21.807
We see all those common areas which are really, conceptually, it's an analog to digital conversion, isn't it?
00:07:21.807 --> 00:07:29.783
You take information from sources of truth, you have some way of quality assuring that information and then you package it on behalf of subjects.
00:07:29.783 --> 00:07:34.663
They then hold it in a plastic card or a digital wallet.
00:07:34.663 --> 00:07:42.740
I guess Can we dig into this sort of infrastructure and that common ground, what you've had to build and what you've had to leverage.
00:07:42.740 --> 00:07:53.745
And I guess we could also ground this conversation relative to COVID, because we love what you guys did relative to COVID, so maybe you can use that to illustrate and underscore how your infrastructure works.
00:07:54.836 --> 00:07:55.940
Sure infrastructure.
00:07:55.940 --> 00:08:01.355
Firstly, we've got to build something that's scalable.
00:08:01.355 --> 00:08:08.495
If it's not scalable, if it's not secure, it's not something that we want to have as infrastructure behind us.
00:08:08.495 --> 00:08:12.706
Because this needs to be scalable, it needs to be secure.
00:08:12.706 --> 00:08:17.185
So at the core of all of this really is data.
00:08:17.185 --> 00:08:22.809
It's important to understand again the journey of what we've built.
00:08:22.809 --> 00:08:30.247
But kind of underneath it all, we have set of tools for people to interact with us.
00:08:30.247 --> 00:08:34.706
We have a digital wallet for holders to hold verifiable credentials in.
00:08:34.706 --> 00:08:44.981
We have an issuing platform that allows issuers of credentials to create a credential catalog and issue those to individuals.
00:08:44.981 --> 00:08:52.268
We have an admin portal for enterprises to use to consume that data.
00:08:52.268 --> 00:09:05.700
So, whether I employ 200 people and I want an overview of the credentials that those 200 people have, we have an admin portal that allows you to access that information, all permissioned by the individual.
00:09:05.700 --> 00:09:23.957
So an enterprise can't always be looking for a request when they need to access information around an individual and their work authorities or skill sets and I want to caveat this all the way all the time this is under permission from the individual.
00:09:23.957 --> 00:09:53.937
So let's take that MIQ type scenario Managed isolation and quarantine, a piece of work we did for the government during COVID here in New Zealand and specifically around the border workforce, the individuals who are working in these highly regulated environments, compliance high environments where they needed to showcase that they were the right people with the right skill set to be working in the environment.
00:09:54.394 --> 00:10:08.288
So let's take a managed isolation and quarantine facility where you've got hotel staff, defense staff guarding the gates, a health staff coming in and out and performing health duties within these environments.
00:10:08.288 --> 00:10:11.405
You've got caterers, you've got repair people.
00:10:11.405 --> 00:10:26.322
You've got this highly compliant environment where, under the New Zealand Health and Safety Act, the person who's controlling that business unit needs to make sure that they are taking the best duty of care possible to make sure the right people are undertaking the right jobs.
00:10:26.322 --> 00:10:31.719
So, essentially, people are qualified, people are skilled, people have the right credentials to be in that environment.
00:10:31.719 --> 00:10:41.600
We needed to provide a value to this government department for them to make sure that the right people were coming in and out.
00:10:41.780 --> 00:10:49.335
The right compliance ticks were being ticked and that was relating to particular credentials around that individual.
00:10:49.335 --> 00:10:56.095
It happened to be obviously identity individual credentials that needed to be health credentials.
00:10:56.095 --> 00:11:10.860
They needed to be health and safety training credentials, as well as work authorities something as simple as a site induction All of this information we were able to provide to the government, or the government to issue the credentials to individuals.
00:11:10.860 --> 00:11:16.927
They already had existing databases that held the truth around this information.
00:11:16.927 --> 00:11:25.224
So say, for instance, think the COVID immunization register there was already a point of truth around COVID immunizations.
00:11:25.794 --> 00:11:41.517
We simply took that data and created a verified credential out of it, issued it to the individual, made the mechanism to hold it in a digital wallet and then, from a verification point of view, the same digital wallet tool has the capability to check or validate credentials.
00:11:41.517 --> 00:11:45.936
So the defense force at the gate was scanning QR codes of individuals when they were coming in.
00:11:45.936 --> 00:11:52.697
Rulesets were created in those environments that ABCD credentials needed to be showcased.
