Users usually receive paper copies of their certified transcripts (showing earned course credits) and degrees (which admittedly look decorative when framed), and they need to make photocopies or scans of those documents to transmit their credentials to other institutions or potential employers. Not surprisingly, fraud abounds, particularly in an increasingly global education and work space. In fact, there are several companies with names like phonydiploma.com, diplomacompany.com, and diplomamakers.com, who openly advertise services to generate fake transcripts and diplomas; the authors did not try to employ these services (or so they say), so no guarantees regarding their efficacy can be given.

To provide higher levels of verifiability, several efforts are underway:

In all of these examples, the credentials need to be verified through third parties, either the issuing institution or other “notarization” entities; an open question is what to do when this verifier vanishes – a lifelong learner requires decades of stability. This is outside the control of the learner, as the mechanism used depends on the issuing institution.

Finally, there are end-to-end confidential data like letters of recommendation for scholarships, awards, and potential employers. A unique feature of these data is that the learner should be able to manage the distribution of these letters, but not be able to see their content. Waving the right to read these letters is often expected by authors (who could otherwise simply refuse to write a letter) and recipients (who put much higher weight on letters with the “waiver”). The letter may also not be replaced with a (potentially) more favorable one. A small sector of industry has developed around managing the workflow of soliciting and distributing these records, for example Interfolio (Interfolio, 2021).

The learner leaves behind a breadcrumb trail of educational data across platforms and institutions, which – due to data protection laws – the prior institutions might even need to purge after certain amounts of time. In addition, due to political or financial instability, educational institutions can vanish over the lifetime of a learner.

Besides transcripts and degrees, there are transactional data (e.g., clickstreams or formative assessment results) from learning platforms, which can be useful for recommender systems, analytics, and quality control. Before making these data useful, they frequently need to be extracted, processed, and compiled from various sources. In any case, as these data are scattered across platforms, no one platform “gets to know” the user.

While a perfect human tutor or mentor would accompany a learner over an extended amount of time and get to know him or her, the status quo is that any kind of AI-mentor would be rather scatter-brained and frequently suffering from memory-loss.

Currently, the learner basically has very little control over his or her data, i.e., lacks sovereignty. The main idea behind the user model presented here is that the learner’s educational experience is one contiguous, lifelong journey, and that the data gathered along the way gets added to one continuous transcript (“ledger”) of achievements, credits, certifications, and degrees, and that the user builds up learning analytics data which enables him or her to take better advantage of each station along the educational journey. These data should be under the control of the user, i.e., he or she should have data self-sovereignty, except in areas where limitations to that control are in his or her advantage to establish trust.

As a result of these challenges, being a lifelong learner is a cumbersome endeavor, as one needs to get just-in-time training and education from a variety of institutions, and needs to proof those credentials to one’s current or potential employers. In the social media realm, some commercial companies are stepping in to give users some way of consolidating credentials and experiences, most notably LinkedIN, which offers brokerage of continuing education and certifications (LinkedIN Learning, 2021) – currently from mostly non-traditional institutions. Targeting more traditional institutions, the concept of a Lifelong Learning Passport was developed (Gräther et al., 2018) – the user model presented here takes a related approach.

When dealing with different players, first of all their identities need to be verified. A highly promising technology is OpenID Connect (OpenID Connect, 2021), which builds on the popular OAuth (OAuth, 2021). OAuth 2.0 is foundational to the increasingly-adopted SWITCH edu-ID (SWITCH edu-ID, 2021), which provides lifelong educational identity management for Swiss educational institutions. OpenID Connect is already in use for the ambitious SwissID project (SwissID, 2021). There are some open questions about the privacy of OpenID Connect, which are currently being researched and addressed at ETH Zurich (Hammann, Sasse, & Basin, 2020). Also, the interplay with the concept of decentralized identities needs to be further explored.

Social Linked Data (SOLID) is a concept of storing data with the user instead of the application or service, under the control of the user (Mansour et al., 2016; SOLID Project, 2021). The user gets to choose which data they release to which platforms, i.e., the user has self-sovereignty over his or her data.

In particular, learner data would not (at least not permanently) be stored in the Next Generation LMS. The user would need to provide their own data “pods,” in which his or her data are stored. Pods can be hosted anywhere on the web under the control of the user; in particular, companies offer hosting of “pod space,” but this function could also be carried out by non-profit organizations or tech-savvy users themselves (e.g., from a server in their basement).

SOLID is not so much a “technology,” since it relies on standard webserver functionality, but rather a philosophy with associated protocols. It is key to the user model proposed here, but for the user, it is not limited to that – they could also use their pods to plug into online stores or social media, if the associated applications or services talk SOLID. On the SOLIDified web, the pods are the users, with which they would buy groceries and take courses. Considering the next generation of learning management systems, when a user applies to or enrolls at an institution, he or she makes their own educational data selectively available, and the platform would start interacting with the data inside the pod.

Authentication and identity management in SOLID is handled using OpenID Connect. The possible creation of fake identities (particularly problematic in countries like Germany where some exams can be “failed for life”) will need to be addressed at this level, in the same way as it is increasingly addressed today. Data access authorization is handled within the data pods and thus under the control of the learner.

