A Self-Sovereign Identity Blockchain Framework for Access Control and Transparency in Financial Institutions

Abstract

In recent years, with the development of blockchain technology and increased awareness of personal privacy, Self-Sovereign Identity (SSI) has become a hot topic. SSI gives customers more autonomy over their personal information, allowing them to control who can access and use their personal information. This provides customers with higher levels of privacy protection, as their data are no longer controlled by centralized institutions. To address the credit assessment needs of financial institutions, this paper proposes a Customer Self-Sovereign Identity and access-control framework (CSSI) based on SSI technology. Customers can securely store assessable assets and credit data on the blockchain using this framework. These data are then linked to a digital account address. With customer authorization, financial institutions processing loan applications can comprehensively evaluate customers’ repayment capabilities and conduct risk management by accessing this credit data. CSSI assists financial institutions in optimizing complex and repetitive processes involved in customer credit assessment and loan origination through SSI and access control, thereby reducing unnecessary risks.

1. Introduction

In the era of big data, information technology has emerged as a central focus of development across diverse industries [1]. Over recent years, financial institutions have increasingly leveraged various information technologies to propel digital transformation. These technologies encompass artificial intelligence, blockchain, image recognition, machine learning, and big data analytics. Digital transformation has emerged as a pivotal trend in the financial sector, empowering institutions to conduct comprehensive and precise market analysis, forecast future trends, bolster overall business efficiency and risk management, curtail labor costs, and optimize business processes holistically. This facilitates the streamlining of cumbersome manual operations and mitigates the risk of human errors, thus catering to consumers’ demand for convenient and efficient financial services. Financial digital transformation spans a range of facets, including mobile payments, internet banking, intelligent customer service, smart investments, and cryptocurrencies.

The 2018 Facebook data misuse incident involved the data-sharing practices of Cambridge Analytica, whereby personal data from millions of Facebook users was collected through an application and utilized for analyzing voter behavior in political campaigns, subsequently influencing election outcomes [2]. This event triggered extensive discussions and brought to light the issue of centralized storage of personal data. Presently, the majority of personal data are governed by a single organization or authority, leaving individuals with limited control over their own data and minimal insight into its utilization. Consequently, the concept of self-sovereign identity (SSI) has gained increasing attention, as individuals view their data as an asset and seek to effectively control and manage it [3]. They seek autonomy to determine which data can be shared and with whom it can be shared.

Traditional financial operations involve numerous steps and processes, with limited information flow between different financial institutions. This necessitates customers to repeatedly undertake cumbersome business procedures, leading to significant time costs. Moreover, information asymmetry heightens uncertainty and risk for financial institutions. Information sharing within the financial sector emerges as a crucial developmental trend, enabling financial institutions to exchange customer information, transaction records, risk assessments, data analytics, market insights, and technologies among themselves. Through financial information sharing, overall efficiency, information transparency, and risk-assessment capabilities can be bolstered, thereby diminishing information asymmetry and uncertainty. This fosters deeper collaboration among financial institutions, fostering mutually beneficial and win-win outcomes. Financial information sharing holds the potential to greatly enhance customer experiences, streamline processes, and offer more convenient services.

In the current scenario, when seeking a loan from traditional financial institutions, customers must physically visit multiple banks to gather account transaction details, income statements, real-estate holdings, personal credit histories, and other requisite documents. The application process typically entails completing numerous contracts, forms, and reports, followed by labor-intensive verification and validation procedures. This process proves to be time-consuming and costly for customers. Moreover, when customers need to reapply for a loan in the future, they must repeat the data retrieval process and undergo re-evaluation. Traditional financial institutions heavily rely on manual processes for loan operations, involving manual data entry for applications and manual verification of loan information. This reliance on manual tasks can lead to human errors and delays, thereby prolonging the application and approval process. And in the financial market, various financial institutions hold distinct sets of information that are not openly shared among them. This lack of information sharing may hinder financial institutions from accessing adequate data to thoroughly evaluate borrowers’ credit risks and repayment capabilities. As a result, financial institutions may render incomplete judgments during the loan approval process, thereby heightening loan risks and potentially destabilizing the entire financial system. On the borrowers’ end, the absence of comprehensive information accessible to financial institutions may prompt the adoption of more conservative loan policies, leading to elevated loan interest rates. This could result in unfair or inaccurate assessments of interest rates, thereby impinging upon borrowers’ rights. Each financial institution operates within its own system, which often lacks mechanisms for interconnectivity and communication. The prevailing design of these systems is primarily centralized in nature. Additionally, the centralized design renders vulnerabilities such as single points of failure (SPF) and susceptibility to denial-of-service (DoS) attacks [4].

Privacy protection stands as a paramount concern for financial institutions amidst the process of digital transformation. Technological progressions have resulted in a notable surge in the volume and diversity of sensitive personal data. These data are employed and exchanged across various contexts, thereby heightening apprehensions regarding potential misuse or unauthorized utilization of personal information. To fortify the safeguarding of personal data, Self-Sovereign Identity (SSI) bestows individuals with authority over their own identity, enabling them to regulate who can access and utilize their personal data. This framework ensures that data are utilized within authorized and regulatory-compliant parameters, with continuous monitoring and oversight of institutions or entities accessing personal data [5].

