Report from EBSI4Austria

In 2018, all European member states, together with Norway and Lichtenstein, signed a declaration stating the joint ambition to take advantage of blockchain technology. These 29 countries founded the European Blockchain Partnership (EBP), and within this partnership, they decided to build the so-called European Blockchain Services Infrastructure (EBSI).

EBSI was created aiming to, on the one hand, provide blockchain capabilities used by the partner of the EPB to implement and realize blockchain projects and use cases within these countries. Moreover, on the other hand, to achieve certain use cases on a European level. The so-called use case groups were defined and present the working groups related to a specific use case to support the latter idea. These use case groups consist of representatives of the EBP member counties, domain experts as well as the European Commission.

Initially, four use case groups were founded, namely the European Self-Sovereign Identity Framework (ESSIF), the diploma use case, document traceability, and secure document transfer. ESSIF focuses on digital identities where the user is in control over her identity data. The diploma use case focuses on educational diplomas of students and related processes such as issuing, verifying, revocation, and all of these processes in cross-border scenarios. Document traceability considers the anchoring of document-related identifiers like hashes on the blockcahin and secure document sharing on tax-related information transfer.

EBSI defined so-called use case groups that should be achieved using the provided capabilities to showcase their functionality and bring in expertise in the specific fields. Each use case group consists of representatives of the member states, domain experts, and the European Commission.

About EBSI4Austria

EBSI4Austria is a CEF funded project with two main objectives. First, EBSI4Austria aims to set up, operate and maintain the Austrian’s EBSI node. Second, we pilot the diploma use case on the Austrian level supported by two Universities and data providers as well as verifiers.

EBSI created a so-called early adopter program to speed up the use case integration of the participating countries. EBSI4Austria joined this ambiguous program already in the first wave reflecting our project’s motivation.

Partners

EBSI4Austria consists of three partners, namely two Universities such as Graz University of Technology (TU Graz) and the Vienna University of Economics (WU Vienna), together with Danube Tech, a Vienna based company that provides leading expertise in Self-Sovereign Identity (SSI) as well as distributed systems and is involved in related standardization bodies. The Universities are responsible for issuing students’ diplomas and also verifying them. Austrian’s EBSI node is set up and operated at the department eGovernment innovation center (EGIZ), which is part of Graz University of technology.

User Story

Figure 1 illustrates the user story that is covered in our project. A student studying at the Graz University of Technology is finishing her bachelor’s program. TU Graz issues her diploma credential stating her bachelor’s degree, which the student stores in her wallet. Next, she wants to apply for a master’s program at the Vienna University of Economics and Business; thus, she presents her bachelor’s diploma credential. After successfully finishing her master’s program at WU Vienna, the university issues her master’s diploma credential to the student. The student is very ambitious; therefore, she applies for a Ph.D. position at the Berlin Institute of Technology by presenting her diplomas. All involved parties utilize the EBSI blockchain network to verify if the issuing universities are trusted issuers.

Figure 1: User Story of the Diploma Use Case

Technology

In order to implement our EBSI4Austria project, we used similar technologies as many other Self-Sovereign Identity (SSI) initiatives, i.e., based on building blocks such as Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs).

We created two DIDs on the EBSI blockchain for the two universities, as follows:

• Test DID for TU Graz: did:ebsi:zuoS6VfnmNLduF2dynhsjBU
• Test DID for WU Vienna: did:ebsi:z23EQVGi5so9sBwytv6nMXMo

In addition, we registered them in EBSI’s Trusted Issuer Registry (TIR).

We also designed Verifiable Credentials to model digital versions of university diplomas. We implemented them using different credential and proof formats to accommodate changing requirements and guidelines in the EBSI specifications throughout the year. See here for some examples in different formats:

Example Diploma by TU Graz:

• JSON-LD+LD-Proofs
• JSON-LD+JWT (also see JWT payload only)
• JSON+JWT (also see JWT payload only)

Example Diploma by WU Wien:

• Paper version (in German)
• Paper version (in English)
• JSON-LD+LD-Proofs
• JSON-LD+JWT (also see JWT payload only)
• JSON+JWT (also see JWT payload only)

We also designed our own (experimental) JSON-LD context in order to be able to work with Linked Data Proofs (see essif-schemas-vc-2020-v1.jsonld). In our opinion, it would be preferable if JSON-LD contexts were provided by EBSI to all member states instead of having to do this separately for each EBSI pilot project.

We use the following technologies in our project:

• Universal Resolver → For resolving DIDs.
• Universal Registrar → For creating DIDs.
• Universal Issuer → For issuing VCs.
• Universal Verifier → For verifying VCs.
• SSI Java Libraries
• ld-signatures-java — For Linked Data Signatures.
• verifiable-credentials-java — For Verifiable Credentials.

We set up the following demonstration websites:

• https://tugraz.ebsi4austria.danubetech.com/ — Issuer demo website
• https://wuwien.ebsi4austria.danubetech.com/ — Verifier demo website

See this Github repository for additional technical details about EBSI4Austria.

Multi-University Pilot

Within EBSI’s early adopter program, EBSI4Austria also joined the multi-university pilot (MU pilot) in which the focus is on issuing and verifying student diplomas between universities but in this case, even in a cross-border scenario. This multi-university pilot should underpin the possibilities even across countries.

While working on the MU pilot, we participated in several EBSI Early Adopter program meetings to identify issuers, verifiers, and types of credentials. We were in contact with members of Spanish EBSI pilot projects (especially from the SSI company Gataca), to compare our approaches to EBSI DIDs and Verifiable Credentials. We had several technical discussions and email exchanges regarding details of those credentials, e.g. about the JSON-LD contexts and exact proof formats we were planning to use. During these exchanges, we were able to exchange initial examples of verifiable credentials and verify them.

Within one of the “clusters” of the EBSI MU pilot, we also collaborated closely with the “UniCert” aka “EBSI4Germany” project led by the Technical University of Berlin, a member of the EBSI early adopter program and the German IDunion consortium. This collaboration proved to be particularly interesting for the following reasons:

1. Since TU Berlin participates both in EBSI and IDunion, they have unique insights into the similarities and differences between these different SSI networks.

2. TU Berlin was also able to share some experiences regarding the use of existing standards such as Europass and ELMO/EMREX, which can help with semantic interoperability of Verifiable Credentials use in EBSI.

Figure 2: Multi-university pilot scenario.

Note: This blog post was co-authored by Andreas Abraham (eGovernment Innovation Center) and Markus Sabadello (Danube Tech). The EBSI4Austria project was funded under agreement No INEA/CEF/ICT/A2020/2271545.