We saved and cellared some Pumpkin yummies for this week! Lots of people like Pumpkin beer, but many folks don't like their early release dates. We think the style is perfect for October weather. Some of these are spiced like the pumpkin beers you know and love…others are made with pumpkin but no "pie " spices. These will be tapped 1 per day with the hopes that most will still be on tap by the weekend.
Pumpkin Carving contest! Drop off all week & judging on Friday Oct. 23rd. Winner does not need to be present to win, just make sure we have your contact info! Yes, we will be keeping the pumpkins.
This was tons of fun when we did it a few years ago. We will give a 1st place prize of a $50 Avenue Pub Gift Certificate and a second place prize of $25 Gift Certificate. Just bringing in in a carved pumpkin and leaving it at the pub this week will get you your first pour of a pumpkin beer free!


text:
Home > Brain and Mind Institute > Brain and Mind Institute Researchers' Publications > 16
Brain and Mind Institute Researchers' Publications
Keeping time in the brain: Autism spectrum disorder and audiovisual temporal processing.
Ryan A Stevenson
Magali Segers
Susanne Ferber
Morgan D Barense
Stephen Camarata
Mark T Wallace
Autism Res
A growing area of interest and relevance in the study of autism spectrum disorder (ASD) focuses on the relationship between multisensory temporal function and the behavioral, perceptual, and cognitive impairments observed in ASD. Atypical sensory processing is becoming increasingly recognized as a core component of autism, with evidence of atypical processing across a number of sensory modalities. These deviations from typical processing underscore the value of interpreting ASD within a multisensory framework. Furthermore, converging evidence illustrates that these differences in audiovisual processing may be specifically related to temporal processing. This review seeks to bridge the connection between temporal processing and audiovisual perception, and to elaborate on emerging data showing differences in audiovisual temporal function in autism. We also discuss the consequence of such changes, the specific impact on the processing of different classes of audiovisual stimuli (e.g. speech vs. nonspeech, etc.), and the presumptive brain processes and networks underlying audiovisual temporal integration. Finally, possible downstream behavioral implications, and possible remediation strategies are outlined. Autism Res 2016, 9: 720-738. © 2015 International Society for Autism Research, Wiley Periodicals, Inc.
This is the pre-peer reviewed version of the following article:
Stevenson, R. A., Segers, M., Ferber, S., Barense, M. D., Camarata, S., & Wallace, M. T. (2015). Keeping time in the brain: Autism spectrum disorder and audiovisual temporal processing. Autism Research. DOI: 10.1002/aur.1566
which has been published in final form at https://onlinelibrary.wiley.com/doi/full/10.1002/aur.1566. This article may be used for non-commercial purposes in accordance with Wiley Terms and Conditions for Use of Self-Archived Versions.

redpajama_set_name: RedPajamaCommonCrawl


Mt Hutt College "Good Citizenship" Award Honours Board in the College Assembly Hall.
The Methven Masonic Lodge presents a "Good Citizenship" award at every Mt Hutt College Prize Giving each year. Besides awarding the Freemasons "GOOD CITIZENSHIP" awards the Midland District #28 Freemason's MUSIC award to a Mt Hutt College student is presented also.
The Methven Masonic Lodge "GOOD CITIZENSHIP" Awardees for 2018 from Mt Hutt College: CHRISTOPHER SPITTAL and HINE WAIREPO – Congratulations to you both.
Winner of the Midland District #28 Music Award to a Mt Hutt College student for 2018 was: SIMON HARFORD – Congratulations.
The Methven Masonic Lodge "GOOD CITIZENSHIP" Awardees for 2017 from Mt Hutt College: TOM SEXTON and HEIDI CUTTLE – Congratulations to you both.
Winner of the Midland District #28 Music Award to a Mt Hutt College student for 2017 was: DYLAN TAYLOR – Congratulations.
The region's students who have previously won the awards are listed below on a special Mt Hutt College Honours Board above – it would be interesting to know how each of these students are doing today. One award is given to a senior Girl and a senior Boy each year.
The Methven War Memorial at the entrance to the Methven Primary School.
Each year at the same time as the Bursary presentations, the Methven Masonic Lodge #51 also donates a sum to the Methven Primary School and The Lady of The Snows School, to a fund to assist children who otherwise would not be able to pay their way for funding their part in special or extracurricular events.
The Recipient of the Mt Hutt College Methven Freemason's University Bursary for 2018 was Aimee Elliott from Winchmore. Aimee will prove an excellent recipient of this bursary. She is studying at the Waikato University in Hamilton. Lodge Master Peter Rusbatch accompanied with George Currie made the presentation to Aimee.
Benjamin Todd receiving his Bursary from our Master Christopher Cayanan.
Anna Ikenaga receiving her bursary from our Master Christopher Cayanan.
2017 Bursary 2 presentations to Benjamin Todd and Anna Ikenaga (both centre) and their families.
Chris Murphy Principal of the Methven Primary School School receiving the Lodge's donation for assisting under privileged children.
Pattie Ree Acting Principal of Our Lady of the Snows School receiving the Lodge's donation for assisting under privileged children.
2016 Bursary Presentations: BACK ROW; Tony Lamb Principal O.L.S. Primary School, Frank Sandys, Annah Casey-Solly, Quintin Pannett, Peter Rusbatch, Chris Murphy Principal Methven Primary School, Richie Palis, Glenn Rodrigo. FRONT ROW; Chris Cayanan, George Currie Master Methven Lodge, Brooke Sandys, Mikaeli Lalor, John Kinvig Midland District Grand Master, Edsel Fernandez, Leo Mario. Absent; Coral Hickman.
Back Row: VW Bro Ray Gudex DC; Tony Lamb Principal of Our Lady of the Snows Primary School; Bursary recipients, Joshua Marr; Jacob Jenkins and Thomas Brown. Front Row: W Bro George Currie Lodge Master; W Bro Donald Smith Lodge Dep Master; Bursary recipients, Victoria Rogers; Cory Blackburn; Ashleigh Pannett; Irene Anderson; Ella McKendry; W Bro Peter Rusbatch Lodge IPM; Chris Murphy Principal of Methven Primary School and W Bro Bob Frame Lodge Treasurer. Absent in Japan was Kenji Boekholt, and his mother Hiromi received the bursary for him.
The Methven Masonic Lodge #51 hold their annual presentation of Bursaries in the month of February to selected students who have just left Mt Hutt College and now going onto higher education and training to assist them in moving into their chosen occupation with good qualifications around them. The Methven Masonic Lodge hopes that their small contribution to each one will help them achieve their goals. The recipients, who on receiving their bursary, speak on how they would apply them in pursuit of achieving their desired life occupation.
Also included in the evenings presentation is a donation to each of the two local Primary Schools. This contribution goes to a fund to assist children's families, who find it difficult to find funds for additional school events when asked for funds for them.
MT HUTT COLLEGE, METHVEN. Recipients of Annual "Good Citizenship" Awards to the Appointed Senior Girl and Senior Boy at the end of Year Prize Giving. – EDUCATION – Plus in the New Year Selected Bursaries are Offered to Those Leaving for University Studies – EDUCATION Again.


text:
B.C.'s booming bio-economy built on decades of innovation
Decades of ideas and innovation support the evolution and ground-breaking work of the life sciences sector today
October 6, 2022, 10:00 am | By Tyler Orton
The promise and potential of greener supply chains
Talk, some action and a lot of opportunity to decarbonize local and global supply chains
August 12, 2022, 6:00 am | By Albert Van Santvoort
B.C. moves toward values-based trade strategy
The province's new trade diversification plan prioritizes partnerships where values align
August 9, 2022, 3:00 pm | By Chuck Chiang
Decarbonization drives new export markets for B.C.
LNG, wood pellets, critical minerals, ammonia exports driven by climate change policies
August 9, 2022, 6:00 am | By Nelson Bennett
Cybersecurity threat looms large over global supply chain
Escalation of cyberattacks threatens to cause massive supply chain disruptions
August 8, 2022, 12:45 pm | By Timothy Renshaw
The growth potential of B.C.'s agri-tech sector
Failing to nurture and support the sector is a significant lost opportunity
December 14, 2021, 6:30 am | By Denise Mullen
The quest for cleaner fuel
B.C. cleantech primed to power industry's decarbonization
December 8, 2021, 6:00 am | By Nelson Bennett
Retail's technology edge
Augmented reality, advanced e-commerce among innovations fuelling sales for retailers
December 8, 2021, 6:00 am | By Glen Korstrom
Tech compensation is in a pressure cooker
Remote work, heightened competition for talent and 'the great resignation' create perfect storm for unique compensation market
December 7, 2021, 1:30 pm | By Stephanie Hollingshead
Tracking B.C.'s unicorn surge
Companies valued at US$1B or more are becoming commonplace in the province
December 7, 2021, 1:30 pm | By Tyler Orton


