OVERVIEW AND ABSTRACT: This is the 'silent' slide deck, including extra Question-and-Answer session slides, from a presentation at The Open University's Knowledge Media Institute on 19th May 2020, in which we describe the workings of the world's first blockchain-based mobile app for certifying and verifying COVID-19 antibody test results and vaccinations. A full video replay of the 20-minute talk, as well as the full 30-minute followup question and answer session, and related academic papers, can be found at https://blockchain.open.ac.uk/#covid-19 ----------[ABSTRACT OF TALK FOLLOWS]---------- As the COVID-19 Pandemic of 2019/2020 unfolds, a controversial 'Immunity Passport' has been mooted as a way to enable individuals to return back to work or be admitted to current off-limits locations. Our approach is less dramatic, concentrating on the soundness of certification and verification: While the quality of antibody testing and the likelihood of even attaining COVID-19 immunity continue to be researched, we address the issues involved in providing certification for antibody testing and likely future vaccination, in a tamper-proof, privacy-preserving, and ethically appropriate manner. To do this, we developed a prototype mobile phone app and requisite decentralised server architecture. Personally identifiable information is only stored at the user's discretion, and the app allows the end-user selectively to present only the specific test result with no other personal information revealed. Behind the scenes it relies upon (a) the 2019 World Wide Web Consortium standard called 'Verifiable Credentials', (b) Tim Berners-Lee's decentralized personal data platform 'Solid', and (c) a consortium Ethereum-based blockchain. Our approach enables both verifiability and privacy in a manner derived from public/private key pairs and digital signatures, generalized to avoid restrictive ownership of sensitive digital keys and/or data. The app and decentralised server architecture offer a prototype proof of concept that is readily scalable, applicable generically, and in effect 'waiting in the wings' for the biological issues, plus key ethical issues discussed in the presentation, to be resolved. Full replay, academic papers, and related material can be found at https://blockchain.open.ac.uk/#covid-19

1. 1
COVID-19 Antibody Test /
Vaccination Certificates
“There’s an app for that”
KMi Webinar 19th May 2020, 1:30pm-2:30pm UK Time
• Overview, Key Technologies and Issues: Prof. Marc Eisenstadt
• Technical Details: Dr. Manoharan Ramachandran
• Questions & Answers (questions to kmi-events@open.ac.uk)
Marc Eisenstadt and Mano Ramachandran
with Niaz Chowdhury, Allan Third, John Domingue
https://blockchain.open.ac.uk/#covid-19
(includes link to video replay)

2. 2
What we’ve done…
...and ‘So What?’
(then: ‘The Secret Sauce’)
(then over to Mano for ‘under the hood’ + demo)

3. 3
Myth Busting: you might think…
1. Blockchain = Bitcoin + evil
2. Blockchain = slow
3. Blockchain = env’t disaster
4. ‘Immunity passports’= ‘ID hell’
5. COVID-19 reinfection happens!
6. Antibody tests inaccurate
7. ‘Immunity’ short-lived
8. Vaccination certificates? NO!!!!

4. 4
Myth Busting: you might think…
1. Blockchain = Bitcoin + evil
2. Blockchain = slow
3. Blockchain = env’t disaster
4. ‘Immunity passports’= ‘ID hell’
5. COVID-19 reinfection happens!
6. Antibody tests inaccurate
7. ‘Immunity’ short-lived
8. Vaccination certificates? NO!!!!
1. Decentralised ledger, immutable

5. 5
Myth Busting: you might think…
1. Blockchain = Bitcoin + evil
2. Blockchain = slow
3. Blockchain = env’t disaster
4. ‘Immunity passports’= ‘ID hell’
5. COVID-19 reinfection happens!
6. Antibody tests inaccurate
7. ‘Immunity’ short-lived
8. Vaccination certificates? NO!!!!
1. Decentralised ledger, immutable
PlainVanilla Ledger
###0 ###1
50 75
42 87

