Trust over IP Layers as a development model

[cjbuchanan]

The Trust over IP Stack

Just wanted to start a discussion on the Trust over IP Stack. The stack outlines the required components for the trust ecosystem in the context of decentralized identity technologies like DID and VCs and represents a comprehensive view informed by those who have developed the underlying standards and technologies as well as companies that have been developing solutions in this space from its inception.

Here is the stack:

As you can see each layer of the stack has both technical and governance components. In my short exposure to VCI, it appears we are primarily focused on Layer 3, and reducing governance requirements is a design goal/necessity. However, you cannot wish away governance. You can encode it or externalize it, but those choices should be made and justified by the project so that implementers are aware of those choices and a coherent implementation remains possible across multiple providers.

I would propose an ecosystem subgroup to help quickly identify and document the relevant questions at each layer for both technical and governance so that we can incorporate that into the project design documents and ensure a coherent effort across all partners.

The Trust over IP Foundation

The Trust over IP Foundation is part of the Linux Foundation and was created to address the need for some sense of orthodoxy in integrating all of the disparate technologies supporting efforts like VCI. Trust over IP is tech agnostic and neither prescribes a specific solution nor seeks to compete with standards or providers, but instead informs and advises solution developers (like VCI) in wading through all the design options. MITRE is a steering committee member for Trust over IP and I am MITRE's representative to the foundation. Feel free to reach out.

Here is some additional information on the Trust over IP Foundation and its purpose:

• Introductory Whitepaper

[jmandel]

Capturing notes from phone call:

• We agreed to add a page to the spec providing a "Trust Over IP Mapping" -- much the way that FHIR provides RIM and v2 mappings for its resources. The idea is if you're familiar with ToIP and speak that language, you can read the mapping as a primer to understand how SMART Health Cards fits into this world view
• We recognized there's a slight risk that the mappings may get out of sync with reality, so we need to make sure folks who deeply understand both sides of the mapping can review for accuracy.

[cjbuchanan]

Decided.. mapping under issue #59.