00:11:52.697 --> 00:11:57.524
Our tool allowed that to simply return a result of you meet requirements.
00:11:57.524 --> 00:12:02.115
Where you don't meet requirements based on the verified credentials that you had sitting within your wallet.
00:12:02.885 --> 00:12:03.889
Then got it.
00:12:03.889 --> 00:12:06.095
There's a lot of parties involved there.
00:12:06.095 --> 00:12:22.504
What matters to the most and we think I'd love to discuss this further with you, but we think that the relying party, or the party that's on the hook for most of the risk in these transactions and these interactions, is almost like the silent partner in a lot of discussions.
00:12:22.504 --> 00:12:28.524
But what matters to all of those stakeholders, especially the relying party, what are they telling you matters?
00:12:28.524 --> 00:12:29.888
Is it things like logging?
00:12:29.888 --> 00:12:30.750
Is it visibility?
00:12:30.750 --> 00:12:31.712
Is it performance?
00:12:31.712 --> 00:12:32.916
What is it?
00:12:33.806 --> 00:12:34.607
It's all those things.
00:12:34.607 --> 00:12:40.791
It's all the things that people are screaming out for Efficiency, productivity.
00:12:40.791 --> 00:12:57.778
Time is so important to individuals and what our tool and our solution allows people to do is essentially take a lot of that time controlled back, particularly in this environment that we just discussed about managerisation and quarantine.
00:12:57.778 --> 00:13:00.524
What was important to them was time.
00:13:00.524 --> 00:13:12.418
These individuals, every time they turned up at the front gate, needed to showcase a set of credentials that took time to validate and make sure they were true before that individual came into that environment.
00:13:12.418 --> 00:13:15.333
So A I needed to know when that person came in.
00:13:15.333 --> 00:13:21.177
I needed to know, at the point in time that they turned up, that they had the right credentials to actually be in this environment.
00:13:21.177 --> 00:13:26.465
There's logging, there's validation that the right people are undertaking the right tasks.
00:13:27.246 --> 00:13:41.479
That audit trail is really important because if something goes wrong, I need to showcase, from an audit trail point of view, that I put everything in place to make sure that I was doing my job correctly as the essentially custodian of this environment.
00:13:41.565 --> 00:13:44.524
And that can be totally translatable to a construction site.
00:13:45.407 --> 00:13:53.221
If I'm the lead can a contractor on a construction site, it's my responsibility that people coming in that environment I kept safe when they were there.
00:13:55.950 --> 00:14:17.524
So what this tool allows people to do is give them peace of mind that the right people are turning up with the right skills and qualifications, and verified credentials is the perfect way to do this, because it's not just me trusting that a piece of paper, a plastic card, some sort of proof that I have to validate whether it's true or not, is really up to me.
00:14:17.524 --> 00:14:37.465
So giving the technology and allowing the technology to make those decisions for people and give them that peace of mind is really important and gives them so much control, validation, but also, most importantly, it gives them time back because they can get back to actually doing what they should be doing, as opposed to spending time validating information.
00:14:37.465 --> 00:14:46.504
And for my Q-workers, what was taken the minutes before we were able to come and give them the solution we're literally able to reduce to seconds.
00:14:46.504 --> 00:14:51.618
So we're also able to reduce a whole bunch of admin staff and behind the scenes.
00:14:51.618 --> 00:14:54.524
Whose job was it to go and validate that this information was true and real?
00:14:55.025 --> 00:15:12.399
So you've got the ability for holders of these credentials to present themselves quickly and to get approved quickly, and you've got strong audit trails to show that the correct rules have been followed and that the correct data has been presented by the correct people at the right time 100%.
00:15:12.399 --> 00:15:16.054
Now we've talked about wallets already and you're obviously using a wallet.
00:15:16.054 --> 00:15:18.481
Is that a proprietary junction wallet?
00:15:18.481 --> 00:15:24.917
Is it part of your solution and how do you feel about the operating system wallets like Google and Apple, the built-in wallets?
00:15:25.986 --> 00:15:28.796
It is a proprietary piece of tech that we've created ourselves.
00:15:28.796 --> 00:15:31.524
We're kind of operating with two wallets at the moment.
