Enhance Privacy in Sensitive Document Exchange during Customer on-boarding using IRMA

In a society that increasingly relies on digital processes, the reliability, security and resilience of our national IT systems are more important than ever. This mission focuses on developing smart technologies that prevent, detect and efficiently resolve failures with major societal impact. Within this graduation project, privacy-preserving identity verification plays a central role: how can individuals prove what they are without revealing who they are? IRMA (I Reveal My Attributes) offers promising opportunities to strengthen critical processes while protecting sensitive personal information.

This graduation assignment is part of the project ‘Mission: Impossible – Critical IT Protocol’. With this project, we are giving the Netherlands a digital boost by building IT solutions for critical societal challenges. From payment systems and public services to cybersecurity and crisis detection: together, we are strengthening the Netherlands’ digital infrastructure with impact that truly matters.

In many financial organizations, sensitive information and documents need to be exchanged during the process of onboarding new customers. An example is proof of the customer’s identity or income as part of a loan application. Often, the documents that need to be shared contain more sensitive information than necessary. It would be safer if people only needed to share the attributes about themselves that are necessary for the assessment of the customer during the onboarding process.

IRMA can achieve this by securely disclosing certain attributes about a person using a mobile phone running the IRMA app (https://irma.app). It protects the privacy of the person by only showing attributes that are sufficient. In the loan application example, this would be the attributes stating the country of residence, date of birth and yearly salary. Other information is not shared and cannot be abused by a third party to commit, for example, identity fraud. This attribute-based authentication only reveals what you are and not who you are.

IRMA also offers attribute-based signatures, which improve on the traditional digital signature done with a private key and a corresponding certificate containing the public key. These IRMA signatures are constructed by enclosing a number of attributes of the signer to the document. For example, signing the ownership document of a building using the notary’s attribute stating that the document comes from a real notary. This is a big advantage over traditional signatures because it gives information about who actually signs it.

This could be used to integrate it with a service like CryptPad (https://cryptpad.fr), with which you can make collaborative documents. It uses client-side encryption to make sure it’s protected from other people who can access the server. Other people can read your documents by sharing your cryptographic key that is never sent to the server. Moreover, your username and password are used only to generate a unique keyring, and the server only knows your signature to identify you and retrieve your documents. This zero-knowledge application makes a good candidate to research whether integrating it with the IRMA system has further potential benefits.

IRMA is open source and available to integrate with other services for which authentication, sharing sensitive information and signatures are important. Integrating IRMA into customer-onboarding processes to enable a legally binding way of only sharing the attributes necessary during these processes would greatly enhance privacy.

You will research whether, and for what purposes, IRMA can be integrated into a customer onboarding process and whether CryptPad can be incorporated into the solution. Perhaps the attribute-based signatures can add value to prove the origin of the documents the customer shares during the process? What about the authentication flow of customer-facing portals? This research includes setting up IRMA, integrating it with a customer onboarding process in a way that allows a legally binding way of sharing information, analyzing the approaches and motivating your choices.

About Info Support Research Center

We anticipate on upcoming and future challenges and ensures our engineers develop cutting-edge solutions based on the latest scientific insights. Our research community proactively tackles emerging technologies. We do this in cooperation with renowned scientists, making sure that research teams are positioned and embedded throughout our organisation and our community, so that their insights are directly applied to our business. We truly believe in sharing knowledge, so we want to do this without any restrictions.

Read more about Info Support Research here.

About Info Support

Info Support specializes in custom software, data/AI solutions, management, and training and is active in the Finance, Industry, Agriculture, Food & Retail, Mobility & Public, and Healthcare sectors. We provide solid and innovative solutions for complex and critical software issues. Our headquarters are located in Veenendaal (NL) and Mechelen (BE). At present, approximately 500 employees are employed by Info Support.

Info Support’s working method is characterized by a number of core values: solidity, integrity, craftsmanship, and passion. These core values are intertwined in our work and the way we interact with each other.

To ensure that all employees are always up to date with the latest developments, Info Support has an in-house IT Academy that eagerly satisfies the hunger for more or different knowledge and skills.

B2 language proficiency in Dutch is required.