text:
Home Celeb Gossip/News	How the Victoria's Secret Fashion Show is Changing in 2019
Celeb Gossip/NewsPop Culture & Celebs
by Sophia-Rose Delaney June 15, 2019
by Sophia-Rose Delaney June 15, 2019 0 comment
The Victoria's Secret Fashion Show has long held a place in our hearts. You've more than likely had your television set to record the spectacular event year after year, and you're not alone. Every winter millions of viewers enjoy the styles and performances of famed celebrities and models.
The beloved brand has been a behemoth in the lingerie industry for years, that is until 2018 brought one loss after the next.
Last year Victoria's Secret saw more declining sales than ever before. Public frustration voiced that the brand's marketing techniques lacked inclusivity. Then, shortly after a sad but true interview, their Chief Executive Marketing Officer resigned.
More loss struck when Victoria's Secret also had to close more than 50 stores as a result of the marketing issue. Finally, their losses were apparent when the 2018 fashion show only saw 3.3 million viewers, as opposed to the whopping 5 million in 2017.
What does this mean for supermodels Candice Swanepoel, Adriana Lima, Alessanda Ambrosio, and countless others? Unfortunately only more bad news.
The history of the iconic fashion show
Millions of people love the iconic fashion people, few know the true history of where it came from, but understanding it makes recent losses even harder to accept.
The show began at a hotel plaza in New York in 1995. Models wore next to nothing in their slips and satin bras, but this barely compares to the brightly-coloured costumes and elegant wings that grace the stage today.
The phenomenon quickly grew. Lighting improved, performances were added and the fashion changed immensely. Costumes exploded on the stage and wings were first introduced in 1998 because what's an angel without wings anyway? By 1999 the wings had it, and ever since they've only gotten bigger, and bigger, and BIGGER. There's no doubt you've seen some of the hottest supermodels such as Heidi Klimt and Tyra Banks rock the stage with some of the biggest wings you've ever seen.
In the last decade, props, capes, and heels have been highly decorated, but the wings remain. In addition, the underwear has gotten even more expensive. In 2014, fantasy bras were introduced and Alessandra Ambrosio and Adriana Lima featured bras valued at $2 million. The stage has also been a showcase for positive change and hopes during some of the world's greatest tragedies.
Clearly, this fashion show is more than just a show, but it has always featured one image and one kind of "it" girl. So perhaps it is time that the show takes a new direction.
Not meant for television
We're not sure if the new direction of the fashion show is specifically in light of the negative events in 2018, or a change that has long been coming. However, like everything else in the world, the time for change has come.
The inside scoop came from Victoria's Secret's Chief Executive. She announced that they have decided to rethink the classic fashion show, specifically stating that television just isn't the right fit anymore.
This comes as quite a surprise since the brand has been entertaining television since 1995, but Victoria's Secret indicates that a new kind of event with a different agenda is on the horizon. Potentially the event could even feature different platforms. Sad as it may be for many, this could be the best solution for everyone.
2019 fashion show cancelled
In case you didn't quite get that, the 2019 Victoria's Secret Fashion Show IS cancelled. No longer airing on television and rethinking a new kind of event is code for, no fashion show this year.
While 1.7 million viewers might be unphased, there are several million others that consider this news a tragedy. Even the models themselves admit this pill is not an easy one to swallow.
One of the primary sources who first revealed the big news was longtime veteran Shanina Shaik. She admitted the news with a heavy heart on The Daily Telegraph. Shaik claimed that the change was difficult since usually, she would be training around this time. The model did end on a supportive note, however, stating that she trusts in the direction of the brand since it is in fact the best show in the world.
The fashion show will no longer air on television, effective immediately, which means the show won't go on – at least while Victoria's Secret is working on a new event.
As far as the future timeline goes, will the runway be reopened again next year? In 2021? The answer isn't clear, but surely we will all be patiently awaiting the show.
Sophia-Rose Delaney
Death and a Pup: How Joe Jonas and Sophie Turner Handled Their...


text:
\section{Introduction}\label{sec:intro}

The current trend in enterprise blockchain industry is to create \textit{minimum viable ecosystems} for business consortia, i.e., limited business processes managed by permissioned blockchain networks that are built on diverse distributed ledger technologies (DLTs)~\cite{fabric, corda}. This has fragmented the wider blockchain ecosystem, producing isolated networks with data and assets in silos~\cite{abebe2019enabling}. But these networks have compelling reasons to interoperate while remaining operationally independent for privacy and logistical reasons. For example, an exported good that is financed on a trade finance network~\cite{wetrade, marcopolo} may be tracked on a separate provenance network~\cite{ibmfoodtrust} or a trade logistics network~\cite{tradelens}, while the traders' identities are attested on a shared KYC (Know Your Customer) network~\cite{kyc}. Such cross-network operations should be as trustworthy as transactions within those networks.
The problem of transferring or exchanging assets across networks is well-studied, especially in the context of permissionless networks~\cite{htlc, tesseract, herlihy2018atomic, xclaim}. We focus instead on the data sharing problem, that is, the transfer of data recorded in the ledger of one permissioned network to the ledger of another. To prevent fraud, the information must be accompanied by proof of veracity and provenance, as there is no guarantee that parties interested in it will be privy to both the ledgers.

\begin{figure}
\centering
 \includegraphics[width=0.35\textwidth]{fig/high-level-protocol.pdf}
 \caption{Generalized Cross-Network Data Transfer Protocol}
 \label{fig:high-level-protocol}
\end{figure}

Though several schemes exist for data sharing with proof, they are typically relevant for permissionless networks~\cite{popow, pegs}, rely on intermediary infrastructure (relay chains)~\cite{cosmos, polkadot}, or use API-level integration between trusted end-points. Because we want networks to remain autonomous and interoperate directly as per need, we base our work on the foundation laid by Abebe \textit{et al}~\cite{abebe2019enabling}. According to their model, as illustrated in the lower half (or \textit{data plane}) of Figure~\ref{fig:high-level-protocol}, a source network receiving an information request applies an access control policy through consensus before generating data and proof, and a destination network accepts the information after validating the proof against a verification policy, again through consensus.
This proof must reflect the \textit{consensus view} of the source network's peers. Though the protocol is agnostic of the nature of proof and policy, the opacity of a permissioned network necessitates some form of \textit{proof-by-attestation}; i.e., the proof must consist of a quorum of network participants' signatures attesting to the veracity of shared data.
But proofs-by-attestation rely on a network's ability to gain some visibility into its counterparty network, to enable its participants to know the identities and certificate chains of the latter's participants so signatures in proofs can be validated. Gaining such visibility is therefore crucial to establish a trust basis for cross-network data sharing. In this paper, we separate the data requests and proof validation concerns from identity concerns by placing them in separate planes of activity (see Figure~\ref{fig:high-level-protocol}). Further, we replace the assumption made by Abebe \textit{et al} that the networks' participants have a priori knowledge of each others' identities and certificates, which is impractical to guarantee, with a generic and pluggable \textit{identity plane} protocol that provides a trust basis for data plane interoperation. In a naive implementation, credentials could be directly exchanged via network proxies, but this is both insecure (reliance on intermediaries) and unsustainable (discovering and exchanging credentials on the fly). Our primary contribution in this paper is the design of a secure distributed identity management infrastructure and set of protocols linking permissioned networks and laying the basis for blockchain interoperation.

To build such infrastructure, we rely on the fact that enterprise blockchain networks are created by mutual agreement among existing real-world organizations possessing digital identities, though their network affiliations are not well-attested outside the network consortia. We handle heterogeneity challenges in sharing and proving identity (credential formats, digital signature algorithms, sharing policies, identity providers) as well as privacy constraints (an organization may wish to reveal its network affiliation for cross-network data sharing while keeping its other attributes and affiliations secret). Our infrastructure enables networks to dynamically discover and sync each others' membership lists and verify the pre-existing identities of participant organizations without mandating a single centralized identity and validation registry (which would undermine the principle of decentralization and constrain the autonomy of interoperating networks). Dynamic changes in network memberships are handled, avoiding situations where non-participants or ex-participants can claim to be present participants of a network (which would result in invalid proofs of data). Finally, our system is agnostic of the DLT on which a network is built (structure, consensus protocol, identity issuance, cryptographic mechanisms).

In Section~\ref{sec:decentralized_group_identity_management}, we elaborate on the challenges and requirements while making the case for building our solution on the open frameworks like decentralized identifiers, verifiable credentials, and DLT-based identity registries. Our solution, built on Hyperledger Indy~\cite{indy} and Aries~\cite{aries}, with its building blocks, architecture, and protocols, are described in Section~\ref{sec:solution}, and a proof-of-concept implementation for Hyperledger Fabric~\cite{fabric} networks is presented in Section~\ref{sec:implementation}. We analyze our system in Section~\ref{sec:analysis} and survey related work in Section~\ref{sec:relatedork} before making concluding remarks in Section~\ref{sec:conclusion}.
\section{Decentralized Group Identity Management}\label{sec:decentralized_group_identity_management}

An identity plane protocol involves distributed management of group identities. This is because a permissioned blockchain network is a collective rather than a unitary entity, deriving its identity from its participants (typically organizations), who may join or leave the network at any time. For privacy and security, such networks are open to outsiders only through invitation, and they manage identities internally in diverse ways, making cross-network identity management a challenge.
For example, in a Hyperledger Fabric network, each participating organization runs one or more \textit{Membership Service Providers (MSPs)} to issue identities and certificates to its peers and clients~\cite{fabric, fabric-msp}. Whereas in a Corda~\cite{corda} network, identity is managed through a hierarchy of certificate authorities (CAs), from a single root CA to one or more doormen CAs down to individual node CAs.

Bridging the identity gap between networks so that they can share data and validate proofs, therefore requires cross-network identity management. This can be done in different ways, but if we wish to let the networks remain autonomous, avoid dependence on centralized identity providers, and preserve blockchain tenets of consensus and distributed trust, we must overcome several technical challenges:

\begin{compactitem}
    \item \textbf{Platform heterogeneity:} networks built on different DLTs have different structures and different procedures for transaction commitment and consensus.
    \item \textbf{Identity management heterogeneity:} DLTs have diverse mechanisms for identity management and use diverse cryptographic algorithms.
    \item \textbf{Lack of common identity infrastructure:} external identity providers for network's participants (members), who may serve as a common root of trust, are themselves diverse (i.e, non-standardized), and there is also no guarantee that two networks will have a common set of identity providers to vouch for the members of both.
    \item \textbf{Privacy:} participants must be required to share only the bare minimum information necessary for interoperation.
    \item \textbf{Security:} outsiders and ex-members should not be able to claim that they belong to a given network; i.e., the integrity of network membership should be guaranteed.

