Over the past few months, many governments have begun designing and implementing COVID certificate systems, including the recently-launched EU Digital COVID Certificate (formerly the EU Digital Green Certificate). We have been speaking to many of these public health authorities (PHAs) and their partners to understand their most urgent needs. From these conversations we’ve identified two critical challenges:
- There is a lack of a global trust architecture, a system that verifiers in one jurisdiction can use to make a decision about whether or not to accept a certificate signed by another jurisdiction.
- There are still many questions that government policy makers and technology teams have about how to build and manage COVID certificate systems, as vendor offerings in this space are still very new, and the standards are still being finalized.
To solve these challenges, we are proud to launch the Global COVID Certificate Network (GCCN), an initiative to enable interoperable and trustworthy verification of COVID certificates between jurisdictions for safe border reopening. GCCN will include a global directory of trust registries to enable cross-border certificate verification, and be a home for toolkits and community-managed support for those building and managing COVID certificate systems. We will also foster the development of a vendor ecosystem to accelerate adoption and provide paid support and other services.
LFPH has co-led the drafting process of the Good Health Pass Interoperability Blueprint (the “Blueprint”), which was released for public comments on June 7. The Blueprint has provided a set of recommendations for trust registries and frameworks, data and protocol standards, and other essentials to enable global interoperability of COVID certificate ecosystems. We will follow, operationalize and adapt the Blueprint recommendations for governments and industry alliances who are working to reopen borders. By adopting the Blueprint recommendations, we will also be able to facilitate interoperability between existing ecosystems while enhancing their level of privacy protection.
Components of GCCN
We plan to work with governments and industry alliances, software vendors and systems integrators, supporting organizations, and the broader LFPH community to jointly develop the following:
Trust Registry Network and Trust Registry Protocol
We will establish a global trust registry network, a directory of peer trust registries. Through the directory, governments and industry alliances will be able to look up other governmental or alliance trust registries, and decide based on information provided whether to accept their certificates. They will also be able to publish their own pointers to lists of their own authorized issuers, for other countries to accept.
We will start with a lightweight governance framework for the peers in the directory. Over time, participating peers will develop the governance model, defining the future evolution of the service.
Global COVID Certificates Implementation Toolkit
- Governance framework template. Participating governments and industry alliances will be able to make their own policies (e.g. the type of COVID certificates they issue and accept) using the governance framework template. Every participating organization will be able to decide whether or not to accept another jurisdiction’s certificates based on rules they set.
- Schema definitions and minimum datasets. We will provide schema definitions and minimum datasets for all three use cases (vaccination, test results, recovery from infection) of the Global COVID Certificates as well as a paper version for each.
- Technical specifications. We will provide technical specifications for all software components needed to issue, hold and verify the Global COVID Certificates. These include QR code specifications, certificate applications, formats, and signatures.
- Implementation guides and open source reference implementations. LFPH is working with our existing open source projects, Medcreds and Cardea, to incorporate the Blueprint recommendations. Our COVID Credentials Initiative (CCI) has been working over the past few months to create implementation guides for COVID certificates.
- Implementation and governance guidance. We at the Linux Foundation will not directly deploy trust registries or COVID certificate systems on behalf of governments or other institutions. That will typically be done by government technology teams and their vendors or other partners working under contract. Instead, we expect our community will be a home for peer advising on implementation and governance to anyone implementing COVID certificate systems. That could include how to build a country/jurisdiction-level trust registry and other related infrastructure, and how to leverage the Global COVID Certificates to incorporate existing institutions or communities into a national or jurisdiction-level trust infrastructure.
Vendor Network
The ability to turn good principles, plans, and open source code into production implementation depends on a vibrant commercial ecosystem. We are building a directory of vendors who can competently work on these kinds of projects, so that governments and institutions can more easily get running.
We have been discussing the development of COVID certificate systems with the Science and Technology Options Assessment Panel of the European Parliament. Our hope is that GCCN can become an important link between the EU Digital COVID Certificate Gateway (and Member States’ COVID certificate ecosystems) and new and existing COVID certificate ecosystems throughout the world. We look forward to further collaboration with relevant EU institutions to explore and create conversion mechanisms between the EU Digital COVID certificate and the Global COVID Certificate.
GCCN implements the Good Health Pass Interoperability Blueprint
The Good Health Pass Collaborative (GHPC) was conceived in late 2020 when the travel and tourism industry was seeking to safely reopen. It responded to a concern that the patchwork of certificate systems emerging onto the market would be neither interoperable nor privacy focused. To weave together existing efforts and present a path toward “good” digital health passes, ID2020 launched GHPC in February 2020 as a global collaboration to develop principles and standards for globally interoperable and universally accepted digital “good” health pass systems. LFPH and CCI joined GHPC as initial partners and endorsed its Principles Paper released at launch.