In light of these considerations, this paper proposes a framework that enables the uploading of personal assets and credit information required for loan services onto the blockchain, empowering customers with self-sovereign identity and access control capabilities. Through customer authorization, financial institutions can access customers’ personal assets and credit information on the blockchain, thereby facilitating data sharing among financial institutions and organizations. This enhances the efficiency and transparency of financial business processes, reduces the manual operations and time costs associated with customer application processes and financial institution data retrieval, and mitigates the impact of information asymmetry. The immutability feature of blockchain technology ensures that data uploaded to the chain cannot be erased or tampered with. Furthermore, the decentralized system architecture enhances information security, ensuring proper management and protection of customers’ personal data.

This paper proposes a Customer Self-Sovereign Identity and access-control framework (CSSI) based on SSI technology. Customers can securely store assessable assets and credit data on the blockchain using this framework. These data are then linked to a digital account address. With customer authorization, financial institutions processing loan applications can comprehensively evaluate customers’ repayment capabilities and conduct risk management by accessing this credit data. CSSI assists financial institutions in optimizing complex and repetitive processes involved in customer credit assessment and loan origination through SSI and access control, thereby reducing unnecessary risks.

Section 2 provides an overview of the background and related works. Section 3 elaborates on the proposed system design. Section 4 outlines the implementation and validation of the system. In Section 5, a comparative analysis between our proposed framework and other relevant architectures is presented, focusing on differences and highlighting the features and security aspects of the CSSI framework. Finally, Section 6 concludes the study and discusses potential future avenues of research.

2. Background and Related Works

Each technology included in Section 2 was selected for its unique contribution to the CSSI framework. Blockchain ensures data immutability and security, while smart contracts enable automated processes. Verifiable Credentials provide a standardized method for data validation, and zk-SNARK enhances data privacy without compromising verification. These technologies collectively address critical requirements of the framework.

2.1. Blockchain

In 2008, a figure or group known as Satoshi Nakamoto introduced the concept of blockchain, a decentralized database technology aimed at enhancing data security and trustworthiness. Blockchain ensures data immutability and facilitates multiple nodes to collectively record transaction records. Each node possesses a complete copy of the database, operating independently yet in coordination with others. The core attributes of blockchain are decentralization and Distributed Ledger Technology (DLT), which contrast with traditional centralized management structures, offering a distributed network for verification and storage. The application of blockchain technology has become widespread, encompassing prominent cryptocurrencies like Bitcoin and Ethereum, as well as various sectors such as smart contracts, identity verification, the Internet of Things (IoT), supply chains, healthcare, finance, and insurance. It is foreseeable that as blockchain technology continues to mature, it will exert a profound impact on society, emerging as a potent force propelling industry and societal development.

Blockchain, a decentralized technology, operates without the need for a central authority. Each node in the network holds a full copy of the data, allowing for decentralized operation, data verification, exchange, and maintenance. Furthermore, each block in the blockchain records the hash value of the preceding block, ensuring data integrity by making alterations or deletions challenging. This immutability characteristic serves as a safeguard against data tampering. The publicly accessible nature of blockchain data enables any participating node to verify and view transaction records, reducing the impact of information asymmetry and enhancing the system’s credibility. Additionally, as a type of Distributed Ledger Technology (DLT), blockchain distributes data across multiple nodes, enhancing data reliability, response speed, and resilience against Distributed Denial of Service (DDoS) attacks. Once a transaction is written into the blockchain, it becomes immutable, distributed to all nodes, making its existence irrefutable.

As the application scenarios of blockchain continue to expand, different types of blockchains have been designed to meet the needs of various use cases. The most common type is the public blockchain, also known as Permissionless Blockchain. In a public blockchain, transaction details are fully transparent and open to the public. Since the emergence of Bitcoin, public blockchain technology has found significant application in the financial sector [6]. Anyone can freely participate in transaction verification and decision-making. Examples of public blockchains include the Ethereum blockchain. On the other hand, the private blockchain is a closed blockchain that requires authorization from a single organization to access and verify the blockchain data. Transaction information is not publicly disclosed, providing higher privacy protection compared to public blockchains. Private blockchains typically involve fewer validating nodes, resulting in faster verification speeds. They are mainly used for data management and sharing within enterprises or organizations. Consortium blockchain, meanwhile, is a semi-open blockchain type that lies between public and private blockchains. Consortium blockchains are maintained by multiple specific organizations, and access to and verification of blockchain data require authorization. Common applications of consortium blockchains include product supply chains and blockchain networks between financial institutions.

The blockchain consensus mechanism involves all nodes in a blockchain network collectively maintaining the ledger, utilizing consensus algorithms to synchronize content, ensuring consistency, and preventing tampering. Different consensus mechanisms, such as Proof of Work (PoW), Proof of Stake (PoS), Delegated Proof of Stake (DPoS), and Proof of Authority (PoA), are adopted based on specific ledger requirements. PoW, currently the most widely used, requires nodes to dedicate computational resources to solve complex mathematical problems, offering high security but slower transaction speeds and substantial resource consumption. PoS, in contrast, determines node weight and mining probability based on cryptocurrency holdings, providing faster transactions but is susceptible to certain risks. DPoS, an optimized mechanism derived from PoS, improves transaction speed, efficiency, and overall network throughput by selecting validation nodes through elections. In PoA, only select participants possess authority, enabling fast transaction speeds but potentially leading to centralization issues due to power centralization among specific participants.