    \item \textbf{Consensus on identity:} registering the identity of a foreign network's member organization in one's ledger creates a shared truth for a network and therefore must be governed through its consensus mechanism.
\end{compactitem}

To address these challenges, and knowing both the nature of permissioned networks and what technologies exist for distributed identity management, we can derive certain design requirements for our solution:
\\
\textbf{Decoupling Participants' Identities from Network:} Identities created within permissioned blockchain networks, e.g. Fabric root certificates, are unknown outside network boundaries. Since interoperation requires identities to be shared and validated externally, and to avoid creating a central authority or spokesperson, identities ought to be independently verifiable by external entities while remaining under the participants' control.
This necessitates the \textit{decoupling} of participants' identities from the networks they belong to. Fortunately, we can rely on the \textit{self-sovereign identity (SSI)} concept~\cite{ssi_inevitable, did}, which allows an entity to control/manage its identity and prove properties about itself while retaining independence from any centralized registry/provider.
\\
\textbf{Decentralized Identity Registries:} To complement SSI (as a means of decoupling), there must exist external registries to facilitate the resolution of network participants' decentralized identities~\cite{did} and the issuance, validation, update, and deactivation of credentials. To aid in mapping SSI to network-specific identity, such registries must maintain publicly accessible credential structures and validation information on behalf of one or more trusted identity-providing or credentialing authorities.
Several \textit{Decentralized Identifier} (DID) registries exist~\cite{didregisteries}, but our use cases ideally require those that are not governed by centralized authorities.
\\
\textbf{Maintaining Network Membership Integrity:} At any given instant, a network's membership list must be unambiguously available to a counterparty network in an interoperation session, and any changes to membership (joins and leaves) must be communicated
using a trustworthy process.
Incorrect membership information, or worse, malicious outsiders and ex-members pretending to belong to a network, will corrupt a data-sharing procedure that relies on proof-by-attestation, because a proof consumer may mistakenly accept an out-of-date (or fake) set of identities and signatures.
Our solution must ensure that the membership information can be
validated though consensus in the receiving network at any given instant.
\\
\textbf{Trust Anchors to Discover and Certify Network Consortia:} Though a permissioned network is a voluntary consortium of independent members, once created, it acquires a life of its own and remains wedded to its identity even if most of the original participants leave. Hence, for a newly-formed network, it is more straightforward to discover its identity and subsequently discover its membership rather than deal with the chicken-and-egg problem of extrapolating a network identity from a group of participants' identities. For discovery, we must rely on reputed \textit{trust anchors} that may either directly represent the consortium or serve as an authoritative reference for it. Examples: Being well-known stakeholders, IBM or Walmart could represent (anchor) the IBM Food Trust Network~\cite{ibmfoodtrust}, whereas Maersk could represent Tradelens~\cite{tradelens}. Such anchors can be implemented with different levels of decentralization; they could be single entities or sets of corroborating entities representing different network participants; they could run their own organizations or belong to shared identity registries, maintaining credentials in shared ledgers. Ultimately, the trust anchor(s) should represent the collective rather than a single network participant to ensure decentralization.
\\
\textbf{Compatibility with Networks' Identity Management Systems:} No identity plane protocol we develop ought to require any internal modifications to underlying blockchain platforms. Though these networks may have to implement additional adapters to manage heterogeneity for interoperation purposes, the internal transaction commitment and consensus processes, which rely on existing certification and cryptographic mechanisms, must be allowed to proceed unchanged. Therefore, our solution
must be simultaneously compatible with existing permissioned DLT identity management systems and agnostic of their specific implementations.

\section{Solution}\label{sec:solution}

We now present a decentralized identity management solution to fulfill the requirements stated in Section~\ref{sec:decentralized_group_identity_management}, and whose development was guided by the following design principles:

\begin{compactitem}
\item The solution should not be tied to, or only applicable for, a particular DLT.
\item Networks and their participants should be free to choose identity registries and providers (or use their existing ones).
\item Networks must retain their autonomy while gaining the ability to interoperate universally.
\item No change should be required in a network's regular operation, nor should it be burdened with onerous additional configurations.
\end{compactitem}

\begin{figure}
	\centering
	\includegraphics[width=0.9\linewidth]{fig/architecture.pdf}
	\caption{Architecture to enable identity plane exchanges}
	\label{fig:architecture}
\end{figure}

\subsection{Building Blocks}
We rely on existing decentralized identity management concepts and tools to serve as building blocks for our solution.

\begin{compactitem}
\item \textbf{Decentralized Identifiers (DIDs)} is a W3C draft~\cite{did} for self-sovereign identity (SSI). A DID is a URI that resolves to a DID Document that contains information about its subject like aliases and pseudonymns. It can contain public keys to authenticate the subject's signature and service endpoints for communication with the subject to obtain verifiable credentials (see further below). We assume each network participant possesses a DID, decoupling its external identity from its network affiliation.

\item \textbf{Verifiable Credentials (VC)} is W3C specification on cryptographic digital credentials based on DIDs, used to certify claims about their holders\cite{vc}, who can then prove their claims to third parties using \textbf{Verifiable Presentations (VP)}.

\item \textbf{Distributed Verifiable Data Registry (VDR)} is a data registry that maintains identity records in a distributed ledger. Examples are Hyperledger Indy~\cite{indy} and Sidetree~\cite{sidetree}. Indy, built on a blockchain network, maintains DID records through consensus. (\textit{Note}: our design will accommodate centralized DID registries too but we recommend Indy-like networks for optimal levels of decentralization.)

\item \textbf{Identity and Credential Messaging} in a platform-neutral and interoperable protocol is required for peer-to-peer exchange of DID records, VCs, and VPs among issuers, subjects and verifiers. An example (though our design can accommodate any equivalent) is the \textit{DIDComm protocol} in \textit{Hyperledger Aries}~\cite{aries}, which facilitates such exchanges with support for encryption using keys and service endpoints stored in registry DID records.

\end{compactitem}

\begin{figure*}[t]
\centering
 \includegraphics[width=\textwidth]{fig/protocol3.pdf}
 \caption{Identity Exchange Protocol}
 \label{fig:protocol}
\end{figure*}

\subsection{Architecture}

Two sets of modules are required to realize an identity plane protocol (Figure~\ref{fig:architecture}) - (i) a set of networks separate from the interoperating networks, collectively called \textit{Distributed Identity Infrastructure}, in which identity and credential records are maintained, and (ii) a set of agents within an interoperating network, collectively called \textit{Network Identity Managers}, each acting on behalf of a participant, syncing and validating identities across network boundaries, and recording foreign identities on the local ledger.

\subsubsection{\textbf{Distributed Identity Infrastructure}}
This is a \textit{cloud} of what we term \textbf{Interoperation Identity Networks (IINs)}, which collectively provide a common root of trust for networks to sync identities and certificates. Each IIN consists of a distributed VDR, which, without loss of generality, is built on a public permissioned ledger allowing open queries but restricting writes to designated \textit{trust anchors} (\textit{see below}). The VDR ledger, shared and maintained by the IIN's pool of nodes through consensus~\cite{indy, aublin2013rbft}, also records verifiable credentials' schemas, authentication keys for credentials' attributes, and revocation lists. Each IIN in our infrastructure cloud enables trustworthy validation of certain networks' memberships by maintaining DID records for their participants and schemas and keys for issuing and verifying credentials.

\textbf{Trust Anchors}: An \textit{IIN} does not have a centralized source of trust. Instead, a trust basis is collectively created by \textit{trust anchors (TAs)}, entities that possess ledger write privileges, allowing them to issue DIDs to entities and maintain DID records on the IIN ledger, and further, issue VCs to DID owners. Some TAs are bootstrapped into an IIN, but any other DID owner can be assigned anchor privileges by an existing anchor too, thereby creating a trust hierarchy. Each TA in an IIN vouches for certain network members' real-world identities and attests to their participation (membership) in interoperating networks. A TA, in effect, is like a conventional identity provider but in our architecture, maintains identity records in a shared ledger with other TAs.

IIN TAs come in two varieties.
\textit{\textbf{Organization identity validators (OINs)}}, who already possess well-known real-world identities, are responsible for associating a network participant's DID with its real-world identity on an IIN ledger (through consensus). (\textit{Note}: The W3C draft proposal does not mandate a DID's automatic association with a real-world or legal identity upon creation~\cite{did,didusecase}, so we need OINs to make such associations explicit.) The presence of a DID record for a network participant with such an association implies that its identity is vouched for by one or more TAs of that IIN.
\textit{\textbf{Participant membership validators (PMVs)}} are responsible for validating the membership of a DID owner in a given permissioned network. Enterprise blockchain networks formed by mutual agreement among its participants have no single central authority that can certify the network's structure or its members. Therefore, proving participation of an organization requires attestation by one or more PMVs, which, like OINs, are reputed in industry or well-known as consortia representatives. For example, either IBM or Walmart, both reputed entities, could act as validators for the membership of the IBM Food Trust \cite{ibmfoodtrust} network, in whose launch and governance they both played key parts.
These trust anchors issue verifiable credentials to participants attesting their network memberships and also revoke them when organizations leave networks.
An organization may hold multiple VCs attesting its memberships in multiple networks. In a cross-network data sharing session, it can construct a VP proving its membership in either counterparty network without revealing its memberships in other networks, thus ensuring privacy \cite{vc}.

\textbf{IIN Artifacts:} the following are maintained on the legder:

\begin{compactitem}
\item \textit{Real-world DIDs} attesting the real-world identity of an organization (network participant).

\item \textit{Membership VC schema and authentication key} - A membership VC for an organization proves its participation in a given network. The VC contains its DID and the name/identity of a network it is a member of as attributes (claims). This \textit{Membership VC schema} is recorded on the IIN ledger, and every organization's VC must adhere to it, though different VCs may use different encodings and cryptographic algorithms. The public key used for authentication of this VC is also recorded on the ledger and used to validate membership claims made by the organization using a VP.

\item \textit{Memberlist VC schema and authentication key} - A memberlist VC consists of a name/identifier for a given network and a list of the network's participants' DIDs as schema attributes. Memberlist VCs are issued by PMVs and used by interoperating networks to fetch each others' list of participants, after which each participant's membership VC can be fetched and validated.

\item \textit{Revocation Registries} - When a blockchain network's member leaves, the \textit{Membership VC} indicating its affiliation with the network must be revoked. We use cryptographic accumulators~\cite{accumulators} as revocation registries, allowing membership presence checks without revealing the entire list of members. Each PMV registers a separate revocation registry on the IIN ledger. This registry is updated when a VC is revoked, and is also looked up by entities validating a verifiable presentation made by a Membership VC holder.

\end{compactitem}

\subsubsection{\textbf{Network Identity Managers}}
These components lie within the trust boundary of a permissioned network, one or more acting on behalf of each participating organization. A network identity manager is responsible for identity-syncing, i.e., (i) presenting its own identity and membership credentials to a foreign network, and (ii) correspondingly validating the membership credentials of a foreign network's members, and fetching and storing their certificates in the local ledger for data plane interoperation. We will henceforth refer to these managers as IIN Agents as they rely on IINs and their trust anchors for discovery and connections with foreign networks.

