►
From YouTube: Verifiable Credentials and KYC - Returning Control Back to the Customer, a Loyalty... - Mahesh Balan
Description
Verifiable Credentials and KYC - Returning Control Back to the Customer, a Loyalty Case Study - Mahesh Balan, Pravici LLC
In this presentation, Mahesh Balan, CEO of Pravici will present a unique approach to handling customer data in the context of a Loyalty program. Traditional loyalty applications and CRM systems store detailed PII data. What if we changed that paradigm and instead returned the full control of PII data to the member of the loyalty program ?. A member can then have full control of their PII data, in the form of a verifiable credential stored in an Identity Wallet in their loyalty app. At Pravici, we have built a loyalty application for consortiums based on Hyperledger Fabric which allows a set of companies to cooperate and run a common loyalty application. Inspired by Hyperledger Indy and Aries projects, we now have a novel approach to storing and using member PII data, minimizing risk for both the member and the loyalty consortium.
Session Details & Slides (if available)- https://sched.co/j3eF
Access All Sessions: https://events.linuxfoundation.org/hyperledger-global-forum/program/schedule/
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #HyperledgerGlobalForum2021 #Blockchain
A
Okay,
it's
10
50
pacific,
where
we
are
in
arizona,
welcome
everybody
and
good
morning
to
those
here.
I
know
there
are
people
from
practically
across
the
world
participating
today,
it's
very
exciting
to
see.
We
saw
a
lot
of
presentations
already
in
this
day
and
a
half.
I
hope
you
got
a
replay
of
vitalik's.
You
know
interview
with
brian.
It
was
also
fantastic.
A
The
second
problem
to
solve,
which
is
how
do
you
securely
store
customer
pii
data,
use
it,
but
at
the
same
time,
don't
fall
into
all
the
pitfalls
of
existing
systems.
You
know
pretty
much.
The
biggest
companies
in
the
world
have
not
been
able
to
secure
their
customer
information.
We
have
seen
that
time
and
again
and
maybe
there's
a
new
way
to
think
about
it
using
verifiable
credentials.
A
So
that's
what
we
will
talk
about
today
and
I
have
a
quick,
two
or
three
minute
demo,
which
kind
of
illustrates
the
concept
I'll
go
through
some
slides
and
then
hopefully
the
last
10-15
minutes.
We
can
spend
doing
interactive
q
a
so
please
do
post
in
the
q
a
section
or
the
chat
and
then
happy
to
answer
as
many
questions
as
possible.
A
So
who
are
we?
You
know
pravichi,
which
is
a
company
that
we
founded
in
2013.
Our
main
focus
was
crm
and
loyalty,
and
just
very
quickly
on
our
history.
We
had
worked
a
lot
with
loyalty,
applications
with
large
airlines
and
so
on
and
so
forth,
and
the
thing
that
we
learned
from
our
experience,
consulting
with
these
companies
and
enterprises,
is
that
a
loyalty
program
can
be
very
profitable
under
certain
situations.
If
it's
a
consortium
loyalty
airlines
are
the
best
example
that
you
can
think
of.
A
But
one
problem
that
happens
is
these
loyalty
programs
make
a
lot
of
money,
selling
a
ton
of
points
to
partner
ecosystems,
credit
card
companies,
car
rental
companies
and
so
on,
but
the
problem
is
one
of
reconciliation.
There
is
a
lot
of
point-to-point
integrations
that
we
have
done
personally
as
part
of
our
consulting
assignments
and
then
reconciling
becomes
a
lot
more
difficult
with
the
onset
of
blockchain
technology.
A
A
As
a
matter
of
fact,
professor
mary
talked
about
the
invoice
reconciliation
problem
with
walmart
today
morning
and
similar
situation
arises
when
you
have
a
large
set
of
partners
trying
to
resolve
the
point
balances
that
you
that
they
owe
each
other.
So
so
that's
the
core
product,
but
today
we
are
going
to
focus
on
another
aspect.
We
also
got
the
opportunity
to
be
part
of
hyper
ledger.
A
Talk
to
companies
like
abernum,
who
are
pioneers
in
the
area
of
fabric,
sorry
in
aries
and
indy,
and
then
we
said
why
not
take
these
additional
concepts
and
apply
it
to
the
the
area
of
loyalty.
So,
as
you
know,
one
of
the
biggest
problems
that
I
just
touched
upon,
that
is
the
fact
that
customer
data
today
gets
stored
in
central
crm
databases.
