KuppingerCole's Advisory stands out due to our regular communication with vendors and key clients, providing us with in-depth insight into the issues and knowledge required to address real-world challenges.
Unlock the power of industry-leading insights and expertise. Gain access to our extensive knowledge base, vibrant community, and tailored analyst sessions—all designed to keep you at the forefront of identity security.
Get instant access to our complete research library.
Access essential knowledge at your fingertips with KuppingerCole's extensive resources. From in-depth reports to concise one-pagers, leverage our complete security library to inform strategy and drive innovation.
Get instant access to our complete research library.
Gain access to comprehensive resources, personalized analyst consultations, and exclusive events – all designed to enhance your decision-making capabilities and industry connections.
Get instant access to our complete research library.
Gain a true partner to drive transformative initiatives. Access comprehensive resources, tailored expert guidance, and networking opportunities.
Get instant access to our complete research library.
Optimize your decision-making process with the most comprehensive and up-to-date market data available.
Compare solution offerings and follow predefined best practices or adapt them to the individual requirements of your company.
Configure your individual requirements to discover the ideal solution for your business.
Meet our team of analysts and advisors who are highly skilled and experienced professionals dedicated to helping you make informed decisions and achieve your goals.
Meet our business team committed to helping you achieve success. We understand that running a business can be challenging, but with the right team in your corner, anything is possible.
Only a few years ago the identity ecosystem seemed to be ‘set’ with little chance for change or dislocation of the large federated identity providers. Today the entire identity technology ecosystem is in flux. What will emerge? OIDC? OIDC/SIOP? DIDComm? Join us for a discussion on the changing protocol landscape, the shifting identity power centers and why it is a both/and and not either/or.
Only a few years ago the identity ecosystem seemed to be ‘set’ with little chance for change or dislocation of the large federated identity providers. Today the entire identity technology ecosystem is in flux. What will emerge? OIDC? OIDC/SIOP? DIDComm? Join us for a discussion on the changing protocol landscape, the shifting identity power centers and why it is a both/and and not either/or.
So we're talking about transitions from platforms to protocols. As, as Don has said, I think we're all very much familiar with the platform world. It's very much the existence that we live in in today. So one of the things that wanted to, to bring forward is it's all about transaction costs for, for those that know Sam Smith, it's a little bit of a channel challenging channeling of Sam. He talks a lot about this, but really in the adoption of platforms. And if you look at the evolution of business over time, it is really all around managing and reducing these transaction costs.
In 2019, I had the experience or the joy of, of working together with Sam and Carson stalker at rebooting on this paper of decentralized identity as a meta platform. And, you know, in that conversation, we were really looking at identity being the connective tissue, and we use the term meta platform at that point, not really extending it really into a protocol, but really as a connective tissue, you are talking about a protocol and that by shifting control of the iden, the identity information or information around the entity, you start to have the ability to cooperate between platforms.
A platform could be the ones we typically call as a platform today, or it could even be, or, you know, smaller, smaller scale platforms. And so that the economic benefit of cooperating starts to bring you almost up to the platform level while not having to have a acquisition. So this is the, was the paper that we put together. And it is interesting that recently this send deep caudry who is probably well known for the platform book called platform revolution, talking about why platforms have become so dominant in this. He talks about sort of the three evolutions of industry or business.
If you go back to the beginning of the 20th century, it was the pipeline, it was the mass mass production. It was the optimizing cost by reducing choice, standardizing on product, the famous Henry Ford statement. You have any color under the sun, as long as it's black, right? That sort of thing of mass scale production was really transformational in lowering the transaction cost of building, building product, building services.
For, for, for the market, the platform then dealt with three additional costs. What's called triangulation costs. The buyer matching the buyer and the seller, making it easier to find for buyers to, to, for sellers, to find buyers and for buyers to find the goods and services that they're looking, the transfer cost, how much it costs to, to optimize the actual cost of, of executing the transaction and the trust by having a trusted platform, you then start to bring this all together and people execute.
I think what we've seen over the last, I think it, you know, was talking with John wonder lick earlier this morning, if you go back to 2010, early 2000, you know, the lack of trust potentially around Amazon as a, as a sample platform was probably even thinking myself personally, I trusted Amazon. I said, okay, I needed to buy something. I go to Amazon. The last 12 years, behaviors have changed significantly in Amazon, and now the transaction, the trust cost there has become significantly higher. And now speaking personally, Amazon's my last protocol, right?