\textbf{IIN Agent:} This is responsible for registering the real-world DID of a network participant on an IIN and obtaining a Membership VCs from a TA of that IIN. It communicates with IIN Agents of foreign network participants using a confidential web-based channel to prove its own identity and validate their identity and membership claims using VPs.
Furthermore, \textit{IIN Agents} exchange their network-issued identity and certificates using self-signed VPs that can be verified against their real-world DID. Once verified, they configure these certificates in their network's shared ledger through consensus.
This maps an organization's decoupled SSI (real-world DID) to its network-issued identity, which ultimately makes proof verification possible in the data plane for interoperation.

\textbf{Ledger Artifacts:} Each permissioned network maintains the following policy configuration for identity-sharing, trust, and interoperation:

\begin{compactitem}
\item \textit{Interoperation network list:} list of foreign networks with which the local network is willing to interoperate.
\item \textit{Trust list:} IINs and specific TAs within that are trusted for identity and membership validation of foreign networks.
\item \textit{Foreign network identities:} identities of organizations participating in foreign networks and their network-issued credentials (typically certificate chains).
\end{compactitem}

\subsection{Identity Exchange Protocol}
\label{subsec:messageflow}
Figure \ref{fig:protocol} illustrates the steps in our canonical identity plane protocol to discover and sync identity and credentials across an example pair of networks (Network A and Network B) and a single IIN. Here, Org1 and Org2 in Network A are learning about the identity and membership of Org3 in Network B so the networks can share ledger data with each other. Note that by repeating these steps, identity information of any of the other organizations in Network B can be discovered, fetched, validated and configured in Network A.

\textbf{\textit{(A) Configure DID and Membership VC:}} Org3 creates a DID and requests an OIN to attest its identity and register it as a real-world DID.
Once this DID is registered in the IIN, Org3 must get a Membership VC issued to it by a PMV of that IIN. The PMV validates the request using some out-of-band validation procedure, issues the VC, and updates the revocation registry accordingly.
\textbf{\textit{(B) Validate DID \& Membership:}} Before starting the validation process, Org1 and Org2 need to know who the participants of Network B are. Org1 requests a Memberlist VC from the PMV associated with Network B, which returns a self-signed VP. After Network B's participants' real-world DIDs are known, Org1 resolves Org3's DID Document from the IIN ledger. This DID Document contains the service endpoint which is then used by Org1 to request Membership VP from Org3. Org1 then validates the VP received using the Membership VC schema, authentication key, and the revocation list, all fetched from the IIN ledger.
\textbf{\textit{(C) Fetch Blockchain Identity Information:}} Org1 requests Org3 for its network-issued identity and certificates, which Org3 returns in the form of a self-signed VP that is validated against Org3's real-world DID's authentication key.
\textbf{\textit{(D) Update Identity in Ledger:}} Though Org1 now has verified the identities of Org3, it cannot record it on Network A's ledger without a consensus among the network's participants. Therefore, Org2 independently carries out steps (B) and (C) above and endorses Org1's request to commit Org3's identity to the blockchain (using a smart contract transaction). Thus, no single participant of a network can unilaterally manipulate the local record of the identity of a foreign network's participant.

\section{Use Case for Hyperledger Fabric}\label{sec:implementation}

We demonstrate a proof-of-concept implementation of our protocol by augmenting the two-network use case in Abebe et al \cite{abebe2019enabling}. We started with the already developed scaled-down versions of the trade logistics network, TradeLens~\cite{tradelens}, and the trade finance network, We.Trade~\cite{wetrade}, namely \textit{Simplified TradeLens (STL)} and \textit{Simplified We.Trade (SWT)} respectively. Here, each network
runs Hyperledger Fabric peers, membership service providers (MSP), an ordering service, and application (client-layer) components, in Docker containers. Each network was equipped with a relay and two system contracts: Configuration Management and Data Acceptance Chaincode (CMDAC) and Exposure Control Chaincode (ECC).

STL consists of a Seller and a Carrier organization, as illustrated in Figure~\ref{fig:trade-flow-implementation} each running a peer and a CA (serving as MSP). Consignments are created and dispatched in the workflow, with a bill of lading~\cite{billoflading} (B/L) recorded on ledger. SWT consists of a Seller and a Buyer organization, each with 2 peers and CAs, running a letter of credit~\cite{letterofcredit} (L/C) management workflow. SWT application clients include the same Seller that is a member of STL, a Buyer, and the Seller's and Buyer's banks. The interoperation steps are: (1) transfer of L/C from SWT to STL as a prerequisite for consignment creation and (2) transfer of B/L from STL to SWT for payment obligation enforcement.

\begin{figure}[t]
 \includegraphics[width=0.48\textwidth]{fig/trade_flow}
 \caption{Simplified Cross-Network Trade Use Case}
 \label{fig:trade-flow-implementation}
\end{figure}

\subsection{Distributed Identity Infrastructure}
We used Hyperledger Indy to implement an IIN with trust anchors. Though other DID registries and DID providers exist, Indy is the most mature and offers all the features described in Section~\ref{sec:solution}. Indy maintains DID records on a public permissioned ledger shared by a pool of nodes running a consensus protocol~\cite{indy, aublin2013rbft}. Trust anchors called \textit{stewards} are bootstrapped into an Indy network within the genesis block, and these stewards can assign trust anchor privileges to other DID owners too: Indy supports TAs of the OIV and PMV categories out-of-the-box. DID records contain service endpoints, credential schemas, and authentication public keys (called \textit{credential definitions}). Real-world DIDs are called \textit{verinynms} (anonymous \textit{pseudonyms} are also supported), and a TA (OIV) can register a verinym on the Indy ledger using a special \textit{NYM transaction}.
TAs (including stewards) and IIN Agents (\textit{see below}) are implemented using the companion Hyperledger Aries~\cite{aries} framework, which enables confidential peer-to-peer communications among Agents and TAs.

For proof-of-concept, we deployed a single IIN: an Indy network bootstrapped with 4 independent Sovrin stewards~\cite{sovrin}. Two trust anchors were enrolled in the IIN by the stewards: one in the name of IBM to represent the SWT consortium and another in the name of Maersk to represent STL (see Figure~\ref{fig:trade-flow-implementation}). (Note that IBM and Maersk are initiators and major players in the real We.Trade and TradeLens networks respectively, and are therefore realistic sources of trust.) A single IIN with two trust anchors is sufficient to demonstrate operational mechanics in a proof-of-concept; in a production implementation, we will likely have more diversity but the mechanisms used will be identical to what we demonstrate here. The SWT Seller and Buyer register verinyms with, and obtain Membership VCs from, the IBM anchor in the IIN; likewise, the STL Seller and Carrier register and obtain theirs from the Maersk anchor.

\subsection{Fabric Network Organizations and Identity Providers}
In a Fabric network, identity is independently managed within an organization by one or more \textit{membership service providers} (MSPs)~\cite{fabric-msp}, implemented as a set of Fabric CA Servers~\cite{fabric-ca-server} (CA: \textit{Certificate Authority}). Multiple root and intermediate CAs can exist within an organization, creating trust chains. Each peer or transaction-submitting client \textit{enrolls} with an MSP (one of the Fabric CA servers) in their organization to obtain a unique identity and X.509 certificates for transaction signing. Organizations are then linked together on a channel when a configuration block containing their respective MSPs' root and intermediate CA certificates is appended to that channel's blockchain.

Every valid transaction in a block must carry a set of peer signatures that satisfies an \textit{endorsement policy}. Likewise, in a data-sharing instance, any data shared with an external network can only be deemed valid if it carries a set of peer signatures that satisfies a \textit{verification policy}. But proof verification (i.e., signature validation) requires the destination network to possess the source network's organization list and the certificates of its MSPs. Below we show how IIN Agents embedded within a Fabric network enable proof verification by fetching certificates and creating identity records on the ledger using the CMDAC contract.

\begin{figure}[t]
\centering
 \includegraphics[width=0.44\textwidth]{fig/implementation.jpg}
 \caption{IIN Components and Connections for Fabric}
 \label{fig:implementation}
\end{figure}

\subsection{IIN Agents within a Fabric Network}

An IIN Agent represents an organization outside its network, and hence is designed to be an extension of that organization's MSP.
An organization typically uses a single MSP in production, but if multiple MSPs are used, representing organizational units, we can use a different Agents for each.
Logically, the Agent functionality ought to be performed by a Fabric CA Server.
Rather than modifying the Fabric CA code, for implementation and deployment convenience, our IIN Agent is built as a decoupled service exposing an API for communication with IINs (Indy networks), IIN Agents of other local network organizations, and IIN Agents of foreign networks' organizations (see Figure~\ref{fig:implementation}). The IIN Agent also has client privileges and can submit transactions to the CMDAC.

An IIN Agent is composed of three modules. An \textit{Indy Agent} built using with \texttt{indy-sdk}\cite{indy-sdk} is used to connect to an IIN's Indy pool and query DID/credential information. An \textit{Aries Agent}, implemented using \texttt{ACA-Py}\cite{aca-py}, is used to communicate with IIN trust anchors for verinym, VC, and VP requests. It uses DID service endpoints and credential definitions (authentication keys) for encrypted communication. While handling VCs and VPs, the \textit{Aries Agent} calls the \textit{Indy Agent} to fetch/update credential schema and definitions, and revocation lists. The \textit{Controller}, implemented using \texttt{Node.js} orchestrates the identity initialization, exchange and validation flow as described in Section~\ref{subsec:messageflow}. It is responsible for fetching its associated MSP's latest root and intermediate certificates for sharing with foreign networks. These three modules run within a single Docker container. Lastly, an \textit{IIN Fabric Client} application built on the \texttt{Fabric SDK}~\cite{fabric-sdk} updates foreign networks' identities and certificates on the channel ledger using CMDAC transactions. This app, running within its own container, takes transaction requests from the \textit{Controller} and executes an application level signature collection flow (see Section~\ref{subsec:sig-flow}) before invoking the CMDAC.

\subsection{Protocol: Syncing Foreign Identities through Consensus} \label{subsec:sig-flow}

Our protocol implementation follows the steps described in Section~\ref{subsec:messageflow} verbatim except for the final step in which a foreign network's identities are recorded onto the local ledger. This step requires DLT-specific mechanisms, and we will show how they were implemented in Fabric. As an example, we consider the scenario where SWT is trying to fetch and sync the certificates of the Carrier organization in STL.