00:15:31.524 --> 00:15:41.417
One is a progressive web application, so essentially it's a cloud wallet, but we also have a native wallet both on Android and Apple.
00:15:41.417 --> 00:15:45.235
Really important to kind of see why we have two.
00:15:45.235 --> 00:15:54.279
A web wallet or a progressive web application allows us to push updates, you know, instantaneously to that platform for our users.
00:15:54.279 --> 00:16:00.756
So when it comes to increasing functionality, it's not reliant on that individual having to go and update it on the app store.
00:16:00.756 --> 00:16:04.193
We're able to kind of push some of these updates straightaway to it.
00:16:04.193 --> 00:16:11.197
Obviously, it has some downfalls to what a native app would have and, for instance, offline capability.
00:16:11.197 --> 00:16:26.673
Our progressive web application relies on the internet, whereas the native app doesn't necessarily rely on connectivity to transfer credentials to individuals, so that validation can still be done in environments that are important to junction.
00:16:26.673 --> 00:16:28.918
You know, like sectors, forestry, etc.
00:16:28.918 --> 00:16:35.524
They work in environments where there is no internet capability, so that validation of a credential still needs to happen.
00:16:35.524 --> 00:16:39.524
So our native app allows us to do that via Bluetooth.
00:16:39.524 --> 00:16:44.476
So there are some cool things in both and important.
00:16:44.476 --> 00:16:50.321
But when it comes to the operating system wallets, you know your Google wallets and your Apple wallets.
00:16:50.321 --> 00:16:51.504
We're big fans of those.
00:16:52.106 --> 00:16:58.524
We believe here at Junction in the ecosystem where the user should be able to choose where they store their credentials.
00:16:59.407 --> 00:17:07.525
If I want to store it in my junction wallet, because I have all of this other cool functionality and great tools to utilize, then I should be able to do that.
00:17:08.288 --> 00:17:12.444
But if I want to store that credential in my Apple wallet or my Google wallet, I should be able to do it as well.
00:17:13.287 --> 00:17:22.525
And that's what our journey is with Junction is to help these issuers of credentials and give them a mechanism and a platform to be able to do that.
00:17:22.525 --> 00:17:26.525
So if you want to issue a credential to somebody, you can issue it to them.
00:17:26.525 --> 00:17:28.515
They can hold it however they want to hold it.
00:17:28.515 --> 00:17:35.258
And if that's within Junction, then fantastic, because we've added value with the toolset that we've created within our solution.
00:17:35.258 --> 00:17:46.974
But if I want to hold it in my Apple wallet and keep it in my Apple wallet, I should be able to do that as well, and that's what we believe in and I suppose that comes back to well, how do you do that?
00:17:46.974 --> 00:18:09.555
And standards are a big part of this, and the W3C standards around verifiable credentials is a big part of this and we're big believers in that to drive adoption so that someone can turn up somewhere and claim a credential and hold it in a junction wallet or in an Apple wallet, and we want that capability for people.
00:18:11.624 --> 00:18:17.282
And, to be clear at this point, the ability to put a credential into an Apple wallet is not present.
00:18:18.527 --> 00:18:18.887
Not true.
00:18:18.887 --> 00:18:23.165
We have done some experiments where we've proved this within Junction.
00:18:23.165 --> 00:18:37.548
Not in a valid market, though, so we haven't got it actively being used within a marketplace, but I suppose, just like any organization, there's a whole bunch of research and development going on to make sure the stuff is entirely possible.
00:18:37.548 --> 00:18:55.873
Another example is pushing into another quasi-wallet, which would be the Microsoft Authenticator app, proving that there are multiple ways to issue these credentials to people, and it doesn't have to be through proprietary wallets like a government wallet or a Mastercard wallet.
00:18:55.873 --> 00:19:06.469
These credentials should be following open standards where they can be consumed by any type of wallet, and I think that's really important for people moving forward that choice.
00:19:07.982 --> 00:19:11.251
We see the same pros and cons playing out in Australia.
00:19:11.251 --> 00:19:23.913
One of the world's preeminent state government credential wallets is the New South Wales Digital Drivers License a project here that's close to my heart and that's been extended for COVID credentials.
00:19:23.913 --> 00:19:30.163
But a whole lot of other trade qualifications and building permits and working with children's checks and so on.
