User-Centric Verifiable Digital Credentials (EN578-170003/35)

Tender Notice

Status

Publishing status
Expired

Dates

Publication date
2019/08/29
Amendment date
2019/10/07
Date closing
2019/11/07 14:00 Eastern Standard Time (EST)

Details

Reference number
PW-19-00884577
Solicitation number
EN578-170003/35
Region of opportunity
Canada
Region of delivery
Canada
Notice type
Request for Proposal (RFP)
GSIN
Trade agreement
  • None
Tendering procedure
Solely Canadian content
Procurement entity
Public Works and Government Services Canada
End user entity
Public Works and Government Services Canada

Contact Information

Contact name
Secrétariat de Solutions Innovatrices Canada / Innovative Solutions Canada Secretariat
Contact email
TPSGC.SIC-ISC.PWGSC@tpsgc-pwgsc.gc.ca
Contact address
10 Wellington
Gatineau  QC
K1A 0S5
CA

Find Out Who Is Interested In This Tender

Are you looking for partnering opportunities or thinking about bidding? Find out who is interested in the tender and add your name to the List of Interested Suppliers.

Important: The LIS for a specific tender notice does not replace or affect the tendering procedures in place for the procurement. Businesses are still required to respond to bid solicitations and to compete based on established bid criteria. For more information please read the List of Interested Suppliers Terms of Use.

Access the List of Interested Suppliers for this tender

Activity

The following statistics are only for the English page and are provided in close to real time. To calculate the total activity for a tender notice, you will need to add the English and French statistics.

Page views
(English page)
-
Unique page views
(English page)
-
Tender notice updates
Get notifications for this tender notice:
e-mail   RSS feed   Atom feed
For more information on notifications, visit the Follow Opportunities page.

Description

October 7, 2019

  1. The closing date for this challenge has been extended to November 7 2019 at 14:00 ET.
  2. Attachment 1 has been added. The document contains questions and answers related to the Challenge.
  3. The Desired outcomes and Considerations have been amended as follows:

REMOVE:

Desired outcomes and Considerations

Essential (Mandatory) Outcomes

  1. Create User-centric Verifiable Digital Credentials able to operate on a national or global interoperable verification platform
  2. Protect the privacy and identity of the user at all times
  3. Incorporate the following emerging and/or mature specifications for interoperability that have been funded, tested and/or championed by the United States of America Department of Homeland Security:
  • Verifiable Credentials: Blockcerts and/or Hyperledger Project Indy
  • Decentralized Identifiers (Standards Development Organizations: World Wide Web Consortium (W3C) or Decentralized Identity Foundation),
  • Verifiable Credentials (Standards Development Organization - W3C); and
  • JavaScript Object Notation for Linked Data / JSON-LD (Standards Development Organization - W3C).

4. Adhere to applicable policy instruments, guidelines and frameworks, including but not limited to:

  • Requirements specified in the Treasury Board Directive on Identity Management; and
  • Conformance Criteria specified in the Public Sector Profile of the Pan-Canadian Trust Framework.

Additional Outcomes

Proposed solutions should:

  1. Give issuers and recipients ownership of their official records that can be cryptographically signed and presented anywhere to verify credential provenance and ownership.
  2. Give issuers and recipients autonomy over how they use their records and verify digital credentials. For example, if issuers decide to switch vendors later on, they retain full access and use of their digital certificates.
  3. Give relying trusted third parties the ability to verify any record independently, in independent fashion, for free and independent of any software vendor or issuing institution. Relying parties can easily verify any digital credential through widely available technology such as a web browser or a mobile phone. Verification is based on open and interoperable approaches.
  4. Provide leading-edge digital credential security to enable the global trust economy that are cryptographically signed thus enabling third parties to verify their provenance and ownership.
  5. Demonstrate the components of self-sovereign identity:
  • decentralized and portable;
  • demonstrated control of attributes; and
  • independence from a centralized registry, identity provider, or certificate authority.

INSERT:

Desired outcomes and Considerations

Essential (Mandatory) Outcomes

Proposed solutions must:

  1. Create User-centric Verifiable Digital Credentials able to operate on a national or global interoperable verification platform;
  2. Protect the privacy and identity of the user at all times* (see note);
  3. Incorporate the following emerging and/or mature specifications for interoperability that have been funded, tested and/or championed by the United States of America Department of Homeland Security:
  • Decentralized Identifiers (Standards Development Organizations: World Wide Web Consortium (W3C) or Decentralized Identity Foundation),
  • Verifiable Credentials (Standards Development Organization - W3C); and
  • JavaScript Object Notation for Linked Data / JSON-LD (Standards Development Organization - W3C);

4. Demonstrate the feasibility of the specifications described above in support of creating, transmitting and storing verifiable digital credentials using wallet or agent reference implementations. These reference implementations may include but not are limited to: Blockcerts, Hyperledger Indy Aries

5. Adhere to applicable policy instruments, guidelines and frameworks, including but not limited to:

  • Requirements specified in the Treasury Board Directive on Identity Management; and
  • Conformance Criteria specified in the Public Sector Profile of the Pan-Canadian Trust Framework.

