Tl;dr

Security and privacy are paramount in today’s digital age, especially regarding personal information and interactions. One innovative approach to bolstering security in digital communications, such as phone calls, is using verifiable credentials for authentication.

Details

Here’s a simplified explanation of how phone call authentication via verifiable credentials works. Imagine you receive a phone call from a service provider, say your customer. Instead of going through the traditional and often tedious method of answering security questions (which could be guessed or obtained by someone else), the authentication process involves a digital handshake using verifiable credentials.

Process

init

Verifiable credentials are digital certificates, similar to digital IDs, that prove the identity of the caller and the call recipient. These credentials can be stored securely in a digital wallet on your smartphone or another device. When a customer initiates a call, the operator requests authentication with the link - to share|present credential (VC). This process is facilitated by cryptographic methods, ensuring that the credentials are authentic and have not been tampered with. We can compare the case to the physical ID card, where the issuer is the government, and the owner is the person who has the ID card. By the office window, the owner shows the ID card, and the office checks the data and security marks on the card. However, the office can also verify the digital layer of the card.

flow You can test the full flow with my demo application. All steps:

  1. The account onboarding process should include the step to issue the Verifiable Credential - you can try with my demopage.
  2. As a Phone Call Recipient, the phone call operator will verify the caller with the page.
  3. The operator gets the link generated to share VC. You can copy the link and share it with the caller via text. The caller can use the link to verify the call.
  4. The caller will use the link to open the wallet and share expected data (Verifiable Credentials) with the recipient.
  5. The recipient will receive the data and verify the call.

Technical details & services

next

To build the service and the demo, I used the following services:

  1. App Service.
  2. Cosmos DB (to store audit log & session).
  3. Entra Verified ID (to issue and verify the credentials).

What next?

next I see the next possibilities for similar business cases:

  1. Security check on the office|factory entrance.
  2. For internal organizational cases, Verified Employee credentials can be used (build-in credentials).
  3. A similar process can be used to verify that the bank employee is calling the customer to be 100% sure that the bank employee is calling.
  4. Face Check can extend the process to improve security.
  5. Extend the process with the KYC (Know Your Customer) process - the onboarding process can verify the customer’s physical ID, selfie, and other data.
  6. Full audit trail - from the verification and presenter sides.