Recording the STL Carrier's certificates on the ledger creates a shared truth for the entire SWT network, enabling its peers to refer to those certificates in a data transfer session, either for access control or proof verification. Allowing the CMDAC to directly query IINs or foreign networks' agents to fetch these certificates would create a non-determinism hazard. Therefore, we use an application-level flow involving IIN Agents for deterministic invocation of CMDAC.

The SWT Buyer IIN Agent initiates this flow by validating the STL Carrier's Membership VC with the IIN, and subsequently fetches the Carrier's certificates from the  Carrier's IIN Agent (whose service endpoint is part of the Carrier's DID record). The Buyer IIN Agent then sends these certificates to its Fabric Client app, which then prepares a \textit{signature collection request}, and sends it to the Fabric Client of the SWT Seller IIN Fabric Client app. The latter validates the Carrier's certificates after consultation with their own IIN Agents (who have presumably fetched those certificates too), and then counter-signs the request on behalf of its organization. The Buyer aggregates the responses (only one here) and submits it as input in a CMDAC transaction. The chaincode checks for the presence of valid signatures from every SWT organization (here: Buyer and Seller) before approving the update of the STL Carrier's identity state on the ledger. Note that this update is idempotent, and can be carried out concurrently by the IIN Agents of both Buyer and Seller. Also, if the Buyer's and Seller's IIN Agents' copies of Carrier certificates are not in sync, the signature collection flow will fail and must be retried.

This protocol replaces the naive implementation in Abebe et al~\cite{abebe2019enabling} where organizational identities and root and intermediate certificates were fetched out-of-band manually.
The identity plane exchange we have demonstrated makes the process more secure and consensus-based. Further, any changes in organizational memberships or certificate belonging to an organizations can be determined and synced automatically through periodic queries made to the IIN registry (for membership and revocation lists) or whenever a proof validation fails because of expired certificates.

\section{Analysis}\label{sec:analysis}

We now analyse our system's ease of use and extensibility, and discuss its limitations with a view to future improvements.

\subsection{Generality and Flexibility}\label{sec:flexibility}
Our design consists of two distinct sets of components: \emph{1) Distributed Identity Infrastructure} shared by interoperating networks but existing outside them, namely the IINs, and \emph{2) Network Identity Managers} components that lie within networks, namely the IIN Agents. IINs are built using state-of-the-art industry standards (Indy, DID, VC), though the specification is independent of a specific technology.
IIN Agents are DLT-specific and decentralized within a network, lying within the scope of a network's participant/organization. In fact, different organizations may implement their own versions of IIN Agents and replace them independently; an Agent just needs to expose the API we have specified earlier in this paper.

\subsection{Security}
We evaluate the security of our protocol against the standard CIA triad model~\cite{whitman2011}. \emph{Confidentiality:} The DIDs of network participants are themselves public by necessity, as the DID Registry (IIN) is a public permissioned network. But a DID by itself only reveals the existence of an organization that participates in a network without revealing anything else about that organization, like membership information,
which are known only to identity owners and IIN trust anchors. Also, the intra-network certificates are shared point-to-point among IIN Agents on a need basis and are thus kept confidential from everyone outside the interoperating networks.
\emph{Integrity:} Identities are registered in an IIN using a fault-tolerant consensus protocol (Indy typically uses RBFT\cite{aublin2013rbft}), thereby ensuring a high level of integrity. Trust anchors maintaining Memberlist VCs are assumed to have reputations and are trusted by organizations belonging to a consortium; further, identities and VCs are attested by signatures using keys registered in IINs. Integrity violations are therefore unlikely but can be easily detected, allowing organizations to select more trustworthy anchors.
\emph{Availability:} The availability of identity records depends on the size of the IIN; the more the number of nodes in an Indy pool, the higher the availability. An IIN Agent or an IIN Trust Anchor by itself can be a point of failure, but this can be mitigated by adding redundancy.

\subsection{Ease of Extensibility}

\subsubsection{Network Identity Managers}
An IIN Agent runs as part of a network, but only portions of it needs to have a DLT-specific implemenation. Examining the protocol steps in Section~\ref{subsec:messageflow}, we see that step A involves the Agent communicating with IINs and Trust Anchors using a standard API. Similarly, steps B and C involves communication between IIN Agents across network boundaries, again using a standard interface.
Only Step D, which involves updating the local ledger via a smart contract transaction must be DLT-specific. Hence, an IIN Agent can be mostly built using off-the-shelf components. The transaction submission component must be DLT-specific, as was the IIN Fabric Client described in Section~\ref{sec:implementation}. The equivalent of this in Corda would be a CorDapp~\cite{cordapp} and in Hyperledger Besu would be a Dapp~\cite{dapp}.

\subsubsection{Distributed Identity Infrastructure}
Though our IINs are implemented using Indy and IIN trust anchors using Aries, their specifications and interfaces are based on W3C standards for DIDs and VCs and VPs. Therefore, they can easily be ported to other verifiable data registries that follow the same standard (e.g. Sidetree \cite{sidetree}).

\subsection{Limitations}
A trust anchor representing a consortium or unilaterally issuing real-world DIDs to organizations is the only centralized component in our implementation. But further decentralization is possible by requiring more than one TA to vouch for a network participant; e.g., using a smart contract in the IIN. Collaborative models, where TAs (e.g. representing Fabric MSPs) corroborate each other using signatures can also enhance safety and liveness of identity plane protocols.

Decoupling of network participants identities from their IIN identities presents another challenge: syncing the two sets to ensure that networks possess up-to-date info for data plane operations. In general, this only affects liveness and not safety, because proof verification failures can be handled by re-synchronizing identities using strategies like polling to event triggers. While polling may be slightly inefficient from a communication standpoint, it provides a higher level of assurance (depending on the polling interval). Additional watchdogs may be needed to handle all cases, in case of events, in both the identity and data planes.

\section{Related Work}\label{sec:relatedork}

Networks built on Corda~\cite{corda} can transact states representing data and assets with each other via the Corda Network~\cite{cordanetwork}, a global publicly-available
network that uses a common root of trust for identity. Though a
consortium of nodes may optionally choose to deploy a segregated
network with its own trust root for privacy and
confidentiality, it will be unable to communicate directly with
the rest of the global network unless it merges with it.
Unlike our DLT-agnostic architecture, which enables independent segregated networks to interoperate in a privacy-preserving manner without relying on a common network, the Corda Network suffers from a key limitation: it is restricted to the Corda protocol and
doesn't allow integration with other DLT protocols like
Fabric~\cite{fabric} and Besu~\cite{besu}.

In the permissionless domain there are a range of efforts attempting
to address identity which include naming services such as
Ethereum Name Service (ENS)~\cite{ens} and Polkadot's naming system~\cite{polkadotidentity}, as well as a number of solutions
based on the Decentralized Identity Framework such as
uPort~\cite{uPort} and Ontology~\cite{ontio}. However, these systems
are either designed to simplify user experience in public networks,
such as addressing an entity with a user-friendly name instead of an
arbitrary byte string, or to provide a user-facing identity solution
for creating and sharing credentials. These systems don't address the
general problem of resolving and verifying identity issued by
different ledgers for enabling cross-ledger communication.

Hyperledger Cactus~\cite{cactus} leaves networks autonomous and in control of their interactions with other networks, but currently relies on manually sharing network identity information.

To the best of our knowledge, ours is the first attempt at formalizing the separation of proof and identity concerns, and presenting an identity exchange solution (based on SSI) that adheres to blockchain tenets of decentralized trust.

\section{Conclusion and Future Work}\label{sec:conclusion}

Interoperation for data sharing between permissioned blockchain networks running related business processes requires the networks to have the ability to identify each others' participants and validate their claims/proofs. We have described a way of reasoning about such protocols, separating identity concerns from data and policy concerns into a different communication plane. To give networks the ability to prove memberships, cross-validate identities, and share certificates, we have designed a DLT-agnostic architecture and protocols based on self-sovereign identity and verifiable credential concepts. A proof-of-concept implementation was demonstrated, linking two Hyperledger Fabric networks.
This consisted of an identity registry (IIN) built on Hyperledger Indy and agents built on Hyperledger Aries exchanging certificates across network boundaries in a peer-to-peer manner. In the future, we intend to demonstrate compatibility with Corda and Hyperledger Besu, distribute the trust currently invested in IIN trust anchors, and conduct performance evaluations.

\section*{Acknowledgement}
We thank Petr Novotny (IBM T.J. Watson Research Center) for playing a key role in crafting the idea that led to this work.
\section{Solution}\label{sec:solution}

We now present a decentralized identity management solution to fulfill the requirements stated in Section~\ref{sec:decentralized_group_identity_management}, and whose development was guided by the following design principles:

\begin{compactitem}
\item The solution should not be tied to, or only applicable for, a particular DLT.
\item Networks and their participants should be free to choose identity registries and providers (or use their existing ones).
\item Networks must retain their autonomy while gaining the ability to interoperate universally.
\item No change should be required in a network's regular operation, nor should it be burdened with onerous additional configurations.
\end{compactitem}

\begin{figure}
	\centering
	\includegraphics[width=0.9\linewidth]{fig/architecture.pdf}
	\caption{Architecture to enable identity plane exchanges}
	\label{fig:architecture}
\end{figure}

\subsection{Building Blocks}
We rely on existing decentralized identity management concepts and tools to serve as building blocks for our solution.

\begin{compactitem}
\item \textbf{Decentralized Identifiers (DIDs)} is a W3C draft~\cite{did} for self-sovereign identity (SSI). A DID is a URI that resolves to a DID Document that contains information about its subject like aliases and pseudonymns. It can contain public keys to authenticate the subject's signature and service endpoints for communication with the subject to obtain verifiable credentials (see further below). We assume each network participant possesses a DID, decoupling its external identity from its network affiliation.

\item \textbf{Verifiable Credentials (VC)} is W3C specification on cryptographic digital credentials based on DIDs, used to certify claims about their holders\cite{vc}, who can then prove their claims to third parties using \textbf{Verifiable Presentations (VP)}.

\item \textbf{Distributed Verifiable Data Registry (VDR)} is a data registry based on distributed ledger principles to support identity management. Hyperledger Indy \cite{indy} is one such blockchain-based platform that maintains DID records through consensus. (\textit{Note}: our design will accommodate centralized DID registries too but we recommend Indy-like networks for optimal levels of decentralization.)