If I was a business, you know, now Amazon's behaviors around, you know, either mining the data, if you're a seller mining your sales data to, to launch competitive products or the sequence that products are placed on the top of the list is based on Amazon's profit maximization versus necessarily the product. All of these things start to increase the cost on the trust side. And so that's where you're starting to see people start to change. The protocol now is where we're looking at.
And this is where, you know, there's been a lot of discussion in this community, broader community about web three, things of that nature. We see here, you know, interoperable identity, when that information starts to move freely, it comes out of the platform. It's again, reducing the cost, the trust it's improving the reducing the trust cost and improving the operational, the, the information cost for flowing between the, the parties. So that's where we think protocols are coming.
We're still early days, but I think this is definitely where we're going, IOP identity, you know, allows them the actors to verify. Right. And this is the key part, I think, for what we're talking about in this context here, Marcus. Yeah. Thanks.
So, hi, Marcus ALO from, and Michael was just talking about the, you know, business aspects, economical drivers. I was talking about dominance of platforms and maybe I move towards protocols.
I, I want to just, I don't have a lot of sophisticated slides. I just want to add some more technical thoughts or technical aspects to that question platforms or, or protocols.
We, we know that right now, a lot of people are working on self-sovereign identity, decentralized identity. And why is that emerging as a movement?
Well, in a way it's a counter movement to platforms like, you know, Facebook Google a few years ago, the idea was we need to decentralized.
We need to build decentralized identity protocols and one, and as we've been working on some new technologies, new standards, new protocols, like DDS, Verifi, credentials, I've, I've seen some interesting questions with regard to, to what extent does the, does the technology that we designed technical specification, to what extent to do they influence whether we end up with platforms more, more centralized, maybe large companies, or to what extent do we move towards decentralization? Right.
So, and, and I had a conversation with Naski Moore last night, a little bit about that. So some of this will be, is based on, on his input also, but that's what I've been asking myself in the last few years, as we've been working on new technologies, is there a link between the, the technical details that we have in, in certain technologies and, and the movement either towards more centralized platforms or more decentralized protocols. And I'm just bringing two examples.
So I've, I have two week samples here, technical examples. One question that we've been, that we've seen in a number of working groups in a number of communities, should we use Jason as a data format, or should we use Jason LD as a data format? We've seen this, for example, in the w three C D working group, as we've been designing decentralized identifiers and the de document format, which describes a subject.
So very technical discussion, but basically half of the working group was in favor of using Jason as a data format to describe the de document, to describe metadata about a subject and half of the working group was in favor of using Jason and LD as a data format for describing a subject. And what's the difference? What's the main difference between Jason and, and Jason LD?
I would, I would say, well, Jason is, is more, is simpler probably. And Jason and LD is a little bit more complex, but technically the difference is in the semantics, right? So in Jason LD, which is based on, on RDF and semantic web technology, the idea is that you have an open world model, right open world semantics. Anyone can define schema. Anyone can define what in Jason is called a context. And whereas in Jason, you basically need a, a registry. You need some kind of agreement on what the semantics mean.
If in your document you have, for example, a field called full name or name, then who defines what that means right in Jason, this is more centralized there's. There has to be some kind of registry or some kind of agreement, what the meanings are versus in Jason LD, you have more decentralized approach.
So maybe you could argue that one technology leads or is, is more in favor of centralized platform approaches like Jason, where you can define the meaning in one place, the semantics, whereas maybe the other technology is more in favor of a more decentralized protocol based approach where anyone can define new semantics and you can add context and schema. However you want, based on an open world model, it's a question it's a, it's a theory. On the other hand, even if you look into the chase and ad community, you also see elements of platforms and centralization.
If you look@schema.org, for example, which is a pretty centralized platform where semantics are being defined. So this is one, one example. And the other one, maybe even even more interesting or provocative, I don't know, there's also a lot of discussion now, as we build self-sovereign identity, as we build new technologies, we have a lot of wallets. And what protocol should we use for exchanging very fiber credentials, right? So that's a discussion that's happening in, in many communities.
How can we move a very fiber credential from an issue to a holder and then from a holder to a there also many technical choices, and maybe two of the technical choices are open ad connect and did come. And again, there's a lot of discussion in certain groups in certain communities, which one is better. What are the, what are the differences? There was recently a very long thread in, in the W3C credentials community group, where some of these things are being developed where basically half of the communities said that open idea is, is problematic because it leads to centralization.
