1. Credential Transparency
Stanford University
Joyce Li
Stephen Arod Shirreffs

2. Digital Enables a student to stack their achievements
Enables integration
Breaks things down like Lego blocks
Degrees and certificates
Transcripts and their elements
Cocurricular records
Specific artifacts
Meta data
Stephen – enables a student to stack their achievements – enable integration – break things down like Lego blocks – degrees, certificates, also co-curricular, transcripts, specific artifacts and meta-data

3. Unprecedented Convenience and Potential
B ut this raises the issue of control

4. Authenticity?
Integrity?
How to verify?

5. Keeping a record using cryptographic means and a Merkle Tree structure

6. Authority vs “The Truthless Society” or …

7. Authority vs A dystopian world without sovereign control
Now what has this to do with the price of bread in Palo Alto, you ask

8. The Private Ledger
We control it: We believe that our authority matters
Share technology with other verticals: HR, procurement, legal, etc.
Consortium Model: Shared servers with multiple ledgers
Gateway with Gatekeepers: Known, accredited institutions

9. Our Current Approach

10. University Intranet Vendor
1. Vendor generates Adobe-certified PDF credential files.
Campus SIS
Vendor
2. Send certified credential files to storage.
3. Students download files
University Intranet

11. Platform/Software dependency
PDF format only
Cost
Irrevocable

12. 1. Vendor generates Adobe-certified PDF credential files.
Validation Website
Vendor
1. Vendor generates Adobe-certified PDF credential files.
Campus SIS
Vendor
2. Send certified credential files to storage server (cloud-based vendor).
3. Students download files

13. Stanford hosted validation website

14. As a Trusted Credential Issuer
Promote trust through verifiability
Independent from vendor-specific ecosystems
Support various data types and contexts
Support credential revoking
Ease of Adoption
Reliability of System(s)

15. Hypervisor
Mobile Apps
Bitcoin
Preprocessor
Docker
Performance
Artificial Intelligence
Robotics
Big Data
Spark
Cloud Computing
Blockchain
Cryptography
Database
Distributed System
Agile Development
Responsive Design
Cyber Security

16. Stanford Ph.D. student, Consultant
Developers
Brendan Farmer
Consultant
Jared Dunnmon
Stanford Ph.D. student, Consultant
Tom Black
Stanford Registrar

17. New development based on proven technology
Proposed Solution
New development based on proven technology
Start with dedicated model with potential to be easily replicated and expanded as distributed systems

18. Cryptographic Hashes
sha ( X ) = 8c110a8dbeb6cc4b67dcf3deceaeee45301dbbb9fb8589b50da1d88e a
X could be document file, a statement in Linked in, or even unstructured meta data.
One-Way function

19. Merkle Tree Data Structure
Merkle Root R
h ( x + y )
h ( h(a) + h(b) ) x y
h ( h(c) + h(d) ) a c
leaf
h (a)
h (b)
h (c)
h (d) b d

20. Loosely-Coupled Components
Transparency Server: Maintain one or more transparency logs for holding credential data
Connector: Controlled write access to transparency server
Verification Interface: Verification by inclusion proof checking

21. Validation Website
Validation Website
Vendor
1. Vendor generates Adobe-certified PDF credential files.
Vendor
3. Students download files
Campus SIS
1.1 certify / revoke credentials
2. Send certified credential files to storage server (cloud-based vendor)
1.2 certify / revoke credentials
Connector
Transparency Server

22. Transparency Server No access to student data
Accessible by public without privacy concerns
API to certify, revoke, and verify
Managed by university, hosted anywhere
Write only by the dedicated connector

23. Connector API to certify, revoke
Hosted within university’s secure intranet
Controls write access to transparency server
Complete separation of campus student data from transparency server

24. Verification Interface
Hash student data input on client side for verification
Verify credential by checking inclusion proof

25. certify / revoke credentials
Validation Website
Validation Website
Campus SIS
verify credentials
verify credentials
certify / revoke credentials
certify / revoke credentials
Connector
Transparency Server

26. Credential Issuing Process
Credential Conferred
Digital Artifact Generated
Register Credential on Transparency Server
Digital Credential Released to Learners

27. Credential Issuing Process
Campus SIS
add
add
Connector
Transparency Server
Generate digital credential documents
Generate SHA256 hash of credential documents
Send “certify” requests to transparency server via connector
Digital credential documents awarded to learners

28. Questions/Comments
Joyce Li Stephen Arod Shirreffs