The e-Government is based on the use of ICT and represents a strategic goal in government agendas. Recently, a lot of attention has been directed towards blockchain technology. It has characteristics that could have a strong impact in several sectors, including the public one. The Self-Sovereign Identity, for its part, is a technology that could solve some critical issues highlighted with the use of current digital identity systems. ICYRIME 2022: International Conference of Yearly Reports on Informatics, Mathematics, and Engineering. Catania, August 26-29, 2022 The Digital Agenda for Europe has been implemented by © 2022 Copyright for this paper by its authors. Use permitted under Creative Commons License each Member State, each of which has adopted its own CPWrEooUrckReshdoinpgs IhStpN:/c1e6u1r3-w-0s.o7r3g ACttEribUutRion W4.0oInrtekrnsahtioonpal (PCCroBYce4.0e).dings (CEUR-WS.org)
businesses, based on methods that are profoundly
diferent from traditional ones. Today the user and his needs
The emergence of new needs has often led to changes in are placed at the center of administrative proceedings.
social values, sometimes accompanied by technological The PA has to manage the dematerialization processes,
advances that have marked history in a more or less im- innovating the back ofice processes that prepare the
onportant way, depending on the political, economic, social line delivery of the final service [
pean Union has adopted in order to promote innovation, progress and economic growth, exploiting the potential 2. e-Government of ICT, with the main aim of developing the digital single The e-Government can be identified as the introduction market [12]. Since the 1990s, ICT has played a decisive and use of ICT in administrative processes, with the role in increasing productivity and growth in the EU. aim of providing services that more eficiently meet the The digital unique market has been launched over the new needs, which over time change at the same pace past decade, with the aim of presenting the main legas the evolution of society, in terms of organization and islative proposals, for example on the development of lifestyles. However, it should be noted that it not only e-commerce, copyright, private life and electronic comcoincides with the computerization and general digitiza- munications, harmonization of digital rights and cybertion of the PA, but is also a useful tool to ofer a valuable security [12]. Among other things, it involved the decontribution to the improvement of the final services velopment of digital identities, investments in artificial provided to users. The innovative processes introduced, intelligence, cybersecurity, 5G networks, quantum comrelated to the e-Government, have necessarily changed puting and blockchain [13]. the type of interaction between the PA and citizens and
strategy. Italy has developed its Digital Agenda, that is able to access the services ofered by Member States of a national digitization strategy, aimed at achieving the the European Union [21]. targets set out in the European Agenda, identifying priorities and methods of intervention suited to the needs 3.1. SPID of the Italian context [15]. The Digital Agenda for Italy is defined through the Italian Strategy for Digital Growth The SPID identity is issued by private entities accredited 2014-2020. The document sets out the guidelines for digi- by AgID, called Identity Providers, which in compliance tal growth, both in infrastructural terms and through the with the rules issued by AgID, provide digital identities provision of enabling platforms: the National Registry of and manage users authentication. The choice of the identhe Resident Population (ANPR), which is a centralized tity provider, by citizens and businesses, is free. After database that takes over from the municipal registers and verifying the data, it issues the digital identity, releasing the Registry of Italians Resident Abroad (AIRE); a manda- the credentials [22]. There are three SPID security levels: tory electronic invoicing system to the PA; PagoPA, that the first level allows access to online services through a is a system that gives citizens and businesses the oppor- username and password chosen by the user; the second tunity to make payments electronically, to the PAs and level allows access through a username and password public utility service providers; Open Data, adopting na- chosen by the user, adding the generation of a one time tional guidelines that define models, methodologies and password, sent to the user via text message or through timing common to the PAs; digitization in the sectors of the use of an app given by the provider; the third level health, education, justice, tourism, agriculture [16]. From requires a particular hardware that manages the crypan infrastructural point of view, it contemplates: the Pub- tographic keys, such as a smart card or a remote digital lic Connectivity System, which defines the ways in which signature device, in addition to the username and passthe information systems of the PAs must cooperate with word [23]. each other; Digital Security for the PA, with the aim of increasing the level of security of digital information and 4. Regulations for electronic communications, protecting the privacy, integrity and continuity of PA services; a rationalization of ICT assets, identification with consolidation of data centers and cloud computing; SPID, which guarantees citizens and businesses safe and 4.1. eIDAS secure access to the digital services of the PA and of the private entities that join to them [16]. The Agency for Digital Italy (AgID) plays a fundamental role in this scenario: established in June 2012, it is responsible for achieving these objectives [16].