6. 6
Myth Busting: you might think…
1. Blockchain = Bitcoin + evil
2. Blockchain = slow
3. Blockchain = env’t disaster
4. ‘Immunity passports’= ‘ID hell’
5. COVID-19 reinfection happens!
6. Antibody tests inaccurate
7. ‘Immunity’ short-lived
8. Vaccination certificates? NO!!!!
1. Decentralised ledger, immutable
2. Generally, not any more
3. Consortium, no £££ ‘proof-of-work’
4. Just verifiable & private test results
5. Hearsay! Tests were flawed.
6. 100% sensitivity & 99.8% specificity
7. Perhaps months -> years?
8. Required for yellow fever, measles

7. 7
T

8. 8
T

9. 9
Key premises
1. COVID-19 antibodies are reliably detectable
SARS-CoV-2
x 10,000,000
https://www.open.edu/openlearn/science-maths-
technology/biology/how-does-the-human-body-fight-viral-infection

10. 10
Key premises
1. COVID-19 antibodies are reliably detectable
SARS-CoV-2
x 10,000,000
https://www.open.edu/openlearn/science-maths-
technology/biology/how-does-the-human-body-fight-viral-infection

11. 11
Key premises
2. COVID-19 antibodies appear ‘eventually’ and last
1. COVID-19 antibodies are reliably detectable
https://www.open.edu/openlearn/science-maths-
technology/biology/how-does-the-human-body-fight-viral-infection

12. 12

13. 13
Key premises
2. COVID-19 antibodies appear ‘eventually’ and last
1. COVID-19 antibodies are reliably detectable
3. COVID-19 antibodies impart immunity…for ‘long enough’

14. 14
Problem:
How to start getting people back to key jobs
& locations as the COVID-19 pandemic eases?
“Immunity Passports!”

15. 15
Problem:
How to start getting people back to key jobs
& locations as the COVID-19 pandemic eases?
“Immunity Passports!”
Antibody test… Results! Vaccination… Certificate!
What about fraud? What about your privacy?
Here’s our approach….

16. 16
A: Test
B: Issue Certificate
C: Verify
What:

17. 17
A: Test
B: Issue Certificate
C: Verify
What:
‘Good
enough’
 Issuer
 Holder
 IgG > 4.2

18. 18
Nobody (else) owns it.
Nobody (else) stores it.
So what?
Nobody (else) sees all of it;
only what you reveal.
Nobody can take it.
Nobody can fake it.
Nobody can break it.

19. 19
How does it work? The secret sauce A-B-C 1 of 5
Verifiable Credentials:
W3C standard to
structure the data.
VerifierIssuer
Issue
Holder
Show
Verifiable Data Registry
Verify Register IDs Verify IDs

20. 20
Sender
has
Recipient
has
Signing Sender
private key
Sender
public key
How does it work? The secret sauce A-B-C 2 of 5
Verifiable Credentials:
W3C standard to
structure the data.
VerifierIssuer
Issue
Holder
Show
Verifiable Data Registry
Verify Register IDs Verify IDs

21. 21
How does it work? The secret sauce A-B-C 3 of 5
Verifiable Credentials:
W3C standard to
structure the data.
VerifierIssuer
Issue
Holder
Show
Verifiable Data Registry
Verify Register IDs Verify IDs
Solid Pod: decentralised personal data
store with custom ownership, control
and hosting (eg on own phone).
Think: ‘Facebook without facebook.com’

22. 22
How does it work? The secret sauce A-B-C 4 of 5
FCD3FA34E…
79A6EB94…
Consortium blockchain: secure, immutable
and trusted record, holding encoded hashes
of certificates. Also a decentralised public
key registry for signing all transactions.
Verifiable Credentials:
W3C standard to
structure the data.
VerifierIssuer
Issue
Holder
Show
Verifiable Data Registry
Verify Register IDs Verify IDs
Solid Pod: decentralised personal data
store with custom ownership, control
and hosting (eg on own phone).
Think: ‘Facebook without facebook.com’

23. 23
How does it work? The secret sauce A-B-C 5 of 5
FCD3FA34E…
79A6EB94…
Consortium blockchain: secure, immutable
and trusted record, holding encoded hashes
of certificates. Also a decentralised public
key registry for signing all transactions.
Verifiable Credentials:
W3C standard to
structure the data.
VerifierIssuer
Issue
Holder
Show
Verifiable Data Registry
Verify Register IDs Verify IDs
Decentralised Verifiable Data Registry
Solid Pod: decentralised personal data
store with custom ownership, control
and hosting (eg on own phone).
Think: ‘Facebook without facebook.com’