We
have
been
working
with
crm
for
the
last
20
years
and
this
is
a
constant
issue
right.
A
How
do
you
securely
keep
that
customer
data
prevented
from
getting
hacked
so
in
the
context
of
building
our
loyalty
application?
We
thought
why
not
do
this
right
when
a
customer
signs
up
for
a
loyalty
program,
you
collect
some
information
about
them
because
you
want
to
serve
them
better.
You
want
to
know
their
address.
Their
email
address
their
zip
code,
maybe
and
a
few
other
demographic
information
the
month
they
were
born
in
so
that
you
can
give
them
a
good
deal
that
particular
month
and
so
on
and
so
forth.
A
That's
the
typical
loyalty
system
right,
but
instead
of
storing
that
data
and
have
the
potential
of
losing
it
and
being
subject
to
all
sorts
of
fines
and
not
to
mention
the
dissatisfaction
of
the
customer,
why
not
store
it
as
a
verifiable
credential
in
a
mobile,
app,
typically
loyalty
programs
carry
a
mobile
app.
So
why
not
store
it
there
and
then
seek
the
permission
of
the
customer.
A
If
you
ever
need
to,
you
know
get
one
of
those
attributes
for
you
to
use,
and
this
way,
even
when
you
seek
the
permission
and
use
that
attribute,
you
are
going
to
use
it
ephemerally
and
you
are
not
storing
anything,
definitely
not
storing
it
to
the
blockchain
or
for
that
matter
anywhere
else.
Besides
the
secure
location,
probably
you
know
secured
through
a
fingerprint
at
the
customer's
loyalty
mobile
app.
So
that
is
the
core
idea
of
what
we
built
in
here.
A
So
I'll
just
talk
a
few
more
things,
just
our
relationship.
So
I
talked
about
our
core
loyalty
program,
you
know
and
that
you
know
as
to
why
we
used
hyperledger
fabric
for
that
and
then
I'm
just
going
to
for
those
most
of
you
in
this
audience
probably
already
are
clear
about
how
verifiable
credentials
work,
but
not
everybody
might
know
that,
so
I'm
going
to
spend
a
few
minutes.
Just
talking
about
the
you
know
the
concepts
of
verifiable
credential.
So
what
is
a
verifiable
credential?
A
It's
a
w3c
standard
that
you
may
all
be
aware
and
verifiable
credentials
have
been
incubated
in
hyperledger.
Indian
areas
under
you
know
the
umbrella
of
hyperledger
and
the
concepts
are
pretty
straightforward.
You
have
an
issuer
who
has
a
you
know,
uses
typical
public,
private,
key
cryptography
and
digital
signatures,
and
what
the
issuer
does
is.
A
Whatever
information
you
know,
you
have
a
set
of
attributes.
This
could
be
a
vaccination
certificate.
It
could
be
in
our
particular
use
case
that
we
are
talking
about.
This
is
the
set
of
pii
data
about
yourself
in
either
case.
What
you
do
is
an
issuer
issues,
the
certificate
by
signing
this
with
their
private
key
and
then
publishing
their
public
key
in
a
data
registry.
That's
typically
the
only
role
of
blockchain
in
here
this
is
hyperledger
indie,
for
example,
other
can
be
any
other
data
registry.
A
Ideally
it's
a
blockchain
because
then
it's
basically
functions
as
a
distributed.
Key
management
system,
some
metadata,
such
as
the
formats
and
so
on,
could
also
be
stored
here
in
this
data
registry.
But
the
key
issue
is
the
pii
data
medical
information.
Whatever
the
is
the
subject
of
this
particular
certificate
is
securely
held
in
a
wallet
that
is
held
by
the
customer.
In
our
case,
this
is
a
loyalty
member
and
they
are
holding
their
own
data,
so
we
literally
take
their
inputs.
We
don't
store
it
anywhere.
A
We
simply
reissue
it
as
a
credential
which
is
stored
in
their
wallet.
Now
comes
the
concept
of
a
verifier.
If
a
verifier
wants
to
check
some
attribute,
that
is
useful
in
our
case
in
loyalty,
the
attributes
will
be
like.
I
said
your
month
of
birth.
Your
email
address
your
physical
address
in
case
of
some
cases,
zip
code,
whatever
the
case
may
be,
the
verifier
can
ask
for
a
set
of
attributes,
or
it
can
even
be
even
more
sophisticated.
A
So
basically,
they
can
check
the
public
key.
