abstract: A substantial administrative burden is placed on healthcare professionals as they manage and progress through their careers. Identity verification, pre-employment screening and appraisals: the bureaucracy associated with each of these processes takes precious time out of a healthcare professional's day. Time that could have been spent focused on patient care. In the midst of the COVID-19 crisis, it is more important than ever to optimize these professionals' time. This paper presents the synthesis of a design workshop held at the Royal College of Physicians of Edinburgh (RCPE) and subsequent interviews with healthcare professionals. The main research question posed is whether these processes can be re-imagined using digital technologies, specifically Self-Sovereign Identity? A key contribution in the paper is the development of a set of user-led requirements and design principles for identity systems used within healthcare. These are then contrasted with design principles found in the literature. The results of this study confirm the need and potential of professionalising identity and credential management throughout a healthcare professional's career.
author:

bibliography: references.bib
date: January 2020
title: Trust-by-Design: Evaluating Issues and Perceptions within Clinical Passporting

**Keywords:** COVID-19, CL-15, CL-17, privacy-preserving,

# Introduction

While the COVID-19 crisis has brought the challenges of staff mobility into the spotlight, the administrative burden placed on a healthcare professional throughout their career has always been present. Over the years healthcare service providers have increased the minimum standard for identity verification and pre-employment checks in line with new regulations . As a result, the time spent on these processes has increased. A House of Lord's report, for example, estimated that 25,000 junior doctor days a year were currently being spent on these administrative tasks . In addition to this, digitisation of healthcare services has further increased the time and complexity associated with managing one's career. In a 2011 US survey, 87% of physicians stated that the leading cause of stress was down to administration and a study of Finnish physicians found that poorly functioning IT systems continue to be a major cause of stress, particularly for those in highly time pressured roles . Another major challenge is within doctors working across both in public health care and also in private practice .

In a crisis like the COVID-19 outbreak, the need for a healthcare service to react to rapidly evolving, location specific, stresses at a Trust or Hospital level cannot be clearer. Different locations may hit their peak at different times, while some areas may only be minimally affected . However, consultation with an RCPE trainee suggests that on-boarding into a new Trust or hospital can take up to two days. This is two days of precious time that could potentially have been spent saving lives. Technological solutions have regularly been heralded for their ability to reduce inefficiencies and streamline patient care. Blockchain technology is just one of the more recent innovations predicted to have a disruptive impact . Often though, the reality in the hospitals is different to the design assumptions made by technologists and the productivity benefits are not always obvious .

This paper thus presents an initial set of design principles for any technical solution attempting to reduce the administrative burdens currently placed on healthcare professionals. An analysis of discourse about digital identities, verifiable claims and trust has led to a theoretical set of trust and design principles. These principles were validated in a workshop with healthcare organisations held at the RCPE. This research takes an initial step towards understanding the problem space from the perspective of those currently experiencing it and lays the foundation for future quantitative studies in this area.

## Research questions

This paper evaluates a use case in which a person can digitally obtain, manage and present their professionals credentials and personally identifiable data within an healthcare system. We limited the scope of the work to healthcare professionals, as these are identified as being burdened with administrative tasks associated with identity verification, and pre-employment checks. As well as recording and managing their credentials as they progress through their career. A burden which is generally expected to take place in people's personal lives. The following research questions were identified:

-   What are the identity interactions that a healthcare professional must manage throughout their career?

-   How might Self-Sovereign Identity technology be used to simplify a healthcare professionals identity administration?

-   How do the design principles of Self-Sovereign identity stated in the literature and technical sphere meet the requirements of the healthcare professionals that would actually be using these systems?

# Related Literature

Berwick, Nolan and Whittington define the *Triple Aim* focusing on improving the care, health and cost when accessing healthcare performance in the US . They point out that these goals are interdependent so must be considered together when planning and evaluating healthcare changes. It has been suggested that this framework should be extended to consider a fourth aim, care for the provider , due to reports that staff burnout and dissatisfaction is widespread. As care providers are on the frontline when it comes to achieving the triple aim for healthcare services, including their well being into this assessment makes sense.