2.2. Smart Contracts

Smart contracts, initially proposed by Nick Szabo in 1994 and a key technology of Blockchain 2.0 [7], enable the automatic execution of contracts without third-party intervention. Once predefined conditions are met, smart contracts are triggered and executed, ensuring transparent, fair, and interference-free transactions in untrusted environments. They possess characteristics such as high execution efficiency, as they automatically execute when conditions are met, ensuring no need for third-party intervention. Additionally, running on blockchain nodes provides high security against tampering and attacks, ensuring contract protection. Smart contracts also offer public transparency, as contracts are stored on the blockchain, accessible to all nodes for content querying. They are customizable, allowing programming according to various needs and scenarios, and immutable once deployed, ensuring contract credibility.

The most commonly used smart contract language is Solidity, with syntax similarities to C++ and JavaScript. Solidity is used to write contracts compiled and executed on the Ethereum Virtual Machine (EVM). Ethereum executes level-3 ledger applications using smart contracts, typically specified in Solidity, as (distributed) state machines. Solidity is an object-oriented programming language with a class-based structure [8].

2.3. Non-Fungible Token (NFT)

NFTs, or Non-Fungible Tokens, represent a unique form of digital asset built on blockchain technology, often utilizing the ERC-721 smart contract standard [9]. Each NFT is distinguished by a unique identifier (ID) and is linked to a specific digital asset, rendering it one-of-a-kind. The value of an NFT is contingent upon the uniqueness of the digital asset it represents, leading to a diverse array of applications spanning art, gaming, music, virtual real estate, digital identity, membership cards, and the digitization of physical assets.

Key characteristics of NFTs include:

• Verifiability: NFTs are founded on the Ethereum blockchain, enabling transparent verification and traceability of ownership, which can be publicly verified.
• Irreplaceability: Each NFT is distinct and holds its own intrinsic value and ownership, making them irreplaceable by other tokens.
• Indivisibility: In contrast to cryptocurrencies, NFTs are indivisible entities and cannot be subdivided.
• Immutability: Transaction records of NFTs are permanently stored on the Ethereum blockchain, ensuring data integrity and preventing modification once recorded.

The tokenization of real-world physical assets is a significant trend in the future of Decentralized Finance (DeFi), involving the conversion of tangible assets like commodities, stocks, real estate, and luxury goods into tokens or NFTs to validate their existence. By tokenizing assets, traditional intermediaries are bypassed, resulting in cost and time reductions. This enhances the potential value of DeFi and improves the efficiency and autonomy of DeFi applications. Tokenizing assets and placing them on the blockchain heightens transparency and liquidity. Additionally, tokenized assets can be distributed among multiple holders, enabling investors to pursue diversified investment portfolios and mitigate risks.

2.4. Self-Sovereign Identity (SSI)

Self-Sovereign Identity (SSI) revolutionizes individual identity recognition by granting individuals full control and ownership over their digital identities, enabling them to manage the disclosure of personal sensitive information. Unlike traditional centralized systems, SSI operates on a decentralized ledger known as Decentralized Identifiers (DID), ensuring that personal data are no longer under the control of centralized entities. This paradigm shift empowers individuals with unparalleled control over their personal sensitive information, resulting in enhanced privacy protection and security.

Under the SSI model, individuals enjoy the freedom to exercise their fundamental human rights, such as the right to expression and the right to privacy, without constraints imposed by any centralized authority. This transformative approach to identity recognition represents a significant advancement towards safeguarding individual autonomy and privacy in the digital age [10].

The characteristics of Self-Sovereign Identity (SSI) encompass several key aspects:

• Control: SSI empowers individuals with greater control over their personal data by adopting a user-centric identity management approach. Individuals hold and manage their own private keys, allowing them to exercise control over their identity and personal sensitive information.
• Access: Individuals have the autonomy to decide whether to disclose access permissions and the duration of access to their personal sensitive data to institutions or organizations, providing them with enhanced privacy control.
• Persistence: Unlike centralized services that may be susceptible to attacks and service disruptions, SSI addresses these vulnerabilities by storing data on a decentralized ledger. This ensures greater resilience and reliability, contributing to a higher level of customer experience.
• Sharing: SSI promotes interoperability of identity verification by facilitating the exchange of identity information among multiple verification institutions. Identity information sharing is facilitated with the consent of individuals holding the identity, fostering seamless collaboration and data exchange.
• Privacy Protection: Leveraging Decentralized Identifiers (DIDs) and cryptographic techniques, SSI enhances privacy protection for individuals, safeguarding their personal sensitive data from unauthorized access or manipulation.

Traditional Centralization Model of Identity is characterized by the control and management of personal identities by centralized institutions, including governments, financial entities, and social media platforms. In this model, these institutions hold individuals’ personal information, often leaving individuals with limited control over their identities and personal data. Consequently, individuals depend on centralized organizations to store their personal information and conduct identity verification and authorization processes.

Contrastingly, Self-Sovereign Identity (SSI) represents a decentralized-identity model centered around the concept of Decentralized Identifiers (DIDs). This paradigm shift empowers individuals with complete control over their identities and personal sensitive information. Within the framework of SSI, individuals can independently create, manage, and share their digital identities without relying on centralized institutions. Consequently, SSI offers a more autonomous and privacy-preserving solution compared to the centralized-identity model.

2.5. Decentralized Identifiers (DID)

Decentralized Identifiers (DIDs) serve as a foundational element of Self-Sovereign Identity (SSI), operating as an open standard designed to enable individuals to control their identities securely and privately. Leveraging Distributed Ledger Technology (DLT), DIDs provide unique and permanent identity identifiers, facilitating the creation, management, and control of identities for users [11,12].