Authentication and Signature (eIDAS) - was defined to provide Member States with a common regulatory basis for the management of trust services and electronic identification means, increasing security and efectiveness of electronic services and transactions of e-business 3. Digital Identity and electronic commerce in the European Union. It has been in force since 2016 [24]. Among other things, it Digital identity is the set of digital resources uniquely establishes a legal framework for electronic signatures, associated with a citizen who identifies him, representing electronic seals, electronic time stamps, electronic dochis will, during his digital activities. Digital identity is uments, electronic certified delivery services and serusually presented to access a computer system or infor- vices relating to website authentication certificates; it mation system or to sign digital documents. The Public defines the conditions under which Member States recAdministration uses digital identity to provide access to ognize electronic identification system of citizens and online services through a single credential, which is acti- businesses, who fall under a notified electronic identifivated only once and is always valid [21]. Access to online cation system of another Member State [25]. Unlike elecpublic services is therefore only possible with the Public tronic identification systems, according to eIDAS, each Digital Identity System (SPID) and the Electronic Identity Member State can notify the electronic identification sysCard (CIE). All PAs must have integrated SPID and CIE tems provided to citizens and businesses to enable mutual into their information systems, as the only digital iden- recognition [24]. In Italy, the national eIDAS Node allows tity systems for accessing digital services, leaving the old Italian citizens to access the online services of other EU credentials. Thanks to SPID and CIE, access to public ser- countries - such as public, university, banking services vices becomes uniform throughout the national territory, using SPID or CIE. Moreover, citizens of other European with the advantage of having greater security of personal countries in possession of digital identities are recogdata, no longer having to manage diferent credentials nized in the eIDAS framework, to access the services of depending on the service they want to use and also being the Italian PA [26]. 4.2. Self-Sovereign Identity those rights of free movement and freedom of establishment which can only be achieved by guaranteeing an The Self-Sovereign Identity (SSI) is a digital identity di- eficient dialogue with all the PAs of the Member States. rectly controlled by the user, who has the possibility to In April 2020 the European Commission published the choose which data to allow sharing, among those avail- SSI eIDAS Legal Report, with which it mainly suggests able, when accessing a particular service [27]. In the first the creation of an eIDAS Bridge, exploiting the European historical period of Internet activity, the main problem Blockchain Systems Infrastucture (EBSI) which already, was to create a network of networks. The TCP/IP pro- autonomously, includes among its goals that of creating tocol fulfills this purpose, but is limited to identifying in Europe an SSI model) and to proceed gradually accordthe address of the computer connected to the network, ing to a schedule that includes a series of steps. In the without providing information relating to the citizen or short term, the use of eIDAS digital identities (such as business who is using it. To solve this problem, a model SPID) is planned for the purpose of issuing VCs. In the based on the concept of an account has been introduced. medium term, the issuance of qualified certificates, the isThe accounts are registered by the entity who provides suing of technical specifications for VCs, the adoption of the online services. However, this causes several prob- new specifications based on the European Self-Sovereign lems, linked to the multiplication of identities and the Identity Framework (ESSIF), on the EBSI platform, for existence of that account only on the servers of that par- identification are planned. In the long term, the need is ticular entity, the total absence of control over the data identified to regulate Identity hubs as trust services, to by the person who owns the account, and greater ex- regulate the services that ofer wallets for the manageposure to possible thefts of identity. The next model, ment of cryptographic keys as independent trust services, developed to address these issues, is that of federated to regulate some specific nodes of the registers distributed identity. In this case, the existence of a third party, the as trust services. The goal, in the long term, is therefore Identity Provider (IdP), is expected between the service the complete integration of the services related to the provider and the person who would use it. The latter SSIs within the framework of the trust services currently therefore has an identity registered by the IdP and can governed by eIDAS [27]. The Italian strategy, prepared access services provided by third parties, without having by the Ministry of Economic Development, in the field of to re-register at their sites, but by accessing through that blockchain, highlights the advantages of the SSI model identity. SPID is an example of this model. SSI represents also, with a series of proposals that have, among otha third model, decentralized and made possible thanks to ers, the goal to providing Italy with a regulatory framedistributed ledger technologies, such as the blockchain. work that is competitive with those of other countries; The feature that distinguishes this model from the others increase public and private investments in Blockchain is that it operates in the same ways as a real identity. technologies and promote information and awareness In fact, it is based on a direct relationship between the among citizens; improve eficiency and efectiveness in owner of the SSI and the entity who needs to verify an at- interacting with the PA through the adoption of the Oncetribute [27]. The SSI ecosystem has three main roles. The Only principle and decentralization; promote European issuer is the person responsible for creating and issuing and international cooperation, with the adoption of the the credentials for the holder. The holder is the owner: common European infrastructure by EBSI [31]. he receives the credentials from the issuer, owns them and, when requested, shares them with a verifier. He has full control over the use of his SSI and decides which data 4.2.2. European SSI Framework to share from time to time, among those contained in his identity. Furthermore, he must be in a position to carry out all operations relating to his identity, or to assign control of certain functions to third parties on his behalf.
