Research paper

Designing GDPR Compliant Credential Verification Using Blockchain: A Design Science Research Approach

The paper derives meta-requirements and three design principles for a GDPR-compliant blockchain-based credential verification system: use blockchain for trustworthy transparent verification with legitimate documents, use smart contracts to automate the process, and conform to GDPR via off-chain storage and zero-knowledge proofs.

PaperOpen source resource ↗

Overview

Publication metadata and narrative from the current library record.

Authors: Janne Parkkila, AKM Bahalul Haque, Jaakko Vuolasto, Anastasiia Gurzhii, Sami Hyrynsalmi, Najmul Islam
Year: 2024
Venue: ECIS 2024 Proceedings
Methodology: Design science research; interviews; meta-requirements; prototype using off-chain storage and zero-knowledge proofs.

blockchaincredential-verificationdesign-science-researchgdpr-credential-verificationgdpr-privacyidentity-ssizero-knowledge

Designing GDPR Compliant Credential Verification Using Blockchain: A Design Science Research Approach

Authors: Janne Parkkila, AKM Bahalul Haque, Jaakko Vuolasto, Anastasiia Gurzhii, Sami Hyrynsalmi, Najmul Islam
Venue: ECIS 2024 Proceedings
Link: https://aisel.aisnet.org/ecis2024/track16_fintech/track16_fintech/5 (opens in a new tab)

Summary

Artifact

A GDPR-compliant blockchain-based credential (certificate) verification system.

Methodology

Design science research; interviews; meta-requirements; prototype using off-chain storage and zero-knowledge proofs.

Citations

[1] Janne Parkkila, AKM Bahalul Haque, Jaakko Vuolasto, Anastasiia Gurzhii, Sami Hyrynsalmi, Najmul Islam. Designing GDPR Compliant Credential Verification Using Blockchain: A Design Science Research Approach. ECIS 2024 Proceedings. https://aisel.aisnet.org/ecis2024/track16_fintech/track16_fintech/5 (opens in a new tab) [2] Source document: Designing GDPR Compliant Credential Verification Using Blockchain.pdf [3] Source evidence: MR1-MR4 individually stated in Section 3.3.1 (article pp. 5-7); DP1-DP3 individually stated in Section 3.4 (article p. 7); Table 2 (article p. 6) explicitly maps requirement rows to "MR3, DP1 & DP2" (row #10), confirming DP2 also addresses MR3 alongside MR2, in addition to the DP1->MR1/MR3 and DP3->MR4 mappings already present.

DSR grid

Six dimensions represented in the current paper record.

Problem description

Credential and certificate verification is manual, slow and costly, and blockchain-based solutions must comply with the GDPR.

Input knowledge

Self-sovereign identity; zero-knowledge proofs; GDPR; off-chain storage; digital-identity-management literature.

Research process

Design science research: interviews, derivation of meta-requirements, and a prototype using off-chain storage, ZKPs and Polygon ID.

Key concepts

Self-sovereign identity, blockchain, zero-knowledge, GDPR compliance, digital identity.

Solution description

A GDPR-compliant blockchain credential-verification system storing documents off-chain (hashes on-chain) and using ZKPs. Solution-space representation: Instantiation (prototype) plus meta-requirements and three design principles.

Output knowledge

Four meta-requirements and three design principles for GDPR-compliant credential verification.

Design knowledge

Directly linked concepts, grouped by their represented design-knowledge category.

Design Principle

Design Principle3

Design Principle

design-knowledge/gdpr-credential-verification-dp1

DP1 - Blockchain for trustworthy multi-party verification

Use blockchain to enable trustworthy and transparent user-credential verification with legitimate documents among multiple parties, since immutable entries and multi-party participation ensure only authentic certificates are stored.

credential-verificationdesign-principlegdpr-credential-verificationgdpr-privacy+2

Design Principle

design-knowledge/gdpr-credential-verification-dp2

DP2 - Smart contracts to automate verification

Use smart contracts to automate the whole process, remove manual intervention of third parties and ensure quick turnaround time.

credential-verificationdesign-principlegdpr-credential-verificationgdpr-privacy+2

Design Principle

design-knowledge/gdpr-credential-verification-dp3

DP3 - GDPR conformance via off-chain storage and ZKPs

Conform to GDPR by storing actual documents off-chain (only hashes on-chain) and using zero-knowledge proofs and user-held identity so that data ownership and access control are ensured.

credential-verificationdesign-principlegdpr-credential-verificationgdpr-privacy+2

Meta Requirement

Meta Requirement4

Meta Requirement

design-knowledge/gdpr-credential-verification-mr1

MR1 - Verify with original documents

The verification system should only use the candidate's original documents to verify the credentials.

credential-verificationgdpr-credential-verificationgdpr-privacyidentity-ssi+2

Meta Requirement

design-knowledge/gdpr-credential-verification-mr2

MR2 - Automated verification

The verification system should be automated to ensure quick turnaround time and reduce manual work.

credential-verificationgdpr-credential-verificationgdpr-privacyidentity-ssi+2

Meta Requirement

design-knowledge/gdpr-credential-verification-mr3

MR3 - Easy-to-use, easily integrated interface

The verification system should have an easy-to-use interface for all kinds of users and be integrable into existing systems with minimal effort.

credential-verificationgdpr-credential-verificationgdpr-privacyidentity-ssi+2

Meta Requirement

design-knowledge/gdpr-credential-verification-mr4

MR4 - Data-protection conformance

The verification system should conform to available data-protection and privacy regulations so that data ownership and access control are ensured.

credential-verificationgdpr-credential-verificationgdpr-privacyidentity-ssi+2

Paper design map

The default semantic design map canonicalizes stored design relationships; Raw links retains the complete technical Markdown-link view.

Design-knowledge map

7 stored concepts / 5 canonical semantic relationships

Concept types

Show relationship labels

Publication metadata

Additional metadata represented in the current library record.

Show additional metadata

{
  "type": "paper",
  "title": "Designing GDPR Compliant Credential Verification Using Blockchain: A Design Science Research Approach",
  "description": "The paper derives meta-requirements and three design principles for a GDPR-compliant blockchain-based credential verification system: use blockchain for trustworthy transparent verification with legitimate documents, use smart contracts to automate the process, and conform to GDPR via off-chain storage and zero-knowledge proofs.",
  "resource": "https://aisel.aisnet.org/ecis2024/track16_fintech/track16_fintech/5",
  "authors": "Janne Parkkila, AKM Bahalul Haque, Jaakko Vuolasto, Anastasiia Gurzhii, Sami Hyrynsalmi, Najmul Islam",
  "year": 2024,
  "venue": "ECIS 2024 Proceedings",
  "methodology": "Design science research; interviews; meta-requirements; prototype using off-chain storage and zero-knowledge proofs.",
  "dsr_grid": true,
  "dsr_solution_space": "Instantiation (prototype) plus meta-requirements and three design principles.",
  "tags": [
    "gdpr-credential-verification",
    "identity-ssi",
    "gdpr-privacy",
    "credential-verification",
    "zero-knowledge",
    "design-science-research",
    "blockchain"
  ]
}