They
can
check
this
digital
signature,
which
says
yes.
This
was
signed
by
the
private
key
behind
this
public
key,
it's
not
been
tampered
with,
and
then
they
can
get
attributes
or
there
is
concepts
such
as
selective
disclosure
and
zero
knowledge
proofs,
for
example.
If
you
just
needed
to
prove
that
you
are
above
21,
you
don't
need
to
reveal
your
date
of
birth.
You
can
just
reveal
the
fact
that
you
are
above
21.,
so
that's
one
zkp
application.
A
There
could
be
others,
for
example,
in
the
vaccine
case,
like
I
said
you
know,
you
could
prove
that
you
took
a
vaccine
within
the
last
three
months
and
so
on
and
so
forth.
So
this
is
the
three
parties,
the
issuer,
holder
and
verifier-
that
are
involved
in
verifiable
credentials,
and
that
is
the
kind
of
concept
that
we
have
applied
in
the
context
of
loyalty.
A
So,
basically,
like
I
said
before
what
we
end
up
doing,
is
we
extend
the
use
of
verifiable
credentials
to
store
the
loyalty,
member
pii
data
and
again,
why
store
this
data
somewhere
else
and
increase
the
risk?
You
can
now
give
the
best
of
both
worlds
using
this
technology.
Now,
typically,
when
you
sign
up
for
a
loyalty
program,
you
want
to
be
rewarded
for
the
actions
that
you
take,
the
activities
that
you
do
with
the
consortium
of
loyalty
companies,
so
you
are
willing
to
share
your
activities
with
them
so
that
you
can
earn
points.
A
So
it's
a
little
bit
different
than
some
other
verifiable
credential
use
cases
in
which
you
know
they
even
try
to
avoid
this
correlation
right,
but
in
this
case
you're
giving
them
permission
to
be
in
in
turn
to
be
rewarded
with
points.
But
there
is
no
need
for
that
company
to
know
all
your
details
and
store
it
in
their
systems.
You
know
you
hold
it.
A
A
It
might
be
a
little
bit
shocking
for
to
try
and
do
business
this
way
as
opposed
to
how
it's
been
traditionally
done.
If
you
think
about
all
the
crm
systems
that
I've
worked
in,
the
main
trust
has
been:
how
much
extra
information
can
we
collect
about
somebody?
They
want
to
track
you
every
which
way,
and
the
belief
was
that
collecting
all
that
information
they'll
be
able
to
target
you
better
right,
but
I
think
we
have
seen
the
pitfalls
of
that
type
of
stuff.
A
Secondly,
it's
I
think
the
era
has
come
that
if
somebody
wants
to
use
your
information
first
of
all,
they
need
to
seek
your
permission
and
second,
they
need
to
split
the
proceeds
of
the
benefits
of
that
with
you.
You
know,
for
example,
pay
you
with
loyalty
points.
They
can
tell
hey
if
you
give
us,
if
you
put
your
zip
code
in
your
credential,
we
are
not
going
to
just
keep
it
in
a
database,
but
even
just
adding
that
will
give
you
some
points
for
that,
because,
once
in
a
while.
A
Your
permission
and
use
that
particular
piece
of
data
right,
so
that's
kind
of
where
we
want
to
support
the
concept
of
true
data
privacy
by
putting
this
personal
information
into
a
mobile
wallet
and
then
letting
the
user
keep
control
of
that
right.
So
that
is
the
large
kind
of
theory
in
how
we
built
this.
A
A
B
A
The
there
are,
you
know,
all
the
you
know,
this
is
no
different
than
in
any
other
permission
network.
As
far
as
the
concepts
of
verifiable
credentials,
as
you
know,
I
mean
the
whole
thing
is
the
credential
is
held
in
the
wallet
of
the
customer
and
therefore
we
are
really
not
centralizing
the
storage
of
that
information.
We
have
a
reference
to
the
customer,
typically
a
member
id.
So
what
happens
if
a
customer
needs
to
follow
the
gdpr
concept
of
hey?
Forget
me
from
the
system
it
deletes
this
mobile
app.
A
We
have
lost
the
cryptographic
verification
as
a
matter
of
fact,
the
way,
a
person
even
logs
into
the
into
the
loyalty
application
through
the
mobile
app,
is
using
a
verifiable
credential.
The
credential
that
was
issued
to
you
with
did
com
exchange.
You
are
able
to
prove
that,
whoever
you
know
you
have
you
hold
this
credential.