*Note: In relation to protecting privacy and identity of the user, the bidder is expected to demonstrate, in the proposal, knowledge and application of relevant controls as outlined in applicable guidance, including but not limited to CSE ITSP.30.31 published at https://www.cse-cst.gc.ca/en/system/files/pdf_documents/itsp.30.031v3-eng_0.pdf

It is also expected that the bidder demonstrate, in the proposal, sufficient knowledge to enumerate relevant threat agents and mitigation approaches

Additional Outcomes

Proposed solutions should:

  1. Give issuers and recipients ownership of their official records that can be cryptographically signed and presented anywhere to verify credential provenance and ownership.
  2. Give issuers and recipients autonomy over how they use their records and verify digital credentials. For example, if issuers decide to switch vendors later on, they retain full access and use of their digital certificates.
  3. Give relying trusted third parties the ability to verify any record independently, in independent fashion, for free and independent of any software vendor or issuing institution. Relying parties can easily verify any digital credential through widely available technology such as a web browser or a mobile phone. Verification is based on open and interoperable approaches.
  4. Provide leading-edge digital credential security to enable the global trust economy that are cryptographically signed thus enabling third parties to verify their provenance and ownership.
  5. Demonstrate the components of self-sovereign identity:
  • decentralized and portable;
  • demonstrated control of attributes; and
  • independence from a centralized registry, identity provider, or certificate authority.

6. Demonstrate multiple partnerships and interoperability with other companies within verifiable credential ecosystem.

*******************************************************

This Challenge Notice is issued under the Innovative Solutions Canada Program (ISC) Call for Proposals 002 (EN578-170003/C). For general ISC information, Bidders can visit the ISC website.

Please refer to the Solicitation Documents which contain the process for submitting a proposal.

Steps to apply:

Step 1: read this challenge

Step 2: read the Call for Proposals

Step 3: propose your solution here

CHALLENGE TITLE: User-Centric Verifiable Digital Credentials

CHALLENGE SPONSOR: Shared Services Canada (SSC) and Treasury Board Secretariat of Canada (TBS)

Funding Mechanism: Contract

MAXIMUM CONTRACT VALUE:

Multiple contracts could result from this Challenge.

The maximum funding available for any Phase 1 Contract resulting from this Challenge is $150,000.00 CAD (plus tax) including shipping, travel and living expenses, as applicable, for up to 6 months.

The maximum funding available for any Phase 2 Contract resulting from this Challenge is $1,000,000.00 CAD (plus tax) including shipping, travel and living expenses, as applicable, for up to 12 months. Only eligible businesses that have completed Phase 1 could be considered for Phase 2.

This disclosure is made in good faith and does not commit Canada to contract for the total approximate funding.

TRAVEL:  No travel is anticipated

Kick-off meeting

Teleconference/videoconference

Progress Review Meeting(s)

Teleconference/videoconference

Final Review Meeting

Teleconference/videoconference

Problem Summary Statement

The Treasury Board Secretariat of Canada (TBS) and Shared Services Canada (SSC) are seeking a standardized method to issue and rapidly verify portable digital credentials across many different contexts, thereby reducing human judgement error, increasing efficiency and ensuring digital credential veracity using cryptography.

Problem Statement

This challenge is seeking a portable secure digital credentials (self-sovereign identity) solution held by individuals that can be independently, cryptographically and rapidly verified using emerging distributed ledger standards and an approach that may give rise to a global digital verification platform. For many contexts, ranging from applying for a job to transiting checkpoints for aviation security, paper documents remain the predominant way to prove key attributes about an individual, such as their name, date of birth, academic/professional qualifications, or security clearance. While these attributes might be presented in digital form, there are no widely adopted or standardized methods to issue and rapidly verify digital credentials across many different contexts. There exists no current capability to digitally verify without dependencies on centralized or low-latency network platforms (or both).

Note: The operational solution will be required to store all personal information within Canada

Desired outcomes and Considerations

Essential (Mandatory) Outcomes

Proposed solutions must:

  1. Create User-centric Verifiable Digital Credentials able to operate on a national or global interoperable verification platform;
  2. Protect the privacy and identity of the user at all times* (see note);
  3. Incorporate the following emerging and/or mature specifications for interoperability that have been funded, tested and/or championed by the United States of America Department of Homeland Security:
  • Decentralized Identifiers (Standards Development Organizations: World Wide Web Consortium (W3C) or Decentralized Identity Foundation),
  • Verifiable Credentials (Standards Development Organization - W3C); and
  • JavaScript Object Notation for Linked Data / JSON-LD (Standards Development Organization - W3C);

4. Demonstrate the feasibility of the specifications described above in support of creating, transmitting and storing verifiable digital credentials using wallet or agent reference implementations. These reference implementations may include but not are limited to: Blockcerts, Hyperledger Indy Aries

5. Adhere to applicable policy instruments, guidelines and frameworks, including but not limited to:

  • Requirements specified in the Treasury Board Directive on Identity Management; and
  • Conformance Criteria specified in the Public Sector Profile of the Pan-Canadian Trust Framework.