24. 24
How does it work? (Timeline) 1 of 5
Holder’s
mobile phone
with
Decentralised
Identity
1

25. 25
Consortium
blockchain
Holder’s
mobile phone
with
Decentralised
Identity
How does it work? (Timeline) 2 of 5
1
FCD3FA34E…
79A6EB94…

26. 26
Test result
certificate goes
to Solid Pod
How does it work? (Timeline) 3 of 5
2
FCD3FA34E…
79A6EB94…
Hash

27. 27
Verifying test result certificate
How does it work? (Timeline) 4 of 5
3
FCD3FA34E…
79A6EB94…
Compare

28. 28
Verifying test result certificate
How does it work? (Timeline) 4 of 5
3
FCD3FA34E…
79A6EB94…
Compare
‘Good
enough’
 Issuer
 Holder
 IgG > 4.2

29. 29
How does it work? (Timeline) 5 of 5 - Steps together
FCD3FA34E…
79A6EB94…
1
2
3
Compare
Hash

30. 30
Consider the ‘Holder’ at the end of this…

31. 31
Consider the ‘Holder’ at the end of this…
Nobody (else) owns it.
Nobody (else) stores it.
Nobody (else) sees all of it;
only what you reveal.
Nobody can take it.
Nobody can fake it.
Nobody can break it.

32. 32
Too good to be true?
• Private
• Tamper-proof

33. 33
• Do we need certificates?
• Do we need digital certificates?
• What about ‘bad actors’ (e.g. bribery)?
• Two-tiered society?
• Incentivise illness?
• Could it be ‘weaponised’?
Too good to be true?
• Private
• Tamper-proof

34. 34
• Manage incentives (i.e. keep it free!)
• Well understood guidelines (e.g. NHS, MRC, ESRC, BBSRC, …)
• Oversight by ethics committee
• 3-monthly review
Ethics

35. 35
Under the hood
+
Demo
(Screenshots from live demo)

36. 36
Functional
modules
Generate/Scan QR
Blockchain Communications
Solid Pod Communications
Maintain Holder/Issuer Accts
Generate DIDS
Generate Verifiable Credentials
Hashes for text/images

37. 37

38. 38

39. 39

40. 40

41. 41

42. 42

43. 43

44. 44

45. 45

46. 46

47. 47

48. 48
COVID-19 Antibody Test / Vaccination Certificates
“There’s an app for that”
Questions & Answers
kmi-events@open.ac.uk
https://blockchain.open.ac.uk/#covid-19
(includes link to video replay)
Special thanks to
Ben Hawkridge, Pasquale Iero, Michelle Bachler, Kevin Quick,
Harriett Cornish, Damian Dadswell

49. 49
Antibody binding to the critical antigens on the outside of the virus can prevent it from infecting a
host cell. Interferon can signal a cell to adopt a virus-resistant state. Once a cell has become infected,
NK cells (NK) and cytotoxic T lymphocytes (Tc) can recognise it and trigger a process of cell death.
A B C D
https://www.open.edu/openlearn/science-maths-technology/biology/how-does-the-human-body-fight-viral-infection
How does the human body fight viral infection? (OpenLearn:
open.edu)

50. 50
Blockchain in 30 seconds 1 of 6
PlainVanilla Ledger
50 75
42 87
“Just a
ledger”

51. 51
Blockchain in 30 seconds 2 of 6
PlainVanilla Ledger
50 75
42 87
PlainVanilla Ledger
###0 ###1
50 75
42 87
“Encode
entire
contents
here”

52. 52
Blockchain in 30 seconds 3 of 6
PlainVanilla Ledger
50 75
42 87
PlainVanilla Ledger
###0 ###1
50 75
42 87
(The code
of the
another
ledger)
“Encode
entire
contents
here”

53. 53
Blockchain in 30 seconds 4 of 6
###0 ###1
50 75
###1 ###2
210 450
###2 ###3
79 5281
PlainVanilla Ledger
50 75
42 87
PlainVanilla Ledger
###0 ###1
50 75
42 87
“Ledger 3
stores the
code of
Ledger 2,
etc.”