00:19:30.163 --> 00:19:42.346
The ability to update that wallet quickly is something that makes it very difficult for New South Wales to move to Apple or Google, because there's a whole lot of momentum and inertia with those big projects.
00:19:42.346 --> 00:19:46.817
And, of course, the ability for finer-grained functionality in the app.
00:19:46.817 --> 00:19:55.327
When you've got a proprietary wallet integrated with the app, it's a lot easier to be sharing information, to be streamlining data sharing and so on.
00:19:55.327 --> 00:20:05.592
So I think it's a really nice design problem about the choice of wallet and I myself am prepared to think that we'll have a choice of wallets going forward for quite a long time.
00:20:06.300 --> 00:20:09.269
And I think a key thing here is all of this is good.
00:20:10.160 --> 00:20:15.731
The use of verified credentials is good, no matter how it's done, whether it's in a proprietary wallet.
00:20:15.731 --> 00:20:21.490
I think we will get there and again, there's a massive journey for people to take on.
00:20:21.490 --> 00:20:40.967
We've gone through a long history of showcasing who we are and validating the skill set that we have via paper and physical plastic tokens, and if I take the example of the work we're doing within the energy sector, for 40 years I've used a green passbook.
00:20:40.967 --> 00:20:46.758
It's called the Green Book and it literally is a green paper-sized passbook that holds onto information around.
00:20:46.758 --> 00:20:50.309
You talk to our Vistar who you are and what you're entitled to do.
00:20:50.309 --> 00:21:05.411
So when you turn up to the geothermal power station gate, you hand over that green book and inside is handwritten, rubber stamped signature information around site inductions or working at the heights, training or qualifications and skills.
00:21:06.279 --> 00:21:37.068
We've got a long way to get to our utopia because we've had this long history of this paper-based roof and there's a mindset that needs to change within industries and organizations as well, and I think that's a big part of it too is actually embracing this technology, and it's up to people like me and our organization to convince people the value of this type of technology and why we should move to this.
00:21:37.068 --> 00:21:52.048
So, again, that goes back to the challenge of that closed-loop environment where you are literally selling this and educating people at all levels at the issuer level, at the holder level and at the verifier level.
00:21:52.599 --> 00:21:53.584
Let's get to the business piece.
00:21:53.584 --> 00:22:03.030
So it's the relying party who's paying, it's the enterprise that's paying for this, it's the party that has the risk exposure, correct, correct.
00:22:03.030 --> 00:22:08.271
What do you find to be the leverage points in your argument for adoption?
00:22:08.681 --> 00:22:11.048
Look, there's a couple of important things here.
00:22:11.048 --> 00:22:21.030
Traditionally, how these guys, or how these organizations and enterprises, these relying parties, have dealt with this information is very manual.
00:22:21.030 --> 00:22:29.568
So if they haven't done a database, that's maybe in a spreadsheet somewhere, it's in some siloed database that has a piece of the puzzle.
00:22:29.568 --> 00:22:42.711
So being able to give them a toolset where we can access some of that siloed information and bring it into a platform where it's visible all at once is hugely important to them.
00:22:42.711 --> 00:22:49.393
We're talking about organizations, especially in the energy sector, who have a high-value asset.
00:22:49.393 --> 00:22:58.788
They have a highly hazardous environment in a power generation site where they need to make sure that the right people are undertaking the right task.
00:22:58.788 --> 00:23:07.611
So when that person turns up at the gate, they need to make the quickest decision possible to get that person on site to undertake their work that they are supposed to be there.
00:23:07.611 --> 00:23:14.384
So that's validation of their identity, validation of their skills and qualification and their work authorities.
00:23:14.384 --> 00:23:23.750
If that takes time, there's a trickle-on effect and for six weeks of the, every generation site is shut down for cleaning and maintenance.
00:23:23.750 --> 00:23:26.547
Time is crucial through a period like that.
00:23:26.547 --> 00:23:33.303
So they need to, ahead of time, make sure that the right people are turning up or going to be turning up.
00:23:33.303 --> 00:23:44.724
So that's where our platform comes into play, where, as an individual who contracts to you as a company, I can give you access to particular credentials for a particular period of time or to allow us to say stop.
00:23:44.724 --> 00:23:48.048
That allows you to make those forward-planning decisions.
00:23:48.048 --> 00:23:56.388
So in six months' time, if I'm still sharing with you, you can validate that I've got the right skill set to hire me to come and contract and do this work.