We have had an active role at GHPC since its inception, organizing preliminary activities at CCI and contributing to the drafting of the Blueprint. Kaliya Young, the Ecosystems Director of CCI, co-chaired the Good Health Pass (GHP) Interoperability Working Group hosted at the Trust Over IP Foundation (ToIP), our sister project within the Linux Foundation. Following Kaliya’s lead, many of our CCI community members also joined the Working Group to lead drafting groups of the Blueprint and contribute ideas and expertise.
GCCN finds a supportive and collaborative community at LFPH
LFPH hosts, supports, and nurtures open source technology for the benefit of public health initiatives around the world. Over a dozen jurisdictions around the world rely on LFPH’s exposure notification and COVID credentials codebases to fight COVID and safely reopen their communities.
Since December 2020, LFPH has been the home for CCI, an open global community of hundreds of members collaborating to enable the interoperable use of open-standard-based privacy-preserving credentials for public health purposes, starting with COVID. CCI has been an incubator of ideas and projects, a forum for the implementers of COVID certificate ecosystems to share and exchange ideas, and a resource for PHAs to understand the international landscape of these solutions and possible technology options. While cultivating a productive and vibrant community, CCI has continuously collaborated with other initiatives. Many of the CCI community work deliverables became references for the Blueprint, with some carried over to the GHP Working Group.
Through this work, LFPH has become a trusted advisor and safe haven for PHAs to get advice and collaborate. Our Implementer’s Forum for exposure notification provided events, documentation, and a Slack community where PHAs and the vendors working with them could get advice on best practices from around the world. Our existing relationships with EU countries and reputation as the open community for PHAs and their partners has attracted the developers of the EU Digital COVID Certificate to gather at LFPH and build channels for them to collaborate and debug together. We have dedicated channels for the teams to discuss implementation questions, support each other’s work and coordinate development efforts. This inspires our direction for GCCN and gives us the confidence to become the home for a global network of implementers dedicated to building for safe border reopening.
Participate in GCCN
Government agencies or industry alliances that are looking to launch a COVID certificate ecosystem for border reopening should reach out to us at info@lfph.io and join our conversations with many others who are doing the same.
Implementers of existing COVID certificate ecosystems focused on reopening borders can join the CCI community on our Slack (#cci) to collaborate with other implementers to produce community specifications and exchange experiences building on this technology.
Developers can contribute to the reference implementations by joining our Slack and getting involved with LFPH’s two COVID credentials projects: Medcreds and Cardea.
An Expanding List of Supporting Organizations
GCCN has gained the initial support of government and industry implementation partners including Affinidi, AOKPass, Blockchain Labs, Evernym, IBM Watson Health, Indicio.Tech, LACChain, Lumedic, Proof Market and ThoughtWorks. Additional companies that have committed to developing and moving GCCN forward include: Human Colossus Foundation, Continuum Loop Inc, Trinsic, Privacy By Design Lab, Finema, Dhiway Networks, HLN Consulting, LLC, Symsoft Solutions, digi.me (Consentry), Pravici LLC, Bloqzone, Immunodex, InfoCert, Pulse Connect, Validated ID, Safe Health, MATTR and IdRamp.
Additional Commentary
“IdRamp is on the front line of cross border interoperability. We deploy Zero Trust decentralized identity ecosystems for global enterprises and public sector organizations. As a member of Good Health Pass, ID2020, Cardia, and chair of the Trust Over IP Ecosystem Working Group we are dedicated to building open interoperable solutions that improve global trust. The IdRamp bak2.life service helps organizations easily provide verification of health records for safe access to events and venues according to open standards. Support of the Global COVID Certificate Network is a natural extension of our commitment to open-source digital trust. We look forward to working with the community on this important project.”
Mike Vesey, CEO, IdRamp
“A key consideration for international travel requirements is to enable the resolution of digital credentials in multiple languages. The Human Colossus Foundation will contribute to the Global COVID Certificate Network in the development of a transformation pipeline to enable semantic harmonization between the recommended HL7 FHIR data model (Release 4) for data exchange and the implementation of OCA where linguistic overlays can support multi-language credentialing following the W3C Verifiable Credential Data Model 1.0 standard.”
Paul Knowles, Head of the Advisory Council, Human Colossus Foundation
“Trinsic has been deeply involved with the drafting of the Good Health Pass Interoperability Blueprint and looks forward to supporting the Global COVID Certificate Network. Our focus at Trinsic is the adoptability of digital trust technologies, and the ability for different trust ecosystems to interoperate is critical to adoption. We look forward to supporting the Linux Foundation Public Health in this initiative.”
Riley Hughes, Co-founder & CEO, Trinsic
“When we deployed a trust registry in early 2020 for the global credit union industry we knew it was important for global finance. The extension of that same approach to help facilitate border reopening amid a global pandemic is incredibly exciting. We are proud to be supporting the Global COVID Certificate Network that LFPH has launched and will continue to provide support for the specifications, standards, and protocols that help build a global, open, and interoperable system for digital trust. Continuum Loop and its clients stand behind the open approach taken by LFPH.”