\item \textbf{Identity and Credential Messaging} in a platform-neutral and interoperable protocol is required for peer-to-peer exchange of DID records, VCs, and VPs among issuers, subjects and verifiers. An example (though our design can accommodate any equivalent) is the \textit{DIDComm protocol} in \textit{Hyperledger Aries}~\cite{aries}, which facilitates such exchanges with support for encryption using keys and service endpoints stored in registry DID records.

\end{compactitem}

\begin{figure*}[t]
\centering
 \includegraphics[width=\textwidth]{fig/protocol2.pdf}
 \caption{Identity Exchange Protocol}
 \label{fig:protocol}
\end{figure*}

\subsection{Architecture}

Two sets of modules are required to realize an identity plane protocol (Figure~\ref{fig:architecture}) - (i) a set of networks separate from the interoperating networks, collectively called \textit{Distributed Identity Infrastructure}, in which identity and credential records are maintained, and (ii) a set of agents within an interoperating network, collectively called \textit{Network Identity Managers}, each acting on behalf of a participant, syncing and validating identities across network boundaries, and recording foreign identities on the local ledger.

\subsubsection{\textbf{Distributed Identity Infrastructure}}
This is a \textit{cloud} of what we term \textbf{Interoperation Identity Networks (IINs)}, which collectively provide a common root of trust for networks to sync identities and certificates. Each IIN consists of a \textit{verifiable data registry} built on distributed ledger principles. A canonical IIN in our architecture is implemented as a Hyperledger Indy network, a public permissioned ledger allowing open queries but restricting writes to designated \textit{stewards} and \textit{trustees} (possessing \textit{trust anchor} roles). Indy maintains \textit{credential schemas}, \textit{credential definitions} (public keys for authentication), and revocation lists on its ledger through consensus among a pool of nodes~\cite{indy, aublin2013rbft}. In our scenario, an IIN built on Indy enables trustworthy validation of networks' and their participants' characteristics by maintaining DID records for network participants, and artifacts for supporting verifiable credential issuance and validation.

\textbf{Trust Anchors}: An \textit{IIN} does not have a centralized source of trust. Instead, a trust basis is collectively created by \textit{trust anchors} (stewards and trustees in Indy), entities that possess ledger write privileges and which can issue DIDs and verifiable credentials to users. In our scenario, trust anchors validate network members' real-world identity as well as their participation (membership) in interoperating networks.
An IIN trust anchor can be one of two types:
\textit{\textbf{(a) Organization identity validators:}} These anchors are responsible for associating DIDs of network participants  with their real-world or legal identities. The open (W3) standard for a DID does not mandate such an association~\cite{did,didusecase}, and only creating a DID does not inherently tie it to a legal identity. Indy supports the registration of such identity associated DIDs (called \textit{verinyms} in Indy parlance) by trust anchors possessing \textit{steward} or \textit{trustee} roles~\cite{indy-transactions}. These anchors, or organization identity validators, are expected to already possess well-known real-world identities. A participating organization in a network can register a verinym using a \textit{NYM transaction}, with a record getting created in an IIN ledger after the IIN node pool achieves consensus. The existence of a verinym record for a network participant implies that its identity is attested by one or more trust anchors of that IIN.

\textit{\textbf{(b) Participant membership validators:}} Verification of a  \textit{verinym} only attests the real world identity of an organization, but does not validate its membership in any permissioned blockchain network. Enterprise blockchain networks formed by mutual agreement among its participants have no single central authority that can certify the network's structure or its members. Therefore, proving participation of an organization requires attestation by one or more reputed trust anchors,which we call \textit{participant membership validators}, which like the \textit{organization identity validators} are reputed in industry or well-known as consortia representatives. For example, either IBM or Walmart, both reputed entities, could act as validators for the membership of the IBM Food Trust \cite{ibmfoodtrust} network, in whose launch and governance they both played key parts.
These trust anchors issue verifiable credentials to participants attesting their network memberships and also revoke them when organizations leave networks.
An organization may hold multiple VCs attesting its memberships in multiple networks. In a cross-network data sharing session, it can construct VPs proving its membership in the network that is participating in the data sharing protocol without revealing its memberships in other networks, thus ensuring privacy \cite{vc}.

\textbf{IIN  Artifacts:} Artifacts maintained in an IIN's ledger are:

\begin{compactitem}
\item \textit{Verinyms} attesting the real-world identity of an organization (network participant).

\item \textit{Membership VC} - Attests the participation of an organization in a certain blockchain network. The VC contains the organization's DID, and the name/identity of a network it is a member of, as attributes (claims). This \textit{Membership VC schema} is recorded on the IIN ledger, and every organization's VC must adhere to it, though different VCs may use different encodings and cryptographic algorithms. Corresponding to the schema is a \textit{Membership VC Definition}, or a public key, which is also recorded on the ledger and used to validate membership claims (verifiable presentations) made by a holding organization.

\item \textit{Memberlist VC} - This consists of a name/identifier for a given network and a list of the network's participants' DIDs as schema attributes. Memberlist VCs are issued by participant membership validators, and are used by interoperating networks to fetch their counterparty networks' list of participants, after which each participant's membership VC can be fetched and validated.

\item \textit{Revocation Registries} - When a blockchain network's member leaves, its \textit{Membership VC} indicating affiliation with the network must be revoked. We use cryptographic accumulators~\cite{accumulators} as revocation registries, allowing membership presence checks without revealing the entire list of members. Each \textit{Membership VC} issuer registers a separate revocation registry on the IIN ledger. This registry is updated when a VC is revoked, and is also looked up by entities validating a verifiable presentation made by a Membership VC holder.

\end{compactitem}

\subsubsection{\textbf{Network Identity Managers }}
These are components that run within the trust boundary of a permissioned network, one or more acting on behalf of each participating organization. A network identity manager is responsible for identity-syncing, i.e., (i) presenting its own identity and membership credentials to a foreign network, and (ii) correspondingly validating the membership credentials of a foreign network's members, and fetching and storing their certificates in the local ledger for data plane interoperation. We will henceforth refer to these managers as IIN Agents as they rely on IINs and their trust anchors for discovery and connections with foreign networks.

\textbf{IIN Agents:} An \textit{IIN Agent} is the identity managing component of a participant that creates its DID, registers it as verinym, and obtains Membership VCs from trust anchors in the IIN. It communicates with IIN Agents of foreign network's participants to present its own identity, as well as validate their identity and membership claims through VPs.
More importantly, the \textit{IIN Agents} exchange their  blockchain specific identity and certificates as a self signed VPs that can be verified against their verinym. Once verified, they configure these certificates in their network's shared ledger through consensus.
This maps the decoupled SSI of the participants to their network specific identity, which ultimately makes proof verification possible in the data plane for interoperation. The inter IIN Agent exchanges can be implemented using the Aries DIDComm protocol \cite{aries} that enables confidential peer-to-peer communications.

\textbf{Interoperating Network Ledger Artifacts:} Each permissioned network must have a shared configuration detailing its policies on identity sharing, trust, and interoperation.
This configuration is expressed using the following ledger artifacts exposed through the \textit{configuration management system contract}~\cite{abebe2019enabling}:

\begin{compactitem}
\item \textit{Interoperation network list} - list of foreign networks to interoperate with.
\item \textit{Trust list} - which IINs to trust for identity and membership validation, as well as the trust anchors to use for specific interoperating networks.
\item \textit{Foreign network identities} - identities of participants (organizations/units) of foreign networks and their in-network credentials (typically certificate chains).
\end{compactitem}

\subsection{Identity Exchange Protocol}
\label{subsec:messageflow}
Figure \ref{fig:protocol} illustrates the steps in our canonical identity plane protocol to discover and sync identity and credentials across an example pair of networks (Network A and Network B) and a single IIN. Here, Org1 and Org2 in Network A are learning about the identity and membership of Org3 in Network B so both networks can interoperate for data-sharing. It is to be noted that by repeating the same steps, identity information of any of the other organizations in Network B can be discovered, fetched, validated and configured in Network A.

\textbf{\textit{(A) Configure DID and Membership VC:}} Org3 creates a DID, and  requests an organization identity validator to attest its identity and register it as a verinym.
Once the verinym is registered in the IIN, Org3 has to get a Membership VC issued to it by suitable trust anchors. For that it requests one or more such membership validators who issue Membership VC with Org3 as the holder, and also updates the revocation registry to mark it as valid.
\textbf{\textit{(B) Validate DID \& Membership:}} Before starting the validation process, Org1 and Org2 need to know who the participants of Network B are. Org1 requests Memberlist VC from the membership validator, which returns a self signed VP. After the participants' DIDs of Network B are known, Org1 resolves Org3's DID Document from the Indy ledger.  This DID Document contains the service endpoint which is then used by Org1 to request Membership VP from Org3. Org1 then validates the VP received using the Membership VC schema, definition, and the revocation list, all fetched from the Indy ledger.
\textbf{\textit{(C) Fetch Blockchain Identity Information:}} Org1 requests for blockchain identity artifacts (certificates), which are provided by Org3 in the form of a self signed VP that is validated against Org3's DID keys.
\textbf{\textit{(D) Update Identity in Ledger:}} Though Org1 now has verified the identities of Org3, there has to be some consensus among Network A's participants before this information is stored in the local ledger. Therefore, Org2 independently carries out steps (B) and (C) above and endorses Org1's transaction request to commit Org3's identity to the blockchain. Thus, no single party can unilaterally control the local representation of the identity of remote organizations.

\section{Use Case for Hyperledger Fabric}\label{sec:implementation}

We demonstrate a proof-of-concept implementation of the protocol by augmenting the two-network use case in Abebe et al \cite{abebe2019enabling}. We started with the already developed scaled-down versions of the trade logistics network, TradeLens~\cite{tradelens}, and the trade finance network, We.Trade~\cite{wetrade}, namely \textit{Simplified TradeLens (STL)} and \textit{Simplified We.Trade (SWT)} respectively. Here, each network is a set of Docker containers
running Hyperledger Fabric peers, membership service providers (MSP), and an ordering service; application or client-layer components were also containerized. Further, each network was equipped with a relay and two system contracts: Configuration Management and Data Acceptance Chaincode (CMDAC) and Exposure Control Chaincode (ECC).