00:23:56.388 --> 00:24:06.269
Now, as soon as I untie the box and say I'm no longer sharing with you, you no longer have access to those verified credentials that I was once sharing with you.
00:24:06.269 --> 00:24:14.905
Having that, from a privacy point of view, none of these organizations want to be holding on to information they shouldn't be holding on to.
00:24:14.905 --> 00:24:42.496
So it takes so many boxes from efficiency, productivity, privacy and compliance that the seller isn't actually too hard when you show the value and you show the time saving To the extent where these enterprises are so happy to pay for the people who are coming in and track with them because it actually saves them so much more money than what it does at the cost of it all.
00:24:43.621 --> 00:24:57.732
I just want to expand on that particular example and use one particular use case that the industry the energy industry has highlighted to us here in New Zealand Prior to us coming along, an individual's information wasn't managed that well.
00:24:57.732 --> 00:25:08.311
So if I work for a large generation company and jump ship and go and work for another large generation company when I turn up, my new boss wants to know what I'm skilled and qualified in.
00:25:08.311 --> 00:25:17.470
If that is too hard, or if I don't bring everything with me because I can't remember everything, my previous organization has paid for my training.
00:25:17.470 --> 00:25:19.564
Maybe they feel like they own my training.
00:25:19.564 --> 00:25:20.988
It's mine, by the way.
00:25:20.988 --> 00:25:21.849
I did the training.
00:25:21.849 --> 00:25:22.932
I should be able to own that.
00:25:23.259 --> 00:25:30.986
But because there isn't this easy way now to give this credential to the individual, they turn up to a new environment, shrug their shoulders.
00:25:30.986 --> 00:25:37.505
A new boss says well, I need you to have this skill, so I'm going to send you on a training course tomorrow At the cost of double training.
00:25:37.505 --> 00:25:39.891
That individual already had that skill set.
00:25:39.891 --> 00:25:42.728
They just didn't keep it with them, didn't have it.
00:25:42.728 --> 00:25:44.324
It wasn't easily accessible.
00:25:45.259 --> 00:25:50.465
That cost to the energy industry is around $10 million a year that double training costs.
00:25:50.579 --> 00:26:01.912
So for spending $50 million a year on training, $10 million of that, 20% is wasted double training individuals because it's too hard to validate their skills or training qualification.
00:26:01.912 --> 00:26:17.728
So automatically by implementing this across an industry and hats off to the New Zealand energy industry world leading in the fact that, as an entire industry, they've said hey look, there's no IP in health and safety, so we just want to make sure that people go home safe.
00:26:17.728 --> 00:26:26.231
So what we want to do is we want to give a solution for everybody to be able to validate that Now who they say they are and have the right qualification.
00:26:26.231 --> 00:26:31.069
We want them to be able to turn up to a training environment and receive a verifiable credential straight away.
00:26:31.069 --> 00:26:36.942
So we're working with all of these separate parties to create this efficiency and this productivity.
00:26:36.942 --> 00:26:51.189
And it's working for them because automatically show off the back, thus saving millions of dollars because all of a sudden, this information is visible and the information for the individual is transferable and they can take it with them.
00:26:51.189 --> 00:26:52.291
That's so empowering.
00:26:52.661 --> 00:26:54.587
So let me be clear about that at the end.
00:26:54.587 --> 00:27:11.231
If I'm working for Power Generation Company A and then I decide I want to go move to South Island and work for a company B, the junction wallet that I have that's containing my credentials can that just be valid as soon as I get to my new place of employment?
00:27:11.480 --> 00:27:12.249
Oh, 100%.
00:27:12.249 --> 00:27:13.200
Those are your credentials.
00:27:13.200 --> 00:27:16.568
If they've been issued to by somebody, you still hold them.
00:27:16.568 --> 00:27:17.371
You can take them with you.
00:27:17.371 --> 00:27:25.609
The fact that you've been sharing with your employer while you've been working for them is just so that they can utilize those credentials.
00:27:25.609 --> 00:27:27.226
They need to utilize those credentials.
00:27:27.226 --> 00:27:31.830
You're their worker, you have a particular skill set.
00:27:31.830 --> 00:27:35.088
They need to know that that's valid when they're sending you on work.
