Mojaloop Integration with MOSIP, Mifos, OpenG2P

[edcable]

Paul Makin,

I wanted to start this thread to gather feedback and discuss some of the questions that were raised by Rob and others during your presentation at the Mojaloop convening. Are you able to share upload your presentation here?

I thought this would be the best common place to get input from individuals across various DPGs rather than the slackspace for one individual DPG.

Rob, I will let you share your question/concern regarding the authentication process in the flows that Paul outlined.

[PaulMakinMojaloop]

Hi Ed,

Yes, Rob told you'd been talking! It would be good if we could find a better solution for the token resolution than what we have so far. I'd tag @sasi from MOSIP as a starting point.

For reference, the presentation is here:
PI 21 MOSIP Integration Readout 090323.pptx

[RobReeveLexTego]

Thanks @edcable and @PaulMakinMojaloop - there was a specific issue that I want to understand the associated risks around. That is the authentication of the individual standing in the bank - that is not the true owner of the MOSIP identity.
This is not an artificial scenario - and I can provide information in a non public forum

[PaulMakinMojaloop]

Rob, you don't need to provide evidence, it's a live issue for us all. As I understand it, for MOSIP, all rests on that initial enrolment of the individual with MOSIP. The authentication of the individual in the bank builds on that; MOSIP provides the authentication against the original enrolment.

There are then two scenarios, as i mentioned:

1. MOSIP provides the authentication link only, tying it back to the original enrolment, and nothing more. Authentication is then the only service (that is, no identification).
2. At the time of bank onboarding, MOSIP provides some basic identity data to the enrolling bank, with the bank supplementing this through their own due diligence.

Personally, I think option 2 is the best way forward, because option 1 creates an opportunity for the person to assert a DIFFERENT identity, and get the bank and MOSIP to link it back to a different real world identity. I suspect - but I'm not speaking for them - that MOSIP would prefer option 2 as well.

[RobReeveLexTego]

In option 2 - there are some zero knowledge proof approaches that could be used to ensure the banks data and mosip's data are never exposed - i.e. you get a green light this is the same person. We did some early work with OpenBanking on this.

[PaulMakinMojaloop]

That sounds like (forgive me) an obvious extension to option 2. I'd love to explore it further.

[PaulMakinMojaloop]

Obvious as in, obvious but no-one else has done it.

[PaulMakinMojaloop]

I did discuss with MOSIP the idea that they should provide the link between OpenG2P and the payee DFSP. So OpenG2P says to MOSIP, "Hey, I've got this MOSIP token. Can you pass it to whichever bank hosts the beneficiary's account?". Then MOSIP passes it to the bank, which holds it as a form of alternative ID for their customer.

If we did that, then OpenG2P would never know which bank it was, and the bank would just have a token, and wouldn't be able to identify which relying party it came from.

MOSIP were reluctant to use that approach. I'm not sure why.