Finally, the verifier is a person responsible for verifying the credentials presented by a holder [28].
is an initiative designed to make interoperable the various SBS initiatives developed at national level in each EU Member State [31]. The eSSIF-Lab project, funded by the EU, aims to strengthen the reliability of the Internet with digital identities, through the development and adoption of SSI technologies. The ultimate goal is to promote the widespread adoption of SSI as a next generation, open and reliable digital identity solution for faster and more secure electronic transactions via the Internet and in real life [32][33]. 4.2.1. SSI in Europe and Italy The current federated model used in the EU took shape as a result of the eIDAS Regulation [27]. For several years now, the EU has considered the issue of creating a digital identity management system to be central, for the creation of a digital single market and for the concrete possibility of guaranteeing all citizens of the Member States
two existing blocks. So each additional block reinforces the verification of the previous block. This eliminates The blockchain is a shared and immutable ledger, the the possibility of tampering and creates a transaction log entries of which are grouped into concatenated blocks in that all members of the network can trust. The block chronological order. It facilitates the transactions regis- is verified and approved by the blockchain network. Fitration process and the traceability of data on a network, nally, the block is added to the chain. From this moment ensuring its integrity thanks to the use of cryptography. the transaction is complete and is present and accessible Only authorized network members can access the ledger. in the archives of each participant, therefore on all the A blockchain network can, among other things, track nodes of the blockchain. The blockchain is structured in orders, payments, accounts, production and much more. such a way as to automatically update itself on each of the Since the data is seen uniquely by the various members, clients participating in the network. All the operations they can access all the details of an end-to-end trans- carried out must be automatically confirmed by all the action, thus generating greater reliability, security and individual nodes, using cryptographic software, which eficiency [34]. verifies a packet of data defined as a private key, used to sign the transactions. In this way, the digital identity of those who authorized them is guaranteed [34][35].
A blockchain network is made up of nodes, transactions, blocks, ledger and Hash. Nodes are the members of 5.3. Blockchain at the service of SSI the blockchain and are physically represent each par- There are some implementations of SSI based on ticipant’s servers. Transactions consist of data that rep- blockchain, in which the data is not stored, but only resent the values being exchanged and that need to be the keys of the cryptographic algorithms that allow the verified, approved and then archived. Blocks represent a exchange of data in a secure and unassailable way. This set of transactions, grouped to be verified, approved and logic not only makes the system fully compliant with regthen stored by the participants in the blockchain. The ulations, but also avoids exposing oneself to the risk that ledger is the register in which all the transactions carried such information, despite being encrypted with the most out are recorded in an immutable way, with maximum sophisticated algorithms, can be decrypted and theretransparency and in chronological order. It consists of fore stolen. More sophisticated implementations of SSI, the set of blocks that are linked together by means of a therefore, negate this risk as well [36]. cryptographic function and thanks to the use of hashes.