00:27:35.088 --> 00:27:46.571
So having access to when those credentials expire is hugely important for them, Hugely important for you as an individual as well, especially when you do want to take them with you somewhere else and showcase them to somebody else.
00:27:46.571 --> 00:27:48.366
So, within the energy sector, I can do that.
00:27:48.366 --> 00:27:52.068
I can take all my credentials with me to new employer and I can showcase them.
00:27:53.039 --> 00:27:57.048
How do you assure the new employer that the credentials are legitimate?
00:27:57.750 --> 00:27:58.551
Great question, george.
00:27:58.551 --> 00:28:07.770
And within the energy sector in New Zealand that's not an issue because what they've done is that this is a recognizable form of currency within the sector.
00:28:07.770 --> 00:28:16.347
So if someone is turning up with junction wallet and there are credentials in there, you can be rest assured that those credentials are true and valid.
00:28:16.347 --> 00:28:23.467
Now I'm going to caveat that with we give the ability for individuals to upload their own credentials to claim a credential.
00:28:23.467 --> 00:28:31.368
But what we've done with that is we've implemented a trust matrix, so essentially it's a red, amber, green traffic light system.
00:28:31.368 --> 00:28:50.771
We know that we're not going to get absolutely every issuing authority on board from day one, but it's important for these individuals to carry credentials with them that maybe haven't been digitized yet, so they haven't got to the verifiable credential status where they're issuing a digital driver's license.
00:28:50.771 --> 00:28:58.490
We don't do a digital driver's license here in New Zealand yet, so an individual working in the energy sector needs to showcase that they have a driver's license.
00:28:58.490 --> 00:29:02.750
We can give them a mechanism to showcase that as a verifiable credential.
00:29:02.750 --> 00:29:08.191
But it's caveated on this trust matrix, a red, amber, green traffic light system.
00:29:08.191 --> 00:29:14.412
If it's been issued from the licensing authority, it's a green verifiable credential.
00:29:14.412 --> 00:29:17.686
If I have self-claimed this credential.
00:29:17.686 --> 00:29:19.571
Its flagged is red.
00:29:19.571 --> 00:29:24.963
So anyone I'm showcasing it to can clearly see this trust matrix, clearly see the levels of the trust matrix.
00:29:24.963 --> 00:29:39.667
And what we've done there is again, I'll go back to this journey is we're building so that when that licensing authority comes on board they have the ability to turn all of those red credentials.
00:29:39.667 --> 00:29:44.270
And we do have an amber status which has been endorsed by the organization you work for.
00:29:44.270 --> 00:29:55.172
So if I'm endorsed by a large generation company here in New Zealand and I'm showcasing that to somebody else, they can be rest assured that it has been validated by another authority.
00:29:55.172 --> 00:30:00.270
And then again it's up to them, their own business decisions on how much they trust that.
00:30:01.099 --> 00:30:02.243
All of this comes down to trust.
00:30:02.284 --> 00:30:05.246
At the end of the day, trust is the underlying thing to everything.
00:30:05.246 --> 00:30:08.228
How much do you trust this that I'm showing you?
00:30:08.228 --> 00:30:30.170
And all we've done is give them a mechanism to be able to validate that trust, but also for the issuing authority to be able to come in and say actually I want to turn all of those credentials that people are claiming of mine green, because we're now on board with this movement of verifiable credentials and we want people to be showcasing our credentials out in the marketplace.
00:30:30.170 --> 00:30:47.384
We want people to have peace of mind that that is a true and valid credential, because you look across, you know, in New Zealand we've got the city councils who have just been through a bit of a scandal where an engineer signed off on a thousand pieces of work using another person's credential.
00:30:47.384 --> 00:31:03.634
So those authorities want people in the marketplace showcasing verifiable credentials to prove that it is them who has that authority, because the triple on effect is massive if someone's impersonating or stealing somebody else's credentials.
00:31:03.634 --> 00:31:04.700
So yeah, this is good for everyone.
00:31:04.700 --> 00:31:06.923
The same story in healthcare, I guess.
00:31:07.444 --> 00:31:14.759
professional licensing, maintenance, aircraft, aviation, Generally speaking, what's next?
00:31:14.759 --> 00:31:19.144
What are the most important use cases for this sort of technology going forward?
00:31:20.006 --> 00:31:20.126
Look.