*Note: In relation to protecting privacy and identity of the user, the bidder is expected to demonstrate, in the proposal, knowledge and application of relevant controls as outlined in applicable guidance, including but not limited to CSE ITSP.30.31 published at https://www.cse-cst.gc.ca/en/system/files/pdf_documents/itsp.30.031v3-eng_0.pdf

It is also expected that the bidder demonstrate, in the proposal, sufficient knowledge to enumerate relevant threat agents and mitigation approaches

Additional Outcomes

Proposed solutions should:

  1. Give issuers and recipients ownership of their official records that can be cryptographically signed and presented anywhere to verify credential provenance and ownership.
  2. Give issuers and recipients autonomy over how they use their records and verify digital credentials. For example, if issuers decide to switch vendors later on, they retain full access and use of their digital certificates.
  3. Give relying trusted third parties the ability to verify any record independently, in independent fashion, for free and independent of any software vendor or issuing institution. Relying parties can easily verify any digital credential through widely available technology such as a web browser or a mobile phone. Verification is based on open and interoperable approaches.
  4. Provide leading-edge digital credential security to enable the global trust economy that are cryptographically signed thus enabling third parties to verify their provenance and ownership.
  5. Demonstrate the components of self-sovereign identity:
  • decentralized and portable;
  • demonstrated control of attributes; and
  • independence from a centralized registry, identity provider, or certificate authority.

6. Demonstrate multiple partnerships and interoperability with other companies within verifiable credential ecosystem.

Background and Context

This challenge intends to determine the feasibility and characteristics of developing a national or global interoperable verification platform that can be used to independently verify digital credentials issued by a dynamic set of trusted issuers, and used by a broad and diverse population of users. This can be tested in a context, such as aviation security where there are many actors and authorities operating across many organizational and geographical boundaries. Building on these standards, the goal is to prove that a decentralized, interoperable digital verification ecosystem can be built that can be used by many independent issuers, operators, and most importantly users, by means of open-source libraries and standards-based capabilities. In order for a new technology to gain adoption, it must be made accessible through easy-to-use and widely available software and ubiquitous infrastructure such as Blockchain, Distributed Ledger Technology (DLTs) and Self-Sovereign Identity (SSI). A government could potentially leverage these and develop a ubiquitous infrastructure with enhanced transparency and auditing of public service operations, greater visibility into multi-party business operations, and automation of paper-based processes to improve delivery of services to organizations and citizens. There exists a common need to issue entitlements, attestations and certifications for a variety of purposes including travel, training, education, affiliation, organizational identity and delegated authority and more. Current issuance processes are often paper based, non-interoperable and are susceptible to loss, destruction, forgery, and counterfeiting. While there is a diversity of contexts, there are many common needs across different departmental and agency contexts with a potential use of interoperable implementations of Blockchain, DLTs and SSI that also support the growth and availability of a competitive marketplace of diverse technology implementations for government and industry to draw upon to deliver cost effective and innovative solutions. For many contexts, ranging from applying for a job to transiting checkpoints for aviation security, paper documents remain the predominant way to prove key attributes about an individual, such as their name, date of birth, academic/professional qualifications, or security clearance. While these attributes might be presented in digital form, there are no widely adopted or standardized methods to issue and rapidly verify digital credentials across many different contexts. There exists no current capability to digitally verify without dependencies on centralized or low-latency network platforms (or both). In addition, there is a potential need for self-sovereign identity, which is the concept that people and businesses can store their own identity data on their own devices, and provide it efficiently to those who need to validate it, without relying on a central repository of identity data.

ENQUIRIES

All enquiries must be submitted in writing to TPSGC.SIC-ISC.PWGSC@tpsgc-pwgsc.gc.ca no later than ten calendar days before the Challenge Notice closing date. Enquiries received after that time may not be answered.

Access and terms of use

Government of Canada (GC) tender notices and awards, solicitation documents and tender attachments are available free of charge and without registration on Buyandsell.gc.ca/tenders, the authoritative location for GC tenders.

You may have received this tender notice or award through a third-party distributor. The Government of Canada is not responsible for any tender notices and/or related documents and attachments not accessed directly through Buyandsell.gc.ca/tenders.

This Government of Canada tender notice or tender award carries an Open Government Licence - Canada that governs its use. Related solicitation documents and/or tender attachments are copyright protected. Please refer to the section about Commercial Reproduction in the Buyandsell.gc.ca Terms and Conditions for more information.

Support for smaller businesses

If you have questions specific to this procurement, please contact the Contracting Authority (see the "Contact Information" section above).

If you need help understanding the federal procurement process or registering as a supplier, contact the Office of Small and Medium Enterprises. We have a network of offices across Canada.

Attachments

FileAmendment numberLanguageUnique Download Event (English page)Date added
attachment_1_-_questions_and_answers_1_to_7_-_en578-170003_35.pdfNot availableEnglish- 2019-10-07
piece_jointe_1_-_questions_et_reponses_1_a_7_-_en578-170003_35.pdfNot availableFrench- 2019-10-07