A
There
is
a
credential
id
or
a
member
id
in
there,
and
you
can
prove
that
you
know
whoever
is
holding
this
phone
is
is
having
that
right.
So
we
don't
need
to
know
any
further
information
when
that
reference
goes
away
and
that
person
deletes
it.
We
only
have
left
with
us
a
member
id
which
is
not
really
attached
to.
We
don't
know
who,
because
the
the
member
id
is
attached
to
a
certificate,
you
know
or
a
digital
certificate
which
the
person
has
decided
to
get
rid
of,
and
therefore
we
pretty
much
disappear.
That
data.
B
A
B
Comes
to
building
a
fluid
user
experience,
a
lot
of
data
is
involved
in
storing
lots
of
personal
customer
information
equals
a
lot
of
liability
as
a
business.
How
can
you
manage
empowering
customers
to
own
their
data
while
not
losing
the
conveniences
of
storing
information
in
a
dedicated
database,
pravichi,
tlp,
utilizes,
self-sovereign
identities
and
verifiable
credentials
to
solve
this
problem?
B
Here's
an
example:
a
customer
kevin
has
just
downloaded
a
loyalty
program
app
and
is
ready
to
register,
though
this
may
look
like
your
typical
registration
process.
In
the
background,
a
digital
credential
with
this
information
is
stored
in
kevin's
personal
mobile
wallet.
Kevin's
information
is
securely
stored
on
his
personal
device,
not
in
a
database
now
to
log
in
kevin,
selects
login
with
verifiable
credentials.
With
this
feature,
kevin
does
not
need
to
memorize
a
username
or
password
the
loyalty
app.
Instead
requests
to
check
he's
carrying
the
appropriate
account
credential.
B
He
simply
scans
his
fingerprint
to
authorize
the
app
access
and
is
redirected
to
the
loyalty
app
home
page
kevin
wants
to
order
a
beer
flight
from
his
favorite
brewery.
When
he's
ready
to
redeem,
the
app
asks
permission
to
confirm
he
is
of
legal
drinking
age,
with
a
quick
scan
of
his
fingerprint,
the
app
checks
kevin
is
above
21
and
approves
the
redemption
request.
In
this
way,
digital
credentials
allow
kevin
to
take
control
over
his
information,
while
maintaining
the
flow
of
a
smooth
customer
experience
learn
more
at
proficie.com.
A
So
that
is
the
presentation
you
know,
which
kind
of
illustrates
the
concepts
that
we
just
talked
about,
and
it
shows
how
you
can
construct
a
loyalty
application.
Now,
of
course,
there
are
some
questions
that
you
might
have.
For
example,
you
know:
how
did
you
check
the
age?
It's
a
self-declared
date
of
birth
that
you
do
when
you
sign
up
to
a
loyalty
program.
A
A
What
that
happens
when
that
happens,
when
you
have
multiple
credentials
in
a
wallet,
it's
possible
to
do
what's
called
a
composite
presentation
right,
for
example,
you
can
present
your
proof
that
you're
about
21
from
your
driver's
license
and
from
your
personal
information,
digital
credential,
you
can
pull
some
other
data,
so
these
possibilities
are
certainly
there.
So
let
us
see.
A
And
I
think
trevor
you
said:
are
you
thinking
that,
because
the
same
entity
is
both
the
issuer
and
verifier
yeah?
In
this
particular
case,
you
know
we
just
want
to
use
the
verifiable
credential
concept
so
that
we
don't
hold
that
information
right
in
a
typical
system.
The
issuers
are
different
than
verifiers.
In
our
case,
we
are
using
it
in
a
slightly
different
way.
Thank
you,
jim.
Let
us
see
if
there
are
questions
on
this
one
you
know
is
the
loyalty
application
and
the
wallet
application
the
same
application,
or
are
there
two
different
apps?
A
There
are
two
different
apps.
The
the
wallet
application
is
the
mobile
piece
which
talks
to
think
about
it
as
talking
to
an
api
layer
which
is
the
rest
of
the
loyalty
application
in
in
itself.
So
the
way
we
architect
is,
of
course,
we
have
hyperledger
fabric
in
the
back.
On
top
of
it
is
our
you
know,
chain
code
and
then
the
api
layer,
and
on
top
of
the
api
layer
we
have
an
administrative
console
for
administrative
purposes.
We
have
a
mobile
app
which
can
talk
to
it.