The Hash is a non-invertible operation, which allows you to transform a text string into another of arbitrary 6. SSI and Blockchain to access length (regardless of the length of the original string). services of a Public The Hash uniquely and securely identifies each block, without allowing to trace the text from which it was Administration generated [35].
and it is plagued by excessive bureaucracy. It is often 5.2. Functioning of a blockchain a fragmented reality, whose organizational structures The blockchain works like this: the cryptographic keys are disconnected and do not share data with each other. of the sender and those of the receiver are created in These characteristics collide with the needs for eficiency preparation of the transaction. The transaction is created, and efectiveness required by a society in constant evolucontaining information about the sender, the receiver and tion and in which technology has accelerated the pace. the cryptographic key. In addition to these, the informa- Due to its characteristics, the blockchain technology can tion you want and even conditions can be reported. The be one of the best solutions to be able to overcome the transaction starts with the digital signature and public ineficiencies in current systems and increase the efeckey of each participant. The transaction becomes part of tiveness of the service to citizens. In fact, in addition to a block, which can also include other transactions. Each guaranteeing high data protection, it introduces elements block has a Hash, which records all information relating to increase the levels of transparency and traceability of to the block itself. A Hash with the information of the transactions, such as to determine a substantial decrease previous block will allow to create the chain and link one in fraud and corruption. Consequently, citizens would block to the previous, forming a chain. The blocks certify have an incentive to place more trust in institutions. With the time - via timestamps - and the sequence of transac- the blockchain both parties - citizens and businesses and tions and connect to each other in a secure way, in order PA - derive benefits: on the one hand, citizens and busito avoid that one of them is altered or inserted between nesses have a certified identity to be able to relate to the PA; on the other hand, the PA must no longer possess citizens’ data in centralized structures, more vulnerable to cyber attacks. The added value of this transformation is realized by constituting a new model for the management of one’s data: in traditional systems, personal data are managed centrally by a plurality of institutional subjects, which often do not integrate with each other. Citizens do not interact with a single government counter, but are forced to provide their data to each PA they contact.
Sometimes the set of SPID data to be shared is designed for access to a variety of services. This means that in some cases the user must share data that are actually superfluous, in relation to the single service he would like to access. The SSI, seen as an evolution of SPID, solves this problem, as it allows the user to share only the data that is necessarily needed for access to a particular service, and to select any other data that it deems appropriate to share. In this context, the blockchain guarantees the security of the tracing of requests, by the various PA platforms, for access to user identity data.
For this work, a system that allows access to a PA platform, via Self-Sovereign Identity (simulated) was implemented. A blockchain is used to store the accesses. The Figure 2: initialization of a block platform asks the citizen which data to share, by their identity. Then it makes a request to the identity manager, which verifies that the requesting platform is actually a The block is completed with the Hash generated on the blockchain node, provides the requested data and stores concatenation of the other information contained therein, the transaction in the blockchain itself. The identity man- before being added to the chain. It is also possible to ager uses several databases to manage various data. A consult the history of accesses made to the manager by blockchain ledger is used to store blocks of transactions. a platform, to the various platforms by a citizen and in detail by a citizen to a specific platform. These functions 7.1. Implementation are necessary to fulfill the typical needs of the PA, related to any requests for access to documents, as well as to the Audit, the aim of which is to objectively verify that the management of the service complies with the provisions of the law.
For the implementation, the Python language was chosen, object-oriented, based on high-level data structures, and suitable for developing distributed applications, among other things.
Each block can contain from one to N transactions.
Each transaction represents the access of a platform to the data of an identity.
A series of information is recorded for each block, including the Hash of the previous block and that of the block itself (necessary to ensure the consistency of the entire chain), the timestamp, the Merkle Root (which is a recursive concatenation of the Hashes of the transactions), the number of transactions contained in the block and the list of transaction identifiers.
All the other data related to transactions are stored in a dedicated database. In it, the fiscal code of the identity is not stored in clear text, but a Hash is applied to the combination of it with other data.
tions was made. The regulatory and technical aspects of SSI and Blockchain have been described. And through a case study, it was illustrated how their combination, applied to the context of the PA, allows for optimal privacy management. In fact, on the one hand, the blockchain guarantees the transparency and immutability of the data. On the other hand, the user can choose which data to share with the platform to which he accesses. The system could evolve by allowing access to private platforms as well. A smart-contract, that is a program stored on the blockchain, and executed under certain conditions, in