SOLID provides some data formats, but mostly aims to develop application-specific formats as a community effort, using the concept of “vocabularies” (SOLID Vocabularies, 2021). For educational data, a new vocabulary (basically an ontology) would need to be developed.

Unfortunately, only the personal and portfolio data are immediately compatible with the SOLID concept: personal information falls into the realm of OpenID Connect, and portfolio data falls exactly into the class of data that SOLID was designed for: identifiable, non-confidential, and usually not subject to fraud short of plagiarism. For other types of educational data, however, the control of learners over their data – also in their own interest – needs to be limited: some of it they should not be able to modify themselves (e.g., bestow a Ph.D. on themselves or change their grade in Calculus 1), and some of it they cannot even see (e.g., end-to-end confidential letters of recommendation). Thus, the user should only have control over who can access their data and how, but not necessarily over the content of the data. Other technologies need to be used to accomplish this apparently impossible feat: establish trust in an inherently untrustworthy environment. Particularly with a server in their own basement, learners could otherwise easily read and manipulate anything.

To establish trust, the second key technology in this user model is that of a federated blockchain. Combining Personal Data Storage and blockchains has been suggested previously (e.g., Yan, Gan & Riad, 2017) to serve as “notary,” Blockchains are usually associated with cryptocurrencies, energy-consuming Proofs-of-Work, and global entities like Ethereum (Ethereum, 2021), but none of that is needed here; a federated blockchain, for example using Hyperledger Fabric (Cachin, 2016), and simple Proof-of-Stake will do.

Educational institutions would be the peers in this federation, each holding copies of the blockchain. While “federating” a number of schools, colleges, and universities might seem like herding cats, in a small country, like for example Switzerland, with mostly non-competing institutions, this just might be possible. While on the one hand, at least initially, there might be too few peer nodes to form a minimum effective blockchain, on the other hand, initially mutual distrust among institutions might not yet be an issue.

It is important to emphasize that not all educational institutions that a learner visits need to be part of the federation; actually, that would be illusionary. Thus, the list of “Players” in Section 3 includes external educational institutions. It is crucial, however, that there is a trust relationship between the external player and the federation: the external institution would need to trust the federation to guarantee (“notarize”) trustworthy records, and the federation would need to allow the external institution to register and record transcript data. This, however, is no different from current trust relationships when it comes to accepting transfer credit or conducting study abroad or study away programs.

The learner’s transcript itself should not be in the blockchain, since not all peers in the federation should have access – that access would be selectively granted by the learner (as expected by the SOLID paradigm). Instead, the blockchain stores the fact that a learner received a new transcript entry and the cryptographic hash of that entry.

Table 2 shows an example of a simplified transcript for a user Carlos, as it would be stored in his data pod. In a real application, institutions and users would have unique IDs, and data might be structured rather than in table format, and it may have attachments, such as a PDF version of certificates. As in a ledger, the entries are time-ordered, where later entries supersede earlier ones. For example, in Table 2, the 2000 grade in “Intro to Biology” replaces the failing 1999 grade. However, just like in normal transcripts, past entries are never deleted.

The entries in this transcript have IDs, and the user-ID and hash of the entries (including possible attachments) are stored in a blockchain, which is hosted by the federated institutions; Table 3 shows an example. Thus, at any point in time, all federated institutions can verify the correctness and completeness of a transcript which a learner made available to them, but cannot see or reconstruct a transcript that the learner did not give them access to. The mechanism is robust against an institution dropping out of the federation.

In order to attend an institution, the learner also must give that institution the right to add to his or her transcript, at which point also new entries are added to the federated blockchain. The requirement of “write permission” might be perceived as an infringement on data selfsovereignty, but it is necessary particularly in countries and university systems where examinations can be failed “for good” – the completeness of the record needs to be guaranteed for better or worse. In a variation or extension of the user model, whenever an entry gets added, the current blockchain could be copied to the user’s pod – this would, in principle, allow every user for themselves to verify their own transcript and the integrity and completeness of the blockchain (in case they do not trust the federation).

If authors could be expected to own data pods, confidential recommendation letters would most easily be stored with them. A mechanism would then need to be implemented for the user to release the letter to others. However, such a mechanism would be very much in conflict with the philosophy of SOLID to control one’s own data: both for the user, who could for example not delete the letter, and for the author, who would need to grant another user the right to release data from his or her own pod – rightly so, SOLID has no protocols for that.

Thus, to stay within the philosophy of SOLID, the letter should be inside the pod of the user, but undecipherable and unalterable for him- or herself. In keeping with SOLID, the user can selectively grant access or even delete the letter, but without knowing its content. That pod, however, is pure data storage with access control; it cannot carry out any computational tasks, like for example establish encryption keys – and even if it could perform encryption computations, one could not trust the results, since the pod is completely under the control of the user.

As a consequence of these limitations, encryption needs to be handled by the learning management system. Having only one actor as a central clearinghouse means that a lot of trust has to be bestowed on this platform, but also that it makes no sense to deploy overly complicated encryption mechanisms. The process clearly has vulnerabilities, for example the user somehow managing to send the letter to themselves, but this is similar to the vulnerabilities of currently deployed systems.