## Healthcare Professional Credentials

Healthcare providers have a requirement to maintain strong identity verification checks to ensure that their employees are who they claim to be and that they have the required skills and training for the job . Unfortunately, there have been examples throughout the world of doctors practising without licences. This puts patients lives at risk and reduces the trust in the profession as a whole. Examples include; the UK General Medical Council recently having to recheck credentials of 3,000 doctors after a fraudulent psychiatrist was found to have practiced for 23 years without proper credentials , the case of a social worker in Canada involved in more that 100 child protection cases and the notorious US case of Christopher Duntsch a.k.a Dr Death .

As a consequence, credentialing healthcare professionals is a crucial process in healthcare systems throughout the world. However, the current practices of many systems add huge overheads to both the administrators and the healthcare professionals. In a report on healthcare and digital credentials the US Federation of State Medical Boards (FSMB) analyse the use of digital credentials in healthcare, looking at the potential for both current technology and future technology to streamline the process and enhance trust in the system. The implementation of the Federation Credentials Verification Service (FCVS) in 1996 , a NCQA-certified platform providing a centralized service for obtaining primary source, verified education information for medical practitioners applying for licensing in the US. As the report outlines, the FCVS reduced the time to obtain a license from 60 days to  25 days. A significant reduction. However, efforts to improve the FCVS highlighted the underutilization of technology in the process. Furthermore 66% of this time is driven by parties outside of the control of the FCVS . These credential verification organisations are often redundant and increase the cost of the whole process. The report highlights the movement to *disintermediate the creation and management of credentials*, hinting at a movement towards individual ownership of credentials.

Along with this there is an increasing need for clinical staff to provide digital evidence of their training, skills and experience. Read et al investigated the usage of a passporting system for surgery clerkship and found that those involved often found that it improved student's reporting of their performance in basic clinical skills.

## Self-sovereign identity (SSI)

Digital identifiers - and the trust entities place in them - enable many modern societal interactions. They thus allow organisations to perform critical activities with increased levels of trust. Another way of looking at it is from a risk perspective, and where digital identifiers and account information correlated with an identifier that helps organisations make risk-based decisions associated with a particular interaction and value exchange. Unfortunately, traditional identity management systems continue to have security risks , such as: credential theft or loss; biometric impersonation; document forgery; and identity theft.

SSI uses a new type of identifier currently going through standardisation at the W3C, a Decentralised Identifier (DID) . A DID is an identifier under the sole domain an entity, typically the entity that created it. They are cryptographically verifiable and independent of any central authority. Rather than being assigned an identifier on account creation, DIDs let individuals provide their own identifiers for their digital relationships.For a more detailed description of the technical architecture pf self-sovereign identity we point the reader to the following survey .

Systems built following an SSI architecture could offer the opportunity to rethink the entire credential process for physicians. Before the electronic transmission of credentials can be put forward as a viable option for healthcare professionals, it must be considered if such a process would break any of the rules and regulations currently governing this area. The key things identity verification and authentication process must satisfy for most healthcare services are :

-   Is it possible to verify the authenticity of the claim?

-   Is the claim a primary source attestation. For example, is your degree certification a certificate from the university you attended?

-   Was the credential securely delivered from the credential holder to the verifier?

-   Is there a clear, verifiable audit trail that can trace the origin of this credential?

These points can, in fact, all be satisfied digitally through the use of digital signatures.

The problem of scaling digital identities into health care systems have lead many people to explore alternative methods to identify and authenticate people and things in the digital sphere. One of the proposed architectures is commonly referred to as Self-Sovereign Identity (SSI). Connor-Green identifies that SSIs could be one of the core use cases of blockchain in health . Liang et al outline a blockchain approach within a heath care management system and where the distributed nature of SSIs support a scalable infrastructure which moves away from the centralised control of identity within many existing health care infrastructures .

# Method

The goal of the workshop was to gather a set of values and principles that can be used to evaluate emerging technology for identity systems within healthcare. Terminology and definitions are often much contested in different contexts. We used definitions provided in the selected papers as much as possible, but some definitions were adapted to better fit our goal to measure the value or principle.

The next step in our research was a workshop organised at RCPE. It involved 14 participants with a wide ranging experience of different aspects of the healthcare system. The participants for the workshop were selected through consultation with the RCPE, and who were able to use their contacts to invite a diverse range of attendees. This included clinicians, RCPE trainees, and RCPE staff involved in data management, digital transformation and education, as well as a representative from the General Medical Council (GMC). While no personal data was captured during the workshop and all attendees remain anonymous, explicit consent was obtained and the research aims were explained at the beginning of the workshop.