STL consists of a Seller and a Carrier organization, as illustrated in Figure~\ref{fig:trade-flow-implementation} each running one peer and one CA (serving as MSP). Consignments are created and dispatched in the workflow, with a bill of lading~\cite{billoflading} (B/L) recorded on ledger. SWT consists of a Seller and a Buyer organization, each with 2 peers and CAs, running a letter of credit~\cite{letterofcredit} (L/C) management workflow. SWT application clients include the same Seller that is a member of STL, a Buyer, and the Seller's and Buyer's banks. The interoperation steps are: (1) transfer of L/C from SWT to STL as a prerequisite for consignment creation and (2) transfer of B/L from STL to SWT in order to enforce payment obligation.

\begin{figure}[t]
 \includegraphics[width=0.48\textwidth]{fig/trade_flow}
 \caption{Simplified Cross-Network Trade Use Case}
 \label{fig:trade-flow-implementation}
\end{figure}

\subsection{Fabric Network Organizations and Identity Providers}
We briefly describe how identity is managed within a Hyperledger Fabric network, which is a consortium of \textit{organizations} maintaining one or more \texttt{channels} (shared ledgers). Identity is independently managed within an organization by one or more \textit{membership service providers} (MSPs)~\cite{fabric-msp}, implemented as a set of Fabric CA Servers~\cite{fabric-ca-server} (CA: \textit{Certificate Authority}). Multiple root and intermediate CAs can exist within an organization, creating trust chains. Each peer or transaction-submitting client \textit{enrolls} with an MSP (one of the Fabric CA servers) in their organization to obtain a unique identity and X.509 certificates for transaction signing. Organizations are then linked together on a channel when a configuration block containing their respective MSPs' root and intermediate CA certificates is appended to that channel's blockchain.

Every transaction in a block must carry a set of peer signatures (according to an \textit{endorsement policy}) to be valid. Likewise, in our data-sharing interoperation protocol, any data shared with an external network can only be deemed valid if it carries a set of peer signatures that satisfies a \textit{verification policy}. But proof verification (i.e., signature validation) requires the destination network to possess the source network's organization list and their respective MSPs' certificates. It is here that IIN Agents play a key role, fetching certificates and creating identity records on the ledger using the CMDAC . Let us see how these agents are incorporated in a Fabric network.

\begin{figure}[t]
\centering
 \includegraphics[width=0.44\textwidth]{fig/implementation.jpg}
 \caption{IIN Components and Connections for Fabric}
 \label{fig:implementation}
\end{figure}

\subsection{IIN Agents within a Fabric Network}

An IIN Agent represents an organization outside its network, and hence is designed to be an extension of that organization's MSP.
An organization typically uses a single MSP in production, but if multiple MSPs are used, representing organizational units, we can use a different Agents for each.
Logically, the Agent functionality ought to be performed by a Fabric CA Server.
Rather than modifying the Fabric CA code, for implementation and deployment convenience, our IIN Agent is built as a decoupled service exposing an API for communication with IINs (Indy networks), IIN Agents of other local network organizations, and IIN Agents of foreign networks' organizations (see Figure~\ref{fig:implementation}). The IIN Agent also has client privileges and can submit transactions to the CMDAC.

An IIN Agent is composed of three modules. An \textit{Indy Agent} built using with \texttt{indy-sdk}\cite{indy-sdk} is used to connect to an IIN's Indy pool and query DID/credential information. An \textit{Aries Agent}, implemented using \texttt{ACA-Py}\cite{aca-py}, is used to communicate with IIN trust anchors for verinym, VC, and VP requests. It uses DID service endpoints and credential definitions (public keys) for encrypted communication. While handling VCs and VPs, the \textit{Aries Agent} calls the \textit{Indy Agent} to fetch/update credential schema and definitions, and revocation lists. The \textit{Controller}, implemented using \texttt{Node.js} orchestrates the identity initialization, exchange and validation flow as described in Section~\ref{subsec:messageflow}. It is responsible for fetching its associated MSP's latest root and intermediate certificates for sharing with foreign networks. These three modules run within a single Docker container. Lastly, an \textit{IIN Fabric Client} application built on the \texttt{Fabric SDK}~\cite{fabric-sdk} updates foreign networks' identities and certificates on the channel ledger using CMDAC transactions. This app, running within its own container, takes transaction requests from the \textit{Controller} and executes an application level signature collection flow (see Section~\ref{subsec:sig-flow}) before invoking the CMDAC.

\subsection{Protocol: Syncing Foreign Identities through Consensus} \label{subsec:sig-flow}

Our protocol implementation follows the steps described in Section~\ref{subsec:messageflow} verbatim except for the final step in which a foreign network's identities are recorded onto the local ledger. This step requires DLT-specific mechanisms, and we will show how it was implemented in Fabric. As an example, we consider the scenario where SWT is trying to fetch and sync the certificates of the Carrier organization in STL.

Recording the STL Carrier's certificates on the ledger creates a shared truth for the entire SWT network, enabling its peers to refer to those certificates in a data transfer session, either for access control or proof verification. Allowing the CMDAC to directly query IINs or foreign networks' agents to fetch these certificates would create a non-determinism hazard. Therefore, we use an application-level flow involving IIN Agents to obtain the information and submit a transaction to the CMDAC, which can then process the input in a deterministic manner.

The SWT Buyer IIN Agent initiates this flow by validating the STL Carrier's Membership VC with the IIN, and subsequently fetches the Carrier's certificates from the  Carrier's IIN Agent (whose service endpoint is part of the Carrier's DID record). The Buyer IIN Agent then sends these certificates to its Fabric Client app, which then prepares a \textit{signature collection request}, and sends it to the Fabric Client of the SWT Seller IIN Fabric Client app. The latter validates the Carrier's certificates after consultation with their own IIN Agents (who have presumably fetched those certificates too), and then counter-signs the request on behalf of its organization. The Buyer aggregates the responses (only one here) and submits it as input in a CMDAC transaction. The chaincode checks for the presence of valid signatures from every SWT organization (here: Buyer and Seller) before approving the update of the STL Carrier's identity state on the ledger. Note that this update is idempotent, and can be carried out concurrently by the IIN Agents of both Buyer and Seller. Also, if the Buyer's and Seller's IIN Agents' copies of Carrier certificates are not in sync, the signature collection flow will fail and must be retried.

This protocol replaces the naive implementation in Abebe et al~\cite{abebe2019enabling} where organizational identities and root and intermediate certificates were fetched out-of-band manually and recorded on the local ledgers during bootstrap. The identity plane exchange we have demonstrated makes the process more secure and consensus-based. Further, any changes in organizational memberships or certificate belonging to an organizations can be determined and synced automatically through periodic queries made to the IIN registry (for membership and revocation lists) or whenever a proof validation fails because of expired certificates.

\subsection{Identity Network and Trust Anchors}

We deployed a single IIN, an Indy network bootstrapped with 4 independent Sovrin stewards~\cite{sovrin}. Two trust anchors were enrolled in the IIN by the stewards: one in the name of IBM to represent the SWT consortium and another in the name of Maersk to represent STL (see Figure~\ref{fig:trade-flow-implementation}). (Note that IBM and Maersk are initiators and major players in the real We.Trade and TradeLens networks respectively, and are therefore realistic sources of trust.) A single IIN with two trust anchors is sufficient to demonstrate operational mechanics in a proof-of-concept; in a production implementation, we will likely have more diversity but the mechanisms used will be identical to what we demonstrate here. The SWT Seller and Buyer register verinyms with, and obtain Membership VCs from, the IBM anchor in the IIN; likewise, the STL Seller and Carrier register and obtain theirs from the Maersk anchor.

redpajama_set_name: RedPajamaArXiv


text:
Pure Blue Fish Chooses Orangeburg, South Carolina for Production & Packaging Plant
Area Development News Desk (10/21/2020)
Pure Blue Fish, a fish farming company, will invest more than $28.1 million to establish operations in Global Logistics Triangle at Matthews Industrial Park in Orangeburg, South Carolina. The company plans to create 82 jobs.
Pure Blue Fish's South Carolina operations, expected to be completed by 2022, will serve as a production and packaging facility.
"All of us at Pure Blue Fish appreciate the time, effort and interest that the South Carolina Department of Commerce, SC Power Team, Tri-County Cooperative and the Orangeburg County Development Commission have offered to assist us at this location. We are looking forward to a long working relationship," Pure Blue Fish US, Inc. Co-Founder and CEO Nimrod Litvak said.
As an incentive, the Coordinating Council for Economic Development has approved job development credits related to this project.
"It's always great news when a company like Pure Blue Fish chooses to do business in South Carolina. This decision speaks to the reputation we have built as a state that is dedicated to helping our businesses succeed, and we couldn't be more excited to welcome this company to the Palmetto State," said Governor Henry McMaster.
"Environmentally sustainable aquaculture is an important frontier in farming. I'm pleased to welcome Pure Blue Fish to South Carolina, where agribusiness is the state's No. 1 industry," Commissioner of Agriculture Hugh Weathers noted.
Founded in 2016 in Israel, Pure Blue Fish grows yellowtail fish using innovative recirculating aquaculture systems with zero water discharge technology, which reduce water costs and pollution, all in a clean environment.
"We are very pleased with Pure Blue Fish's decision to establish operations in Orangeburg County. Pure Blue Fish joins a growing list of international firms that are finding Orangeburg County's strategic location and dedicated workforce key to their success. We look forward to welcoming Pure Blue Fish to the Central SC Region," said Central SC Alliance Chairman W. Keller Kissam.
All contents copyright 2020 Halcyon Business Publications, Inc.