DID consists of three components, which are as follows:

• DID Scheme: This component encompasses information pertinent to the DID, including public keys, verification services, and authentication details.
• DID Method: Serving as an identifier for a specific method, this component defines rules or processes tailored to different application scenarios. It enables the customization of rules and methods to accommodate specific requirements.
• DID Method-Specific Identifier: This unique value serves as an identifier for the DID, representing the identity of an entity or individual. It plays a crucial role in distinguishing and identifying the associated identity within the decentralized ecosystem.

2.6. Verifiable Credential (VC) and Verifiable Presentation (VP)

The W3C specification for Verifiable Credentials (VCs) introduces a method for representing credentials on the internet [13,14]. VCs serves as a digital certificate that enables users to verify their identities on a decentralized blockchain. These credentials can encapsulate various types of information typically found in traditional paper certificates, such as bank account details, credit information, and licenses. A Verifiable Credential comprises three essential elements, which are as follows:

• Metadata: Metadata furnishes contextual information about the Verifiable Credential itself, encompassing details such as types, issuance dates, expiration dates, and more. This metadata plays a crucial role in establishing the validity and relevance of the credential.
• Claims: Claims denote the actual information or attributes that the credential holder seeks to assert or validate. This may include personal identity details, qualifications, certificate numbers, and other pertinent data required for verification.
• Issuer Proof: The issuer proof comprises cryptographic proof or a digital signature generated by the credential issuer. It serves to demonstrate the authenticity and integrity of the credential, providing assurance that the credential originates from a legitimate issuer.

Verifiable Presentations (VPs), a concept introduced by W3C, serve as containers that can hold one or multiple Verifiable Credentials (VCs). VPs are designed to offer a secure and trusted method for presenting and sharing digital credentials.

Holder proof, within the context of VPs, refers to the cryptographic proof or digital signature generated by the VC holder. This proof serves to demonstrate the integrity and authenticity of the VP, employing encryption techniques and digital signatures to ensure trustworthiness.

The components of a Verifiable Presentation include Metadata, Verifiable Credentials (VCs), and Holder Proof. These elements collectively contribute to establishing the validity and reliability of the presented digital credentials.

2.7. zk-SNARK

Zero Knowledge Proof (ZKP), first proposed by Z. Goldwasser et al. in 1985, is an encryption protocol designed to verify the truth of a statement without revealing any specific information about that statement. The prover aims to demonstrate knowledge of a statement to convince others of its correctness while withholding the actual content of the statement.

ZKPs can be classified into two forms: interactive and non-interactive. Non-interactive ZKPs offer several advantages over interactive ones. Unlike interactive ZKPs, non-interactive variants do not require multiple rounds of communication during the proving process, making collusion among attackers more difficult and thereby enhancing security. Additionally, non-interactive ZKPs typically incur lower computational and communication costs due to the absence of multiple interactions.

A prominent example of non-interactive ZKP is zk-SNARK, which stands for Zero-Knowledge Succinct Non-Interactive Argument of Knowledge. zk-SNARKs offer enhanced efficiency and scalability by significantly reducing the size of the proof. This reduction enables verification to be conducted swiftly, making zk-SNARKs particularly suitable for applications requiring efficient and secure verification processes.

3. System Design

For instance, the proposed CSSI framework could be applied to streamline the credit approval process for small-business loans, where customers could securely share their financial and credit information directly with banks via blockchain. Similarly, it could assist in reducing fraud in property transactions by allowing verifiable asset ownership data to be shared among stakeholders.

Incentives for financial institutions are crucial for system adoption. The CSSI framework offers benefits such as cost savings through process automation, enhanced data security, and improved customer trust. These advantages aim to make blockchain adoption more attractive compared to maintaining traditional centralized systems.

This paper introduces a Customer Self-Sovereign Identity and access-control framework (CSSI) based on blockchain. Customer identity data are no longer stored in centralized institutions or organizations, enabling customers to independently manage and control the usage of their personal data, thus enhancing customer privacy protection and access-control rights. The CSSI framework, divided into two parts for introduction, encompasses the on-chain storage of customer’s personal assets and credit data as the first part, and the customer’s loan application and access control as the second part.

The significant roles of SSI within this framework are elaborated below, with Figure 1 illustrating the inter-relationships among the three pivotal roles in SSI.

• Ethereum Blockchain: This paper employs the public Ethereum blockchain as a transparent and inclusive platform for implementing decentralized identity authentication and access control. It offers an environment where anyone can participate. Utilizing blockchain technology ensures data immutability, preserving the integrity of sensitive customer data once it is written into a block.
• Decentralized Identifiers (DID): DID serves as the fundamental principle of SSI, granting customers decentralized digital identities. It enables customers to store their identities and personal data in their own digital wallets rather than centralized institutions, thereby enhancing privacy protection and improving the customer experience.
• Verifiable Certificate (VC): VC encompasses three essential roles:

  -

  Issuer: Every VC has an issuer who uses digital signatures to ensure the authenticity of customer sensitive data and the VC itself.

  -

  Holder: The customer who possesses the VC. They can store the VC in their digital wallet and present it as proof when requested by verifiers. Customers can use the certificate to verify their identity and have control over their personal sensitive data.

  -

  Verifier: The Verifier is responsible for verifying the VP of the Holder. They utilize a public key to authenticate the validity of the certificate.