During the workshop, the participants evaluated the fit of SSI within the healthcare domain. First, a process mapping exercise was used to develop an understanding of the current system, looking at the identity data exchanges and key entities that verify or attest to identity attributes of healthcare professionals throughout their career.

Then these identity moments were re-imagined within a SSI enabled ecosystem, this story was told in an interactive manner using physical props and audience participation in order to convey the capabilities that SSI systems could provide for healthcare professionals, without going into unnecessary technical detail. Finally, the workshop participants were asked to evaluate the positive and negative aspects of the identity management system. The participants expressed their requirements, values and expectations. The list that was distilled from these workshop discussions was compared against the list of design principles from the desk research.

# Design principles for self-sovereign identity systems

The success of any SSI system depends not only on the technical feasibility but also on the user acceptance and trust in the system. With users we mean all stakeholders (entities) within a specific context that will use that system together. Trust is harder to define, as there exist more than 70 definitions in academic literature . Trust is seen as a human strategy to cope with uncertainty, such as those we face in relations, actions and innovation . In a digital context, trust is often transferred to cybersecurity measures such as technological controls, certificates, and organisational compliance frameworks. In SSI systems, at least some aspects of this trust shifts from trust between people towards confidence that is placed in cryptographic systems. As Smolenski frames it: *trust is being depersonalized*. Designing new digital identity systems means mimicking real-life situations in a digital way. Human values, such as ethics and trust need a digital equivalent that users need to accept and understand. How do we design trust from the start? Which design principles are most valued by users and most likely to establish trust in these systems?

There are many papers that refer to the *Laws of Identity* (coined by Cameron in 2005) as the foundation for design principles. These laws explain the dynamics causing digital identity systems to succeed or fail in various contexts. Although written before the era of SSI, Cameron himself finds the laws still relevant, also for identity systems on the blockchain and decentralized identity . He points out, for instance, that the first four of the laws are also requirements within the GDPR.

In 2016, Christopher Allen wrote 10 principles inspired by (amongst others) the work of Cameron. His aim was to ensure that user control is at the heart of SSI. Allen pointed out that identity can be a double-edged sword: it can be used for both beneficial and maleficent purposes. Therefore, he states: *an identity system must balance transparency, fairness, and support of the commons with protection for the individual.* The Sovrin Foundation adopted Allen's principles and arranged them in three sections, but this causes some confusion as they used one principle twice and made another principle a section above other principles. Other researchers and developers have used Cameron's or Allen's principles for inspiration and adapted them to their own lists of features. However, testing of SSI systems against these features and design principles is still rare.

Dunphy & Petitcolas evaluated three identity management solutions (uPort, Sovrin, and ShoCard) against Cameron's laws of identity. Their overview shows that none of the solutions meets all seven laws, and non of them meets the law of human integration: usability, user understanding and user experience. They state that none of the schemes they evaluated are accompanied by an evidence-based vision of user interaction. One of the limitations is usable end user key management for nontechnical users that remains unaddressed. Furthermore, they express concern about tightening regulation, such as the GDPR, that sometimes contradicts the transparency of data storage in these solutions. Finally, most solutions provide only ad-hoc trust, as trust relies on integration between participating entities and methods to achieve trust in the context of identity attributes are still evolving.

Ferdous et al. elaborated on the principles of Allen and designed a taxonomy of essential properties for SSI. Then, they compared four blockchain-based SSI systems (uPort, Jolo, Sovrin, Blockcerts) against the properties and through desk research they found that most of the systems satisfy most of the properties. Similar work was done in a student project where students compared eight blockchain-based (IDchainz, Uport, EverID, Sovrin, LifeID, Selfkey, Shocard, Sora) and three non-blockchain based SSI systems (PDS, IRMA, reclaimID) against each of Allen's principles with one additional principle . They concluded that some of the blockchain based solutions fulfil all properties, but that some of the non-blockchain-based implementations meet most of the criteria as well. Interestingly, their conclusions as to whether the properties are met do not always match the conclusions of for two systems (Uport and Sovrin) that both projects evaluated. Toth and Anderson-Priddy validated nine properties from earlier sources (e.g. Allen and Sovrin Foundation) and added new properties. They applied these properties to their architecture for digital identity and reasoned how these apply to their solution (NexGenID).

