UK invites digital ID providers to join testing for machine-readable DVS register

The UK’s machine-readable register for Digital Verification Services (DVSs) is nearly ready, and the Office for Digital Identities and Attributes wants DVS Providers to help test the infrastructure behind it.

OfDIA announced its intentions with the machine-readable DVS register in July to replace the current register. Making the register machine-readable is intended to support automated checks so that the system can scale. OfDIA identified the machine-readable version of the register as a priority when it confirmed its commitment to the DVS trust framework in July.

The agency is planning technical testing through an API model to support direct connections for secure data exchange, and a credential model for verifying credentials presented from a digital wallet, according to a government blog post.

Tests of the onboarding process will take place in October, when OfDIA will also begin interviewing DVS providers to gauge their readiness for integration testing. More tests covering the technical models will follow.

How the system works

The API model is used when a public authority is asked by a DVS provider to validate an individual’s data, and the authority must first confirm the DVS provider is registered to perform the task. It uses X.509 certificates and OpenID Federation specifications. The credential model allows wallets to check reader services are registered as verifiers, using a Verifier Identity Certificate Authority List (VICAL) for verifiers to check and a Reader Identity Certificate Authority List (RICAL) for wallets. VICALs and RICALs are defined in the ISO/IEC 18013-5 standard.

Registered DVS providers will get access to a “DVSP Portal,” currently in development, to create an account. The account allows them to submit and manage information about the services they provide, including technical information for generating transport certificates and create and publish entity configurations.

Transport certificates presented by DVS providers can be traced back to OfDIA through the trust chain created by a certificate issued by an appointed certificate authority, which is chained to an OfDIA root certificate authority, according to the announcement.

Entity configurations take the form of self-signed JSON Web Tokens (JWTs). The JWT may carry a signed OpenID trust mark with certification details.

Relying parties use a mutual TLS to check certificates, which confirms the DVS provider is on the register. The DVS provider can confirm the client’s identity through tls_client_auth or private_key_jwt.

Relying parties confirm the valid roles for the service through the API and a resolve endpoint OfDIA is also working on.

Connections are initiated by the individual presenting a QR code or tapping their phone with NFC enabled.

DVS providers are invited to email digital.identity.register@dsit.gov.uk to participate in the tests.

Article Topics

automation  |  digital ID infrastructure  |  digital verification service (DVS)  |  DVS Trust Framework  |  ISO 18013-5  |  machine readable  |  OfDIA  |  UK digital ID