3.1. Part 1: On-Chain Storage of Customer’s Personal Assets and Credit Data

Figure 2 depicts the steps involved in uploading the customer’s personal assets and credit data on-chain. The steps are described as follows:

• Step 1: The customer initiates the process by applying for Verifiable Certificates (VCs) from issuers (such as banks, institutions, credit bureaus) containing personal assets and credit data to validate the accuracy of the customer’s on-chain data.
• Step 2: DID identity verification is conducted. As all entities on the blockchain are managed by nodes on the Ethereum blockchain, issuers utilize DID verification procedures to authenticate the customer’s identity. Customers also have the option to verify the identity of issuers.
• Step 3: If the customer’s identity is confirmed, the issuer issues VCs and transfers them to the customer.
• Step 4: The customer creates a Verifiable Presentation (VP) and submits it to verification nodes for validation. The VP comprises one or more VCs from various issuers, bundled together in a verifiable manner.
• Step 5: The submitted VP undergoes verification using zk-SNARK. If the VP is deemed valid, successful verification is communicated to the customer.
• Step 6: The verifier divides the VC (Verifiable Credential) due to the limited capacity of a block to store data.
• Step 7: The customer’s data along with the VC are uploaded and stored on the blockchain.

In addition to storing existing physical assets on-chain, customers have the option to include their digital assets (such as cryptocurrencies and NFTs) on-chain as well. These digital assets can be considered within the scope of the customer’s personal asset assessment. This approach enables financial institutions to conduct a more comprehensive evaluation of the customer’s asset status and accurately assess their financial condition and credit risk.

By including digital assets on-chain, financial institutions can gain deeper insights into the customer’s asset portfolios, encompassing both physical and digital assets’ values. This, in turn, allows them to offer more tailored financial products and services effectively. Figure 3 outlines the process of customers putting digital assets on-chain, detailed as follows:

• Step 1: Customers initiate a connection request with a digital wallet (such as MetaMask, Trust Wallet, etc.) to link their web interface with the digital wallet.
• Step 2: Customers undergo identity verification through the digital wallet to verify the legitimacy and authenticity of their identity. They have the option to select which digital assets (such as cryptocurrencies and NFTs) they want to include the addresses of on-chain.
• Step 3: Upon successful identity verification, the digital wallet sends back the addresses of the corresponding digital assets to the customer’s web interface.
• Step 4: The customer uploads the addresses of their chosen digital assets to be stored on the blockchain. In the future, when the customer applies for a loan, financial institutions can evaluate their digital assets as part of the assessment process.

3.2. Part 2: Customer’s Loan Application and Access Control

When customers apply for a loan, they are required to furnish personal asset and credit information to the financial institution. The financial institution evaluates the customer’s repayment capacity based on this provided information to decide whether to approve the loan, determine the loan-to-value ratio, and set the interest rate. However, customers may be reluctant to fully disclose their personal assets and credit information to the financial institution.

Therefore, the CSSI framework empowers customers with greater access control rights. It enables them to select the recipients, content, and duration of access when disclosing personal sensitive information, thereby enhancing privacy protection. Figure 4 illustrates the steps involved in loan application and access control by customers.

• Step 1: The customer, with a loan requirement, initiates a loan application with the financial institution by submitting loan documents specifying the type of loan, desired loan amount, and loan term.
• Step 2: During the loan application process, customers typically need to provide financial and credit information. However, leveraging the CSSI framework, customers have the autonomy to decide whether to disclose personal assets and credit information to the financial institution. They can freely choose the recipients, content, and restrict the duration of access, thereby ensuring the security of their personal privacy and preventing unauthorized use of their data.
• Step 3: The financial institution accesses the data on the blockchain, based on the personal financial and credit information permitted by the customer. By accessing this blockchain data, the financial institution gains access to crucial financial and credit information.
• Step 4: Subsequently, the financial institution evaluates the customer’s repayment capacity and determines whether to approve the loan. Simultaneously, the financial institution calculates the loan-to-value ratio, which represents the ratio of the loan amount to the collateral value, along with determining the loan interest rate.

This paper also presents a comprehensive model of customer assets and credit, which integrates traditional bank accounts, credit information, and digital assets (such as cryptocurrencies and NFTs) with a unique digital account address and decentralized identity (DID). By establishing this digital linkage between physical personal assets and credit information, communication and information sharing between physical and digital data are enabled.

In this model, each customer’s assets and credit information are stored on the blockchain, including Verifiable Credentials (VCs) issued by the respective institutions to validate the authenticity of the data. These data are distributed across multiple nodes, ensuring permanent storage and security. An example is illustrated in Figure 5.

The data stored by customers on the blockchain undergoes de-identification processing, where personal identities and sensitive information are anonymized. This ensures that the stored data on-chain cannot directly identify specific individuals or sensitive information. De-identification measures are implemented to safeguard customer privacy and data security. Additionally, customers retain control over accessing their personal assets and credit information, enabling them to limit the content and time range of access. This empowers customers with ownership over their assets and credit information, allowing them to selectively share specific information with financial institutions to fulfill loan applications or other financial needs.

Additionally, for access control for traditional financial assets and credit information, we have designed two algorithms. Algorithm 1 enables customers to establish access permissions for their personal assets and credit information. To facilitate de-identification, we replace traditional financial institution account and credit bureau numbers with the institution name (F_name) and the certificate number (CN). If the customer’s data are already stored on the blockchain and the customer grants access (Auth), we establish the access period based on the customer’s specified duration. Since the customer’s input is in hours (B_hour), conversion of the time into block timestamps is necessary (D_time).