To the best of our knowledge, published evaluation of values and principles with users in a specific SSI context is very rare. One project that focused on citizens and digital identity systems in general (not SSI specific) was the Digital Identity lab in The Netherlands. In several interactive sessions with citizens they found which values matter the most for digital identities . The research methods included interviews in the streets, meet-ups, expert sessions and design sprints. The results include evaluation quadrants to plot digital identity providers and an overview of values that citizens find important, and that can be used as input for ethical design and trust of digital identity systems. Another project focusing on user experience is the IRMA Made Easy project . IRMA (I Reveal My Attributes) is a self-sovereign identity solution with a digital wallet. The IRMA Made Easy Project works on the design of the app and website with a focus on accessibility. The developers of IRMA point out that user experience design affects how users handle the control over their information. From their experience they share three lessons:

1.  In order for new technology to be adopted, they require a smooth user experience.

2.  User experience design for privacy is not the same as general user experience design.

3.  A system that puts people in control over their data does not always lead to people using that control to protect their privacy: it can even lead to the opposite when they are tricked by others.

From the literature study we learned that there is a gap in academic research that includes evaluation of proposed SSI solutions from a user perspective with domain knowledge of the ecosystem. Furthermore, to the best of our knowledge, the most commonly used design principles have not been validated by users for importance and priority. Projects that included consumers focus on identity management in general, and studies on SSI systems tend to focus on the evaluation by technical experts through desk research. Furthermore, when SSI design principles and features indeed are evaluated, the researchers re-use existing frameworks or lists of principles without user elicitation for principles that technology experts have not imagined yet. If we do not understand the requirements of end users then we run the risk of creating digital tools that no one wants to use, or worse introducing unintended consequences through the deployment of these systems to domains with poorly understood requirements. There are countless examples of technology being introduced into healthcare only to make the jobs of those working alongside this technology worse, like the 15 logins needed to access different NHS systems .