54. 54
Blockchain in 30 seconds 5 of 6
###0 ###1
XXX 75
###1 ###2
210 450
###2 ###3
79 5281
PlainVanilla Ledger
50 75
42 87
PlainVanilla Ledger
###0 ###1
50 75
42 87
“Tamper with
one, and the
chain of codes
breaks”

55. 55
*Majority has to agree what’s
good, but no one owns it.
Blockchain in 30 seconds 6 of 6
###0 ###1
50 75
###1 ###2
210 450
###2 ###3
79 5281
PlainVanilla Ledger
50 75
42 87
PlainVanilla Ledger
###0 ###1
50 75
42 87
“Replicate
this chain of
good*
ledgers
around the
world.”

56. 56
Public/private keys
Sender
has
Recipient
has
Signing Sender
private key
Sender
public key
Encrypting Recipient
public key
Recipient
private key

57. 57
Test result
certificate goes
to Solid Pod
EU GDPR ‘Right To Be Forgotten’ 1 of 3
2
FCD3FA34E…
79A6EB94…
Hash

58. 58
Test result
certificate goes
to Solid Pod
EU GDPR ‘Right To Be Forgotten’ 1 of 3
2
FCD3FA34E…
79A6EB94…
Hash
I quit!

59. 59
FCD3FA34E…
79A6EB94…
I’m deleting
my Solid Pod
EU GDPR ‘Right To Be Forgotten’ 2 of 3
Hash

60. 60
FCD3FA34E…
79A6EB94…
Done
EU GDPR ‘Right To Be Forgotten’ 3 of 3

61. 61
FCD3FA34E…
79A6EB94…
Done
EU GDPR ‘Right To Be Forgotten’ 3 of 3 – note ‘orphaned’ hash

62. 62
FCD3FA34E…
79A6EB94…
1
2
Hash
Compare
3
Off-site lab test 1

63. 63
1
FCD3FA34E…
79A6EB94…
2
Off-site lab test 2
3

64. 64
Off-site lab test 3
1
FCD3FA34E…
79A6EB94…
2a
3

65. 65
Off-site lab test 4a
1
FCD3FA34E…
79A6EB94…
2a
3

66. 66
Off-site lab test 4b
1
FCD3FA34E…
79A6EB94…
2a
3

67. 67
Off-site lab test 4c
1
FCD3FA34E…
79A6EB94…
2a
3

68. 68
Off-site lab test 4d
1
FCD3FA34E…
79A6EB94…
2a
‘Supply Chain Logistics’
3
• Pharmacy ID
• Blood sample ID
• Lab ID, location
• Lab technician ID
• Vehicle, driver IDs

69. 69
Off-site lab test 4e
1
FCD3FA34E…
79A6EB94…
2a
2b
‘Supply Chain Logistics’
• Pharmacy ID
• Blood sample ID
• Lab ID, location
• Lab technician ID
• Vehicle, driver IDs
3

70. 70
Off-site lab test 4f
1
FCD3FA34E…
79A6EB94…
2a
2b
‘Supply Chain Logistics’
• Pharmacy ID
• Blood sample ID
• Lab ID, location
• Lab technician ID
• Vehicle, driver IDs
3

71. 71
Off-site lab test 5
1
FCD3FA34E…
79A6EB94…
2a
3
2b
Compare
‘Supply Chain Logistics’
• Pharmacy ID
• Blood sample ID
• Lab ID, location
• Lab technician ID
• Vehicle, driver IDs

72. 72
FCD3FA34E…
79A6EB94…
2a
3
2b
Compare
Off-site lab test - whole life-cycle
‘Good
enough’
 Issuer
 Holder
 IgG > 4.2
‘Supply Chain Logistics’
• Pharmacy ID
• Blood sample ID
• Lab ID, location
• Lab technician ID
• Vehicle, driver IDs
1

73. 73
COVID-19 Antibody Test / Vaccination Certificates
“There’s an app for that”
Special thanks to
Ben Hawkridge, Pasquale Iero, Michelle Bachler, Kevin Quick,
Harriett Cornish, Damian Dadswell
https://blockchain.open.ac.uk/#covid-19
(includes link to video replay)