Algorithm 1. Access Authorization

Input: Faddr, Fname, CN, Dtime, Auth   1: If IsExist(Fname, CN):   2:  If (Auth =True):   3:   Dtime → Dtime × Bhour   4:   Period = CurrentTime + Dtime   5:   Set(Faddr) → Period   6:   Ser(Faddr) → Auth   7:  Else   8:   Period = 0   9:   Set(Faddr) → Period   10:  Else   11:  Return ‘Customer info does not exist’

In Algorithm 2, if the data exists, the access period has not expired, and the customer has provided consent, the financial institution can access the customer’s personal assets and credit information through their address (F_addr).

Algorithm 2. Access Customer Information

Input: Caddr, CN   1: If IsExist(Fname, CN):   2:  If (CurrentTime > Faddr.Period):   3: If (Faddr.Auth):   4:   AccessCusInfo(Caddr, CN)   5:   Else   6:   Return ‘Customer does not allow’   7:  Else   8:     Return ‘The access period is expired’.   9: Else   10:   Return ‘Customer profile does not exist’

4. System Implementation

To address scalability concerns, future iterations of the CSSI framework will explore layer-2 solutions like rollups or sharding, allowing the system to handle large numbers of transactions and users effectively. These advancements will be essential for achieving real-world scalability on public blockchain networks. To validate the feasibility of the CSSI framework proposed in the previous section, in this chapter we will introduce our simulation testing framework and tools. We will first discuss the simulation tools and system environment used, followed by an overview of our implementation and simulation results. Finally, we will confirm the feasibility of our proposed CSSI framework through simulation testing.

4.1. System Environment

Firstly, in order to simulate the CSSI framework proposed, we set up a local blockchain testing environment using Ganache to simulate a blockchain network. Ganache is an Ethereum blockchain development and testing tool developed by the Truffle team. Ganache provides a user-friendly graphical interface that allows for quick deployment of a private blockchain network locally, without the need to connect to the actual Ethereum network. Ganache sets up a node on the device and creates multiple address accounts and test tokens for developers to use during testing. It enables rapid generation of a testing blockchain environment and offers features such as simulated accounts, transaction execution, blockchain state, and contract deployment, allowing developers to efficiently test on their devices. Figure 6 illustrates the testing environment created for this study.

Next, we used Remix IDE to write smart contracts and deploy them onto the local testing network provided by Ganache. Remix IDE is a web-based integrated development environment designed specifically for Ethereum smart contract developers. It offers convenient features for smart contract writing, compiling, and deployment. Remix IDE supports the Solidity language, which is a high-level language designed for smart contract development. Developers can write Solidity code directly in the editor of Remix IDE. Its intuitive interface and rich features enable developers to work more efficiently on contract development while improving the security and reliability of the contracts. Figure 7 illustrates the user interface of Remix IDE.

Once the smart contracts were deployed, we developed a frontend application that utilizes Web3.js to connect to the blockchain network provided by Ganache and interact with the deployed smart contracts. Web3.js is a JavaScript library for interacting with the Ethereum blockchain, providing a set of APIs for communication and interaction with smart contracts. Developers can interact with smart contracts by invoking contract functions. This allows developers to access and manipulate smart contracts from web applications, enabling various operations such as sending transactions, querying contract states, and triggering events.

Finally, we used MetaMask as a digital wallet to manage user authentication and transaction signing. MetaMask is a popular Ethereum wallet plugin that can be installed and used in web browsers, allowing users to interact with the Ethereum blockchain and sign and confirm transactions. MetaMask allows users to create multiple accounts, each with a unique address and private key, for sending and receiving cryptocurrencies. Users can use their MetaMask accounts to execute transactions, interact with smart contracts, manage assets, and engage with decentralized applications (DApps). Figure 8 illustrates a MetaMask wallet account.

Through these tools and technologies, we successfully set up an experimental environment for testing and validating the feasibility and functionality of the proposed CSSI framework.

4.2. Implementation Architecture

In the system implementation, we initially employed Node.js to create a straightforward web server capable of handling HTTP requests and sending back corresponding responses. Additionally, we deployed the contract to the Ganache blockchain and interacted with it through web3.js, as depicted in Figure 9.

Next, we established a web page serving the client-side (holder), issuer institution-side (issuer), and verifier, using Web3.js and the Ethereum blockchain. On the client-side, users could perform the wallet address on-chain and grant access permission for credit data through a web interface. Customers had the ability to grant specific financial institutions access to their property and credit data. On the financial institution-side, they could view customers’ property and credit data through a web interface. On the verifier-side, verifiers could store the verified personal property and credit data and VC on-chain. The following is our UI and web interface, as shown in Figure 10.

We have issued a Verifiable Credential (VC) for a customer’s traditional asset account based on the W3C specifications. It is a JSON-LD document that serves as proof of ownership of the customer’s traditional asset account. The VC includes metadata describing the type of the credential and referencing standards. The “credentialSubject” field specifies the content of the VC and the customer’s Decentralized Identifier (DID), while the “issuer” field declares the information of the financial institution and the issuer’s DID. The “proof” field provides evidence of the customer’s financial account. Figure 11 presents the VC we have issued.