We compared the different lists of principles, features and values that we found, and created an overview of different and overlapping principles. The results are presented in table . The overview of principles was input for the next stage in our research, where we invited future users to express their opinion on principles and values. In the next section we describe the workshop that we held with representatives of different entities in an ecosystem, in order to contribute to the knowledge of end-user perception and trust of SSI systems.

```latex
\begin{table*}[ht]\label{tab:principles}
\begin{center}
 \begin{tabular}{|p{3cm}|p{3cm}|p{3cm}|p{3cm}|p{3.5cm}|}
 \hline
 Cameron  \cite{cameron_laws_2005} & Allen \cite{allen_path_2016} & Ferdous et al \cite{ferdous2019search} & De Waag \cite{spierings_digitale_2019} & Toth Anderson Priddy \cite{toth2019self} \\ [0.1ex]
 \hline\hline
  & Existence & Existence &  &  \\
 \hline
 User Control and Consent & Control and Consent &  Consent &  Control & Control and consent \\
 \hline
  & Access & Access & Access & Access  \\
 \hline
 & Transparency & Transparency & Transparency &  \\
 \hline
Pluralism of operators and technologies & Portability & Portability &  & portability \\
 \hline
 Consistent experience across contexts & Interoperability & Interoperability & & Interoperability\\
 \hline
  & Persistence & Persistence & & Persistence \\
\hline
Minimal disclosure for a constrained use & Minimalization & Minimalization & Data-minimalization & \\
\hline
 & Protection & Protection & Security  & secure transactions and identity transfer\\
\hline
 & & Autonomy & Autonomy & \\
\hline
 Justifiable parties & & Choosability & & \\
\hline
 Human integration & & & Ease of use & usability \\
 \hline
 & & Disclosure &  &  \\
\hline
 & & Ownership & & \\
 \hline
  Directed identity & & Single source & & \\
 \hline
& & Standard & & \\
\hline
& & Cost & &\\
\hline
& & Availability & & \\
\hline
& & & Trust & \\
\hline
& & & Privacy & \\
\hline
& & & Integrity & \\
\hline
& & & Decentralization & \\
\hline
& & & Inclusivity & \\
\hline
& & & Reliability & \\
\hline
&  & &  & Counterfeit prevention\\
\hline
& & &  & Identity verification\\
\hline
& & &  & Disclosure\\\hline
& & & & Identity assurance\\[1ex]
 \hline
\end{tabular}
\end{center}
\caption{List of design principles}
\label{tab:principles}
\end{table*}
```
```latex
\begin{table*}
\begin{center}
 \begin{tabular}{|p{3cm}|p{10cm}|}
 \hline
 Design Principle & Definition \\ [0.5ex]
 \hline\hline
Existence & The identity of a person exists independent of identity administrators or providers.
Control The person is in control of their digital identity and is able to choose what personal data to share.  \\
 \hline
Autonomy &  A user is independent on creating identities, as many as required, without relying on any party and be able to update/remove it. \\
 \hline
Disclosure  & A user must have the ability to selectively disclose particular attributes.  \\
 \hline
Ownership & The user is the ultimate owner of an identity, including the claims. \\
 \hline
Consent & Data must be released only after the user has consented to do so. \\
\hline
Access &    The person has full access to their own data.\\
\hline
Single source & A user is the single source of truth regarding the identity. \\
\hline
Transparency &  Systems and algorithms are transparent and anyone should be able to examine how they work. \\
\hline
Standard &  An identity must be based on open standards.\\
\hline
Cost &  Costs must be kept to minimum.\\
\hline
Portability &   Information and services about identity must be transportable to other services.\\
\hline
Interoperability &  Digital identities are continually available and as widely usable as possible.\\
\hline
Persistence & An identity must be persistent as long as required by its owner.\\
\hline
Minimalization  & When data is disclosed, that disclosure should involve the minimum amount of data necessary to accomplish the task at hand. For example, if only a minimum age is called for, then the exact age should not be disclosed, and if only an age is requested, then the more precise date of birth should not be disclosed.\\
\hline
Protection  & The rights of users must be protected. When there is a conflict between the needs of the identity network and the rights of individual users, then the network should err on the side of preserving the freedoms and rights of the individuals over the needs of the network.\\
\hline
Availability &  An identity must be available and accessible from different platforms when required by its owner. \\
\hline
Human welfare & The identity system must contribute to human well-being.\\
\hline
Non-maleficence &   The system will not cause harm to others.\\
\hline
Justice & Systematic unfairness (false negatives/positives) is avoided.\\
\hline
Trustworthiness &   Expectations to act with good will towards others.\\
\hline
Privacy & The user has the right to decide what data is shared and to set boundaries.\\
\hline
Dignity & Dignity is intertwined with emotional identity. Technological solutions have a responsibility to uphold human dignity.\\
\hline
Solidarity &    Respectful cooperation between stakeholders.\\
\hline
Environmental welfare & The solution should cause no environmental harm.\\[1ex]
 \hline
\end{tabular}
\end{center}{}
\caption{The list of design principles was validated in a workshop}
\label{tab:design_defs}
\end{table*}
```

# Workshop description

After a brief introduction, participants were asked to complete a warm up exercise where they recorded different identity interactions that occur throughout a typical day in their life. This included using a RFID card, logging into a digital system with a username and password, authenticating to a mobile device, bank card payments. Anything that involved some form of identification and authentication. Participants were also asked to record times when authentication failed for example through a rushed or forgotten password attempt.

The aim of the exercises was to get attendees thinking about how often they interact with digital systems, how many different username and passwords they currently manage and the number of different authentication devices that they have to carry. The majority of participants recorded over 25 separate identity interactions, all in a single day.

## Healthcare Ecosystem Process Mapping

For the next stage of the workshop focused on eight core identity moments that captured at a high level the typical experiences of a doctor throughout their career. Participants were asked a create process maps identifying key organisations involved in each of these stages and the identity information that a doctor is required to present to them. Additionally participants were asked to capture frustrations that a doctor might experience while navigating these identity moments. The general identity moments identified and validated prior to the workshop to provide some structure were as follows:

-   Doctor graduating from university.

-   Doctor applying for a job.

-   Doctor joining a hospital.

-   Doctor training.

-   Doctor rotation.

-   Doctor begins RCPE accreditation.