00:31:20.126 --> 00:31:21.009
What's next is?
00:31:21.009 --> 00:31:22.914
It's a big question, steve.
00:31:22.914 --> 00:31:24.881
There's so many opportunities here.
00:31:24.881 --> 00:31:30.428
As a commercial organization, our focus is Look as a laser focus.
00:31:30.428 --> 00:31:38.569
It's a laser focus on proving in the environments that we're already in, that it works and that there's value, because the use cases are so great.
00:31:38.569 --> 00:32:02.644
This could go absolutely everywhere, but we need to prove it somewhere first, and it just so happens that we found the industry that was screaming out for a solution because they want to send their people home safe and you know the the high hazard industry, that environments where people need to have skills and qualifications in order for other people to stay alive, in order for people to go home safe.
00:32:02.644 --> 00:32:11.237
There's a great place to start with this because there is an immediate impact and it's not just a top-down approach either.
00:32:11.297 --> 00:32:16.551
I think this is something that's really important to understand and I See just briefly before empowerment.
00:32:16.551 --> 00:32:21.305
You know, like individuals holding on to their information and being able to take that with them.
00:32:21.305 --> 00:32:35.278
It's hugely powerful, and we have a use case within the United States, where we have particular sector of workers who are trying to push from the ground up with this technology.
00:32:35.278 --> 00:32:41.265
They care about their data, they care about their information, they care about their identity.
00:32:41.265 --> 00:32:44.464
They don't want people to steal their identity.
00:32:44.464 --> 00:32:49.116
They don't want people to be showcasing their particular skills and impersonating them.
00:32:49.116 --> 00:33:04.913
So they want to use this technology in the environments that they work in so that the organization they're working for is held accountable for that data and is not at the risk of being hacked, not at risk of leaking that data.
00:33:04.913 --> 00:33:18.151
So it really is a ground-up approach, for where we've found success and drive has been from industries that have a requirement, mainly around health and safety.
00:33:18.905 --> 00:33:23.412
But, steve, yeah, the possibilities are endless.
00:33:23.412 --> 00:33:28.125
You know, george, you mentioned in your intro access to solutions, access to systems.
00:33:28.125 --> 00:33:34.509
You know a verified credential could be a key for you to access a particular solution.
00:33:34.509 --> 00:33:38.538
Or, you know, have access to some digital tools.
00:33:38.538 --> 00:33:52.112
Yeah, it might mean that alignment, because of his particular credential set, gives him access to some maps that allow him to see where, you know a Power grid is is mapped out.
00:33:52.112 --> 00:34:05.000
This is really important stuff and I think, with what we're doing, we're just kind of scratching the surface with this use case of individuals showcasing their credentials for their work environments.
00:34:05.000 --> 00:34:09.152
There's so many opportunities with verifiable credentials.
00:34:09.152 --> 00:34:10.856
It really is the new internet.
00:34:10.856 --> 00:34:13.552
It's um, yeah, it's very exciting space.
00:34:14.646 --> 00:34:15.750
Well, dan, thank you very much.
00:34:15.750 --> 00:34:16.873
We're gonna have to leave it there.
00:34:16.873 --> 00:34:22.219
Wish you all the luck in this new year, and you're speaking our language.
00:34:22.219 --> 00:34:23.844
We really appreciate your time.
00:34:23.844 --> 00:34:26.132
Hey, look, thank you so much, guys.
00:34:26.233 --> 00:34:26.695
It's um.
00:34:26.695 --> 00:34:32.956
Yeah, it's been a pleasure and look forward to talk to you again If I have the opportunity, and and thanks to all your listeners as well.
00:34:33.418 --> 00:34:33.981
Let's do it.
00:34:33.981 --> 00:34:35.125
Keep up the good work, Dan.
00:34:35.125 --> 00:34:36.626
Cheers guys.
جستجوی اپیزودهای گذشته
اپیزودهای قبلی Making Data Better را جستجو کن.
سلب مسئولیت: پادکست و آثار هنری تعبیه شده در این صفحه متعلق به Lockstep Consulting Pty Ltd است که متعلق به صاحب آن است و به Listen Notes، Inc وابسته یا تایید نشده است.
ویرایش
از کمک شما برای بروز نگهداشتن پایگاهدادههای پادکست سپاسگزاریم