Once the Verifier receives the VC, they will verify its validity. If the credential is valid, the Verifier will split the VC (as the data storage capacity of a single block is limited) and store the VC for the customer’s traditional financial account at the address of their digital account. Through this process, we ensure that only valid data are stored on the blockchain. As depicted in Figure 12, when the Verifier clicks “submit”, if the VC is successfully uploaded, it will display “VC upload success”.

After the verifier splits the VC, it is uploaded to the blockchain. During the process of uploading the VC, three blocks are generated, as depicted in Figure 13.

To upload the wallet address on-chain, the customer enters the address of their asset and credit data in the web interface and clicks on “CONNECT TO METAMASK”, as depicted in Figure 14.

Next, we will interact with the MetaMask wallet, and the customer can choose the desired wallet account. In the next step, the customer authorizes the web application to access the address, account balance, activity, and suggest transactions to approve, thus establishing the connection. Once the connection is established, the customer’s wallet address is imported into the web interface. Then, the customer clicks “Submit” to upload the wallet address data on-chain. This process is illustrated in Figure 15.

Customers have the ability to configure access permissions for their wallet address, property data, and credit data for various financial institutions. They can set the access permission to “True”, specify the allowed access duration, and provide the addresses of the intended recipients for the disclosed data. Figure 16 illustrates the process of setting access permissions for digital assets, asset information, and credit information.

Financial institutions access customer data based on the access permissions set by the customers. The financial institutions enter the addresses of customer asset and credit data and the desired information to be queried. Figure 17 illustrates the process of financial institutions accessing customer digital asset data. They enter the customer’s wallet address and click on “Search Digital Asset” to view the customer’s digital asset data.

Figure 18 illustrates the process of financial institutions accessing customer asset data. By clicking on “asset_info”, financial institutions can view the customer’s account balance and transaction data. Figure 19 displays the record of the customer’s digital assets such as NFTs and cryptocurrencies. Figure 20 presents the process of financial institutions accessing customer credit data. By clicking on “credit_info”, financial institutions can view the customer’s credit score and credit information.

If the customer rejects access to their personal asset data, an error message is displayed, as shown in Figure 21. Similarly, if the financial institution attempts to access personal asset data beyond the expiration period, an error message is displayed, as depicted in Figure 22.

5. System Analysis and Discussion

Legal compliance is an essential consideration. The CSSI framework will be designed to adhere to data privacy regulations such as GDPR (General Data Protection Regulation) and CCPA (California Consumer Privacy Act). Measures include user-controlled data permissions, detailed audit trails, and mechanisms for consent revocation, ensuring alignment with regulatory standards. Ease of use is critical for adoption among non-technical users. The development of an intuitive, user-friendly interface will be prioritized to simplify interaction with the blockchain system and ensure accessibility for a broad audience. This section will start by discussing and comparing with some similar frameworks proposed in previous studies, and finally will analyze the reliability and security of the CSSI framework proposed in this paper.

5.1. Related Research Comparison and Analysis

In 2015, Zyskind et al. proposed integrating a blockchain as an automated access-control manager, thereby eliminating the need for trust in a third party [15]. The paper introduces a blockchain-based system architecture aimed at empowering users to have better control over their data and protect their privacy, thus preventing unauthorized use or disclosure of data. However, this architecture stores data in a key-value format, where only pointers to the key-value pairs are stored on the blockchain. The users’ sensitive personal data are stored off-chain in the platform without blockchain maintenance, which poses a risk of data tampering. The paper proposes a framework that grants users control over their personal sensitive data. However, it lacks an expiration mechanism for access permissions. This means that if users do not revoke the access granted to organizations or institutions, they can continue to access the data indefinitely, potentially leading to data misuse and posing a risk to user privacy and security.

In 2019, Wang et al. proposed “Loan on Blockchain” (LoC), an innovative financial loan management system that utilizes smart contracts on the permissioned blockchain Hyperledger Fabric [16]. The article aims to automate loan transactions and establish a mechanism to protect customer privacy and prevent data attacks. It introduces a digital account model that enables traditional financial institutions to engage in asset transfers within the model. The paper introduces the LoC framework, which solely focuses on traditional financial institution assets and overlooks digital assets such as cryptocurrencies or NFTs. This limitation hinders a thorough evaluation of an individual’s complete assets for loan assessment and decision-making, potentially resulting in inaccurate loan decisions. Furthermore, the model outlined in this paper fails to address access control, enabling financial institutions to access customer data unrestrictedly. Consequently, customers lack control over their data and remain uninformed about the utilization of their personal sensitive information.

In 2021, Cho et al. introduced a model focusing on the generation and revocation verification of Verifiable Credentials (VCs). The model also enhances the processing of credit evaluation data as VCs by incorporating opt-in consent and the right to erasure [17]. The article presents a credit scoring framework based on Self-Sovereign Identity (SSI), addressing the issues of opacity, centralized control, and security in existing credit scoring systems through the use of Hyperledger Indy blockchain technology. The model utilizes VCs, which include encrypted digests and digital signatures of data, ensuring data integrity and authenticity. The paper proposes a model that utilizes the Hyperledger Indy blockchain. However, it is important to note that the technology of the Hyperledger Indy blockchain is still under development, and there may be limited development and support resources available. This can potentially lead to compatibility issues and integration difficulties among different systems of financial institutions. Additionally, the model presented in the paper adopts an opt-in access control approach to restrict data access, but it does not impose limitations on access expiration. Once the customer grants access, subsequent access to data does not require customer consent, thereby restricting the user’s control over how the data are used.