It, it leads to, to platforms, which is, has to do a little bit with the historical experience, right? With what happened originally with the first versions of open ID, which was designed as a decentralized or, or user-centric empowering protocol, and then led to Facebook connect as, as a centralized platform. So a lot of people said open a Deconnect or what's happening now will again, lead to centralization. Whereas DICOM is the more peer to peer decentralized protocol.
And, and again, it's a, it's a question I would, I would say that, that if you, you look at these two protocols, there, there are certainly some differences. If you, in open ID connect, I would argue there's a certain asymmetry in the, in the, in the technology.
If you, if you use open ID connect to log in somewhere to log in to a website or to exchange credentials, then the way how one party is being modeled. And the other party is being modeled is, is not the same, right? There's not this, this egalitarian symmetrical relationship that there there's always the client, there's the resource server. And one part of one side of the protocol, the client is identified with a client ID and the client's secret. And the other side is, is identified with an, with an ID token when, when you log in.
So there are a little bit of asymmetrical constructs I would argue, whereas in, in DICOM, proponents of DICOM would say, that would say that in DICOM, everything is, is equal. Everything is peer to peer. You always have peer deeds and agents that talk to each other, and there is no client and server or there's no, you know, no, no asymmetry in the, in the protocol. But then again, on the other hand, in both cases, you can, you can deploy both protocols in both in a centralized way and in a decentralized way, right at this conference, we've seen all the fantastic work on open ID connect.
SYOP self issued open ID provider. So you can definitely use open ID connect for very decentralized protocol based deployments and, and ecosystems. And at the same time did come if you use that for wallets and, and agent that could, that in turn could also become very centralized, right?
We may, we might end up perhaps with one large tech company that will, that will host all our did come wallets and did come agents in, in just like maybe just like SMTP. And this was, is a thought I got from net last night, right? SMTP was also designed as a very decentralized protocol where everyone can host their own mail server, but we ended up with, with Gmail. And if you large providers, so that's basically Marcus. And you're anticipating a question here from the, we have many people online, several hundred people online. Yeah.
One of them is ask what prevents one to use one, to use open ID connect over DICOM, open ID connect, defines credentials exchange, and DICOM is a messaging protocol. I it's maybe more a question for the open idea working group.
I'm, I'm not that close to it. I it's, it's probably possible, but I, I can't tell you what Fair enough.
Again, here's a call out to our friends online and those of us that are here in Berlin, we've got just a few minutes left. So we wanna make sure that, sorry, Alexei, I think follow Mark's point and more say, why would you like flip it around? Like the whole point is they're kind of achieving slightly different things to your point around, like who's focusing on, I don't see why you would combine them, but that's perfectly just me. Perhaps Mr. Zamora has a comment to make in this regard now let's because we've got so many folks online. Let's do this. Okay. So it's like O IDC is built.
I HTTP kind when I was designing it, I was trying to make a clear line between the transport and the credential flows and selective disclosure and things like that. This should in principle be possible to build or ADC over Datacom or, or ADC of any other protocol.
I was, it was always my project to write or IDC of avian carrier. That should be possible. Right. So that's my take Great last call on questions and a last opportunity for a wrap up from Michael and Marcus. How about a call to action? Yeah. So I'm not sure if we have a concrete, a conclusion here, it's more of more, more of questions, right. But it's call to action.
Or maybe one, one conclusion is to try to be a little bit aware of, of some of the, the details of the protocols, the, the choices that, that we make when we write standards and create data, data models, and what implications that might have in how they get deployed and, and use that and use later, right? Like, is technology really neutral or do the technologies that, that we built, do they have built in, in values? And do they lead them to, to certain social ways of how they're being used and deployed? Right. Michael last, Yeah, I guess the, it would be We're in a period of transition.
I think it's not that the platforms are gonna go away. It's not that, you know, if you, if you look at from a, a broad times spectrum, it's a, it's a, it's going to be a both end or it's not even that there's two options. There's all the different things are going to continue to exist.
And so it's starting to look at, take it from the economic standpoint, where, how are you optimizing these costs that are around it, whether it's a trust cost, whether it's the ability to, you know, regulatory costs that I think from a business standpoint drives will start to drive how people are moving towards the protocols. But I think the, the we're, we're still in an early phase, but it's, I believe that the C is definitely changing Well said and well done. How about a quick round of applause for our presenters.