A
A
That's
an
interesting
question,
which
is
you
know
this
this
this
whole
paradigm
of
using
wallets
is
going
to
get
stronger
and
stronger
and
what
happens
is,
as
time
goes
by.
People
would
want
to
have
both
the
the
ability
to
store
verifiable
credentials.
It
could
be
stored,
cryptocurrencies
and
so
on
and
so
forth.
So
the
wallet
usage
needs
to
get
way
better
right
and
I
think
over
time
it
will
evolve,
because
today
wallets
can
be
a
little
cumbersome
how
to
restore
them.
A
You
know
if
you
lose
stuff
and
so
on
and
so
forth.
So
I
think
that's
an
area
of
research
that
is
very
strong.
I
saw
some
great
new
advances
using
things
like
threshold
signatures,
which
will
make
the
application
of
wallets
much
easier
without
changing
traditional
customer
onboarding
process
in
lending
world
akshay.
A
Could
you
integrate
this
in
a
traditional
lender
customer
you
could
again
depending
on,
I
think
in
the
loyalty
use
case,
the
bottom
line?
Is
you
know
that
information
we
feel
you
know
is
secure
enough
in
their
in
their
wallets?
Like
I
said,
the
wallet
process
needs
to
get
a
lot
more
stronger,
because
in
a
lending
world
there
may
be
multiple
occasions
for
them
to
get
your
information
right,
so
it
becomes
really
difficult.
A
If
you
know
you
have
to
have
the
person
online
to
authorize
every
interaction,
I
think
the
world
is
going
to
move
to
a
better
place,
akshay,
where
there
may
be
ability
to
have
secure
cloud-based,
wallets
agents,
which
you
can
deputize
that
can
work
with
those
wallets
and,
like
I
said,
with
concepts
like
threshold
signatures
where
you
have
multiple
parties
will
have
to
will
have
to
agree.
Instead
of
this
single
private
key
being
the
problem
right,
you
lose
the
private
key.
You
lose
everything
type
of
a
situation
when
those
improve.
A
A
All
right,
if
nothing
else,
then
we
will
close
a
little
early.
Give
you
guys
some
some
of
your
time
back,
enjoy
the
rest
of
the
presentations
again
I'll
post
here
in
chat
where
you
can
reach
me.
If
you
have
further
questions
I'll,
be
happy
to
be
in
touch
or
hit
me
up
in
linkedin
and
happy
to
answer
any
questions.
A
A
A
A
A
So
far
the
concepts
of
tokens
is
a
little
bit
different
than
you
know,
an
ico,
a
regular
crypto
token
right
tokens
are
covered.
Basically,
what
happens
is
when
a
company
issues
tokens?
They
differ
the
revenue
right.
They
defer
the
revenue
for
that
amount.
So
let's
say
they
give
you
a
dollar
worth
of
points
for
10
worth
of
purchase
that
you
made.
A
Basically,
they
differ
that
one
dollar
of
revenue
until
you
redeem
the
points,
so
all
points
are
actually
backed
by
the
deferred
revenue
of
that
company,
that's
a
concept
of
breakage
and
so
on
and
so
forth
by
which
it's
reconciled.
So
the
the
accounting
behind
it
is
a
little
bit
different,
but
there
could
be
a
way
in
which
you
know.
Crypto.
Tokens
can
also
be
acting
as
loyalty
points.
I
think
that
age
is
coming,
which
wallet
app?
Are
you
using,
and
where
can
I
find
the
aps
to
connect
my
app
to
it?
A
A
Are
you
running
on
a
pre-existing
network?
So
these
are
you
know
individual
networks
that
we
have.
We
are
standing
up
for
customers
based
on
their
requirement.
You
know
a
consortium
of
companies
get
together.
We
stand
up
fabric,
we
can
do
it
in
aws
oracle
cloud.
You
know
pretty
much
anywhere
that
the
customer
wants
in
our
pilot.
We
actually
did
it
through
a
private
network
that
the
automotive
oem
wanted.
A
A
A
So
we
know
the
communication
back
and
forth,
but
the
the
most
important
thing
to
really
understand
is
you
know
we
kind
of
know
what
is
in
the
credential
simply
because
we
defined
it,
but
could
we
use
just
any
public
wallet
that
somebody
else
writes
it
can
be
done.
The
only
problem
is,
like
you
said,
the
integration
between
the
loyalty
application
pieces
and
what
needs
to
be
retrieved
from
the
wallet
could
be.
You
know
a
little
it
just
smoothed
by
the
fact
that
it
is
in
a
single
application.