Darrell O’Donnell, P.Eng., President & CEO, Continuum Loop Inc.
“Dhiway Networks is excited to see emerging developments around the open, collaborative approach taken by LFPH towards establishing a digital trust architecture which spans the globe. We have been members and supporters of LFPH/CCI and will continue to participate in efforts enabling positive improvements in health outcomes – through governance frameworks, interoperability and the consumer experience.”
Satish Mohan, CTO and Co-Founder, Dhiway Networks
The Good Health Pass Interoperability Blueprint lays the foundation of global, scalable trust. The effort undertaken by Linux Foundation Public Health to create the Global COVID Certificate Network (GCCN) not only provides a technology implementation for the Blueprint, but also lays out the principles of good governance and provides actionable governance recommendations. I am excited about the potential of the GCCN model in other areas where digital trust is critical. This effort has also been a great example of what is possible in a very short amount of time when the community stands behind the principles of security and privacy: ultimately, the principles of digital trust. SymSoft Solutions is proud to be a part of this effort.
Savita Farooqui, Founder, SymSoft Solutions
“As an active Health Pass provider, dig.me/Consentry recognises from our clients the absolute importance of interoperability across the world and the use of verified data in a privacy preserving manner. The Good Health Pass Interoperability Blueprint provides the framework for us and others to achieve these goals. We are glad to see Linux Foundation Public Health is adopting the framework and operationalizing it through the Global COVID Certificate Network. We look forward to supporting this initiative.”
Julian Ranger, Executive President and Founder, digi.me/Consentry
“MATTR is pleased to support efforts for interoperability and the trustworthy exchange of privacy respecting, secure Verifiable Credentials. The Global COVID Certificate Network’s global trust registry has the opportunity to support interoperability across jurisdictions. Decentralised identity technologies, implemented in a responsible way create new opportunities for people and organisations to share data securely and with privacy in mind. The same global trust registry and Verifiable Credential technologies can also be used to support paper based verifiable credentials allowing us to bridge the digital divide in low tech or no internet environments.”
Claire Barber, CEO, MATTR
At Validated ID, we are committed to enabling the users to manage their digital identities the same way they do with their physical ones, in a secure and easy way. We’re glad that our commitment is aligned with large regional and international efforts including the European e-ID framework and the Global COVID Certificate Network (GCCN) that LFPH has launched. With this global pandemic, it is more important than ever to create a reliable model of relationships. The good news is that many are moving towards a set of open standards for digital health credentials that are vital to relaunch our economy. We look forward to supporting GCCN to make those standards a reality.
Santi Casas, CEO and Co-founder, Validated ID
“Pulse Connect is excited to join the Linux Foundation Public Health’s effort to create and implement the Global COVID Certificate Network (GCCN). Our focus at Pulse Connect is the enablement of self-sovereign technologies, and we believe maintaining data centricity is essential to securing data interoperability. The Global COVID Certificate Network and its governance blueprint for health-related certificates is pivotal as the world decides to standardize its movement to a decentralized & data-centric ecosystem. It will allow privacy enabling technologies to quickly deploy while maintaining interoperability across the many registries that participate. We look forward to continuing our community work in CCI and supporting Linux Foundation Public Health in this initiative.”
Michael Terrell, Co-Founder & CEO, Pulse Connect
“Having worked with governments and industries to build many digital trust products, Finema looks forward to supporting and contributing to GCCN’s effort in creating a network of trust and a set of tools to help countries reopen borders safely. We appreciate the invitation from LFPH to have us on board for the development of the Global COVID Certificate Network. This opportunity is going to fulfill our vision that vaccine certificates as well as other personal health records should be easy to use outside of the health domain and in a way that respects privacy.”
Pakorn Leesakul, Founder & CEO, Finema Co., Ltd. (Thailand)
“Pravici is fully committed to the principles of LFPH, CCI and the Global COVID Certificate Network in building our Verifiable Credentials product Pravici PocketCred. As we deploy our solution to allow Employees and Students get safely back to work and school, interoperability, adherence to standards and barrier free access to citizens of their vaccination or test status are key governing principles that we share with LFPH and CCI and plan to work towards those goals by following the guidance from the Global COVID Certificate Network.”
Mahesh Balan, CEO, Pravici LLC
“We are pleased to support and endorse the GCCN initiative as we consider it truly important to have a global trust architecture for the interoperability of the COVID certificate on a worldwide level. InfoCert’s experience as QTSP (qualified trust service provider) and as a premier member of DizmeID Foundation, together with Dizme ecosystem based on self-sovereign identity, represent a solid basis for our commitment to this key global initiative.”
Daniele Citterio, CTO of InfoCert, a premier member of DizmeID Foundation