But… I have my limits.
Twice in the last 24 hours I've been approached but different people involved in the BBC music events happening in Birmingham this week.
Both asking if I can supply a choir at 2/3 days notice. And both without a budget.
The first call was to supply a 30 piece choir for the BBC Music Awards Show to mime (yes mime!!) to someone else's music.
Problem no 1 – Miming. Really? I can imagine the conversations now. 'Clare I saw your choir on the telly the other night… They don't usually sound like that – it was great!' … 'Erm, it wasn't us… We were just miming'. No just no. You could ask anyone off the street.
Problem no 2 – 3 days notice and the choir were needed for a morning rehearsal on a weekday and an early evening recording of the show. I simply couldn't get amateur singers out of work at this sort of notice!
Problem no 3 – No budget. If amateur singers are going to be at work when the job needs doing I would need to find professionals. They need paying. End of conversation.
The second call was for a gospel choir at two days notice to sing on Thursday lunchtime at a drinks reception.
Problem no 1 – 2 days notice and the same as above applies if you want an amateur group they will be at work at lunchtime on Thursday and if you want professionals I've got a lot of ringing around to do!
Problem no 2 – No budget. If I'm going to put aside this afternoons paid work to ring around all my gospel colleagues I need to be paid. It is what I do for a living. And the singers need paying! I'm not ringing people and asking them to sing for free at a drinks reception at the Genting Arena where I'm quite sure they'll be paying for the drinks being served!!
The quote of quotes though is that the second caller said 'well we have the money off the BBC for this and we have to be careful what we spend BBC money on so we can only offer expenses'. When was it appropriate for BBC money to fund a drinks reception but not the artists that perform at it??
I'm a very helpful person. I love getting people out of a fix. But if you've left it until 2 days before to call and don't have a budget, or anything in fact, to offer the musicians. Don't ask me to help.
I post this not to upset the BBC as I have many helpful and lovely relationships with the BBC but out of principle… I'm genuinely upset I couldn't help and just wish they hadn't even asked!


text:
Drama, Romance, War
Ralph Fiennes, Juliette Binoche, Willem Dafoe, Kristin Scott Thomas, Naveen Andrews, Colin Firth, Julian Wadham, J?rgen Prochnow, Kevin Whately, Clive Merrison, Nino Castelnuovo
Hana (Juliette Binoche), a French Canadian nurse, finds herself escorting a severely burned man who had been found in the desert in 1944 suffering from amnesia. Due to the mine laden roads in Italy the journey becomes too dangerous despite having the bomb disposal team travelling with them which is why Hana agrees to stay at an old church with the man as he is dying, a bit more every day. It is whilst at the empty church that she meets fellow Canadian David Caravaggio (Willem Dafoe) who believes he has met her patient before and that his name is Count Laszlo de Alm?sy (Ralph Fiennes).
Have you ever watched a movie which has pretty much everything from beautiful cinematography to an evolving storyline as well as good performances yet for some reason it just doesn't grab you in the way it grabs others? This is the case when it comes to "The English Patient" because if I sat down with a tick sheet of what makes a good movie this would be scoring multiple ticks next to each item with the cinematography being simply magnificent. Yet truth be told when I had finished watching "The English Patient" it didn't leave me feeling emotionally exhausted as if I had been part of the drama which what for me usually means a movie was something special.
Now as to that drama; well there is plenty of it going on as "The English Patient" has multiple characters and multiple story threads. On one hand we have the story of Hana who feels she is jinxed as those she becomes close to end up dying which makes her fearful when she falls for Kip whose job it is to disarm bombs and land mines. We also have Caravaggio who shows up saying he is a thief but as we discover knew the severely burned man before the accident which disfigured him. And of course we have the burned man, Count Laszlo de Alm?sy who as we learn was in love with another man's wife and working as a cartographer when WWII broke out giving us an almost epic love story. These stories interweave taking us back and forth between periods whilst drawing in extra elements to do with the war. Yet for me whilst these stories are beautiful I never felt part of them and never felt that emotional connection once the movie was over.
But as I said "The English Patient" ticks box after box and as such we have the wonderful cinematography which is old school classy but more importantly doesn't become painfully drawn out by making these beautiful shots too artsy. Basically the cinematography helps to tell the story, to set the scene but never becomes the focus of a scene even when it does something creative with the shadows thrown by the desert sand.
And then there is the acting and I am going to say that every single part in "The English Patient" was perfectly cast be it Ralph Fiennes as Count Laszlo who you can sense is fighting his feelings when he meets the married Katharine to Kevin Whately as Sgt. Hardy who brings just the right amount of light hearted fun to his part to make him the happy sort of soldier who is everyone's friend. You could possibly write a small book on the acting and the casting in "The English Patient" as it is faultless through out.
What this all boils down to is that "The English Patient" is a great movie, an absolute treat for the eyes whilst being undeniably well acted. But for me it didn't achieve what truly great movies manage which make me feel like I have been part of the drama and as such I didn't feel that emotional exhaustion when the movie was over.
Star Trek VI: The Undiscovered Country (1991)
A disaster has put the Klingon Empire in a perilous state and as such are seeking peace talks, something which not everyone agrees with as Captain Kirk having never trusted the Klingons thinks it would put them at danger. Unfortunat ...
An American Tail: Fievel Goes West (1991)
Having headed to America to make a fresh start the Mousekewitz's discover that things are not so different with trouble in the form of cats, with the exception of Tiger their friend. When they hear that the West is the place to go a ...
Return to the Blue Lagoon (1991)
"Return to the Blue Lagoon" picks up sort of where "The Blue Lagoon" ends as the boat containing Richard, Emmeline and their baby Paddy is picked up. But in this case Richard and Emmeline are dead and as the only word that young Pad ...
Medicine Man (1992)
Having been doing research in the Amazon Rain Forest for the past 3 years, Dr. Robert Campbell (Sean Connery - Indiana Jones and the Last Crusade) suddenly puts in a call for a research assistant, a male research assistant and so is ...
Honey I Blew Up the Kid (1992)
After the incident of shrinking their children the Szalinski's have relocated and Wayne (Rick Moranis) now works for the Sterling corporation. But an incident in the lab causes baby Adam (Daniel Shalikar & Joshua Shalikar) to get z ...
A Daughter's Deception (2019)
Laura (Jade Harlow - Stalked by My Patient) was just 17 when she gave birth to her first daughter, but she wasn't even allowed to hold her as her parents insisted on the baby being taken away immediately and put up for adoption. Now ...
From a young age his father driller into him that he was a protector of people and so it wasn't a surprise when Chris (Bradley Cooper - Serena) ended up becoming a Navy S.E.A.L. sniper as he had always shown a natural talent for mar ...
Shark Lake (2015)
When Meredith Hernandez (Sara Malakul Lane - 100 Degrees Below Zero) put Clint Gray (Dolph Lundgren - Riot) inside for his black-market selling of exotic animals and endangered species she ended up taking in Clint's daughter rather ...
Shattered Memories (2018)
Waking up dazed and confused, Holly (Elizabeth Bogush) discovers it's Sunday morning and that in the bed next to her is a guy called Ray (Brad Schmidt) who she had previously had an affair with but called it off. Trouble is Ray is s ...
Baywatch (2017)
Lieutenant Mitch Buchannon (Dwayne Johnson - Hercules) is devoted to his job as a lifeguard in the beautiful Emerald Bay, often keeping an eye on things, as well as his team, on his day off. It is why he finds himself locking horns ...
He's Watching (2018)
Life is going well for Angela (Linsey Godfrey) as not only she dating her perfect man but she is in line for a partnership at the wealth management firm she works for. Then out of the blue Kyle (Tilky Jones - Open Marriage) shows up ...
VAMPIRE MOVIES ON THE MOVIE SCENE
Dracula (1958)
Bram Stoker's Dracula (1992)
Near Dark (1987)
Stake Land (2010)
From Dusk Till Dawn (1996)
Daybreakers (2009)
Scenes of the Crime (2001)


text:
Dollar General 'Puts Profit Before People': OSHA
Walmart's $350 Billion US Manufacturing Pledge Will Support 750K Jobs
By Kate Nishimura
Kate Nishimura
More Stories by Kate
New Master's Program Targets Women in Bangladesh Garment Sector
Pakistan's Nishat Mills to Acquire Denmark Protective Fabric Maker
No Details on How Many Jobs Hanesbrands Is Cutting
March 4, 2021 6:00am
Sipa USA / Associated Press
Walmart announced plans to bolster the American supply chain Wednesday as it committed to inject $350 billion into the U.S. manufacturing sector over the course of the next decade.
The big-box retailer said the cash infusion would support more than 750,000 new jobs across the country in an extension of its 2013 commitment to invest $250 billion in products made, grown or assembled stateside. The company is on track to deliver on its earlier promise, and has re-upped with a new program that aims to support the creation of textiles, plastics, small electrical appliances, and pharmaceutical and medical supplies, as well as food processing on American shores. The program will also back the production of Goods Not For Resale—equipment, fixtures and other products and services needed to keep Walmart's stores up and running.
"U.S. manufacturing really matters," Walmart U.S. president and CEO John Furner told an audience at South Carolina-based power equipment manufacturer Techtronic Industries (TTI) this week. "It matters to our suppliers, to entrepreneurs and to the environment," as well as to the company's customers, 85 percent of whom have deemed it important that Walmart carry products made or assembled in the U.S., he said.
Furner said Walmart's commitment will also further its sustainability and ethics goals. The company estimated it will see a reduction of as much as 100 million metric tons of CO2 emissions due to the fact that products will be sourced closer to Walmart's end consumers. The shift will also prompt the retailer to distribute its dollars to suppliers of diverse backgrounds from across the country.
How to Interpret Walmart's New Wage Hike
Retail Tech: Microsoft Debuts Smart Store Solutions, M&S Adds Virtual Try-On, Walmart x Salesforce Fulfillment Tie-Up
In addition to allocating capital, Walmart also announced the launch of an effort dubbed American Lighthouses, which aims to solve some of the issues that have hindered U.S. manufacturing's competitiveness. The company will seek to unite key stakeholders across relevant manufacturing regions, from suppliers to non-government organizations, academics, government agencies and local economic development groups to identify and overcome the sector's roadblocks.
The announcement has drawn bipartisan support from federal officials from states that house Walmart's suppliers. Senator Tim Scott (R-S.C.) lauded the company's efforts at TTI's facility this week, saying, "I am passionate about bolstering the American supply chain and creating more high-paying jobs in South Carolina and for folks all across the country," and thanking Walmart for "the great impact" it stands to have on the U.S. economy.
Senator Chris Coons (D-Del.) also congratulated the company for its commitment, touting Zenith Home Corp./Maytex manufacturing, which crafts home storage solutions and accessories, as one of the state's success stories. The company's products have only been available in local Walmart stores, but Zenith "has been able to strengthen its operations" and extend its reach with help from the government-funded Delaware Manufacturing Extension partnership program, which provides education and resources to American businesses, Coons said. "We're proud that Zenith's story of investing in the U.S. is one today's announcement aspires to replicate across the country," he said.
American manufacturing
Pakistan Facing Crisis of Cotton and Energy
This Apparel Company Will Only Use 100% US Cotton
Kenya Rebuilding Flagging Textile Industry