We conducted a comparative analysis between the model architectures of financial loan-related research and our CSSI framework. The analysis results are presented in

Table 1. Comparison and analysis of CSSI framework with related research.

	Zyskind et al. [15]	Wang et al. [16]	Cho et al. [17]	CSSI Framework
Technology	Ethereum blockchain	Hyperledger Fabric blockchain	Hyperledger Indy blockchain	Ethereum blockchain
On-chain data storage	A pointer (pointing to off-chain personal data)	Traditional bank account info.	Credit info., VC, and public key	DID-traditional and digital asset data
Access control	Yes	No	Yes	Yes
The level of data control	Medium	Low	Medium	High
Development cost	Low	Medium	High	Low
Transparency	High	Medium	Medium	High

Note: ‘Low’ refers to minimal control where data handling is largely determined by institutions, ‘Medium’ indicates partial user control over specific data permissions, and ‘High’ represents full user control with detailed access management.

.

5.2. Data Reliability and Security Analysis

• Blockchain Technology
  In today’s organizations, including financial institutions and credit agencies, many operations rely on centralized systems. Each organization maintains its own system independently to ensure security and reliability. However, these centralized systems are vulnerable to attacks such as DDoS, and a single node failure can cause system paralysis or data loss. By leveraging Ethereum blockchain technology, personal data can be stored in a decentralized manner, ensuring that data are not lost and can be permanently stored on the blockchain. Once personal data are stored on the blockchain, it becomes immutable and tamper-proof, providing a secure framework for data reliability and verifiability. This enables organizations and individuals to trust the data stored and exchanged on the blockchain.
• Customer Personal Data De-identification
  We store customers’ personal sensitive data on a public blockchain and process the sensitive personal identity information through de-identification techniques to ensure individual privacy and security. The de-identification process eliminates the possibility of being associated with specific customers, such as ID numbers or financial account numbers. Identifiable data are eliminated or replaced, ensuring that the data stored on the blockchain is no longer linked to specific customers. This allows for the use and sharing of personal data on the blockchain while maintaining the confidentiality and compliance of customer personal sensitive data.
• Setting Access Expiration and Content
  The CSSI framework proposed in this paper empowers customers with control over access to their personal sensitive data. To enhance privacy protection, the concept of access expiration is introduced, enabling customers to actively manage the access duration of their personal sensitive data and determine the timeliness of data disclosure. Once the access expiration period is reached, the corresponding data becomes inaccessible and unusable. This prevents organizations from misusing customer data for other purposes. By actively involving and supervising the data usage and storage process, customers can effectively protect their personal privacy.
• Validating the Authenticity of On-Chain Data
  Before customers upload their personal sensitive data on-chain, they need to apply for Verifiable Credentials (VCs) from the asset credential issuing institutions to prove the validity of their personal financial and credit information. The data can only be stored on the blockchain after undergoing verification by validating nodes to ensure the validity of the VC. Through a rigorous verification process, the on-chain data can be ensured to have a verifiable source and trusted value, ensuring the validity of customer assets.
• Reducing Information Asymmetry
  The utilization of public blockchain technology enhances data transparency. Financial institutions can view customers’ personal data as long as access is granted. This allows access to data from various financial institutions, credit agencies, and digital assets. The CSSI framework facilitates data sharing among different entities, addressing power imbalances and information asymmetry. It prevents financial institutions from making loan decisions without a comprehensive evaluation of customers’ personal assets. This is particularly significant for organizations and financial institutions reliant on personal data.

6. Conclusions and Future Works

In this paper, we present a Customer Self-Sovereign Identity and access-control (CSSI) framework that leverages blockchain technology and Self-Sovereign Identity (SSI) principles. This framework empowers customers to store and manage their personal asset and credit information securely on the blockchain while retaining control over their data. Unlike traditional systems, our framework incorporates not only traditional financial accounts but also digital assets like Cryptocurrencies and NFTs in the assessment of customer assets, enabling a more comprehensive evaluation by financial institutions.

Moreover, with customer consent, financial institutions can access and utilize customer financial and credit data, fostering information sharing among organizations and institutions to reduce risks and enhance financial market stability. The CSSI framework streamlines the loan process by eliminating the need for repeated submission of personal information, thereby improving efficiency and customer experience.

Compared to existing research, our framework introduces a more robust access control mechanism. Customers can set access periods for their data, and once expired, financial institutions cannot access the data without manual intervention from the customer. This effectively prevents unauthorized use of customer data by financial institutions. In summary, the CSSI framework offers a novel solution for creating a secure, trustworthy, and efficient financial services environment.

Currently, personal identity management predominantly relies on centralized institutions, with centralized system architectures prevailing across various applications. However, decentralized technologies and Self-Sovereign Identity (SSI) are emerging as alternatives, albeit with limited adoption in specific sectors such as finance, communications, supply chain, and healthcare. SSI offers individuals greater control over their personal data, facilitating better management and sharing.

There is a global push towards developing decentralized applications based on SSI, with various countries and organizations actively engaged in their development. However, integrating these applications with existing systems or underlying blockchains presents significant challenges. Seamless integration across different systems and chains is crucial to ensure users can access services effortlessly across various platforms.

Moving forward, addressing issues related to cross-chain and cross-system integration will be imperative. This will enable users to leverage decentralized applications and SSI solutions seamlessly, fostering widespread adoption and facilitating the efficient management and sharing of personal data across diverse platforms and sectors.