JLINC is a protocol for sharing data protected by an agreement on the terms under which the data is being shared.

The agreement is known as an Information Sharing Agreement (ISA),which can be a reference to a standardized agreement (a Standard InformationSharing Agreement or SISA) or to a one-off specialized contract.

The JLINC protocol is in essence very simple. It starts with the existence of Information Sharing Agreements. For any given industry or activity there can be one or more SISAs. For personal data, we envision these being hammered out between organizations that represent citizens and industry trade associations. JLINC Labs has created a basic SISA to begin that process.

The other essential concept is that the two principal classes of actors in the system are Data Rights-Holders and Data Custodians. Rights-Holders are people or entities that have legal or moral rights to the data in question, and Data Custodians are people or entities that have a fiduciary responsibility to the Rights-Holder(s) to handle their data in accordance with an ISA or SISA.Any data may have, depending on its type, one or more Rights-Holders as well asa chain of Data Custodians.

Rights-Holders may be individuals or entities of any type, commercial, non-profit or governmental. The data being protected may be personally identifiable information (PII) or corporate, business or organizational data of any type.

The SISA is selected and cryptographically signed by the initiating party (a Rights-Holder or Data-Custodian) and offered to the receiving party. The receiving party, if it recognizes and accepts the SISA, countersigns it and returns it to the initiating party.

W3C standards including JSON-LD, DIDs (decentralized identifiers) and Verifiable Credentials  are used by the protocol specification to accomplish this exchange. JLINC Labs published one of the first conforming DID method specifications in 2018 and is currently about to publish a new more flexible and interoperable DID method.

The over-the-wire protocol uses signed and optionally encrypted JWTs (JSON Web Tokens), or if extreme efficiency is required by the use case, the CBOR version called CWTs.

Both parties retain a copy of the signed and countersignedSISA along with the signing parties’ DIDs and the other metadata that accompanied the exchange. This comprises a completed SISA, which the various parties may submit to a Ledger of their choice to facilitate non-repudiation.

Once the SISA has been completed, the parties may use theJLINC protocol to exchange information accompanied by a hash of the completed SISA, indicating that the exchange is understood to be happening in the context of the SISA. Records of these exchanges (SISA events) are also retained by both parties and may also be submitted to a Ledger.

Once a completed SISA has been established and SISA events begin to flow, a relationship state between the parties exists. In particular, at any given moment there is a state comprised of the permissions that theRights-Holder has afforded and/or denied to the Data-Custodian, and the status of the SISA.

Both parties to the SISA SHOULD be able to view are presentation of this state whenever desired, which will quite probably change from time to time.

The audit section of a SISA event is designed to contain hashes, signatures, public keys and other opaque values as well as DIDs, but nothing that can be decoded or decrypted to reveal sensitive data.

Either or both of the parties to a SISA event MAY choose to transmit the audit section of these events to a third-party audit service of their choice. Audit records serve to provide an independent record of SISA agreements and events that could be referenced in the case where a dispute arises over the authenticity of an event history.

Some Data Custodians may have a special role as Data Agents for other actors in the protocol. These Data Agents facilitate cryptographic operations and communication and persistence protocols and have a special responsibility to the parties they represent. The represented parties may be individuals or organizations of any type, commercial or non-profit.

‍