-   Doctor qualifies as a Physician.

-   Doctor moves abroad.

The workshop participants were split into groups, each group focused on four of the identity moments. The results were then presented back to the group providing a detailed overview of each of the stages in a doctor's career, including recurring and trusted ecosystem entities such as the GMC (General Medical Council). These maps were combined and synthesised into a Gantt chart, showing the time burden and repetition associated with a healthcare professionals as they progress through their career, see Figure . This was developed through follow up communication with a final year trainee at the RCPE who attended the workshop.

## Re-imagining Identity Moments using SSI

The next stage of the workshop involved an interactive session on Self-Sovereign identity and the capabilities it could provide healthcare professionals when applied to the key identity moments that participants previously mapped out. The goal was to give attendees a high level understanding of how this technology works and where it might fit into existing processes within healthcare.

Physical props were used to represent different aspects of the SSI system and a number of workshop attendees were asked to play roles within the healthcare ecosystem. Specifically, six participants acted as the key entities and trust providers identified in the process mapping stages:

-   **A Medical School** - Before becoming a licensed doctor, individuals must first complete a degree at a medical school.

-   **The General Medical Council** - The doctor licensing body in the UK

-   **The Royal College of Edinburgh** - Royal colleges are involved with training and examination procedures for junior doctors as they gradually specialise in a medical discipline.

-   **Edinburgh Hospital** - This hospital was used as the initial place of employment once the fictional doctor in our scenario graduated.

-   **Glasgow Hospital** - This entity represented the doctor rotation process within the scenario modelled.

-   **Health Education Scotland** - A body involved with continuous training and education of doctors.

The initial setup of the SSI healthcare ecosystem was represented by asking each actor in the scenario to *generate a pubic/private key pair*. A red (private) and green (public) card was used to show the two halves of a public/private key pair. Actors then attached their *public key* to a white card, which was used to represent a decentralised identifier (DID). All actors were asked to place their DID onto the wall, representing the act of registering a public DID on a distributed ledger such that the public keys for these trusted entities could be resolved by anyone.

After the initial setup, a member of the research team played the role of doctor and walked through each of the identity moments discussed and mapped in the process mapping session. This interactive approach was used for a couple of purposes:

-   To educate workshop attendees about the capabilities that a Self-Sovereign Identity (SSI) architecture enables.

-   To illustrate how SSI could be applied to the healthcare domain to streamline identity interactions.

Throughout this interactive session, a flipchart was used to represent the doctors digital wallet. The wallet gradually collected Verifiable Credentials represented as large post-it notes and digital relationships, formed through peer DID connections, were represented as small blue post-its within the wallet. See Figure .

Within a SSI system there are generally four core interactions;

-   Establishing a peer DID connection to initiate a digital relationship.

-   Credential issuance.

-   Proof request.

-   Presentation of credential attributes in response to a proof request.

Each of these interactions were represented in this scenario as follows:

### Establishing a peer DID connection

For this interaction, the action used was simply a handshake between the doctor and the party the doctor wished to connect with. For example, during the doctor qualifies from medical school process mapping the doctor had to establish a connection with the GMC. Whilst the handshake took place participants were explained that this represented forming a private peer-to-peer communication channel across which message integrity and authenticated origin can be verified. It was illustrated that the connection was stored and managed by the digital wallet using a small blue post-it note.

The fact that these connections could be formed either face to face, or through a website was additionally discussed. Explaining that you probably have more trust in a connection formed face to face and that trust can be built across these connections by sharing verifiable information.

This relationship once formed can last indefinitely, until one individual or the other decides to break it off. This means that the GMC or any entity could form more personal relationships with the doctors they licence, enabling them to push them relevant communication across their secure communication channel.

### Credential Issuance

Credential issuance was a recurring SSI interaction that was represented in the scenario. The medical school issued the doctor their medical degree, the GMC issued their licence and the RCPE issued the doctors a qualified physician credential. All these credentials exist in the current system. They are attestations about the attributes and qualifications of a doctor, made by entities with the authority to make such claims. Before any credential issuance interaction, a secure connection must have been formed as discussed above this was highlighted through a handshake action.

Then workshop participants acting as the different trusted entities within the scenario were asked the write the name of the credential (a large post-it) and sign the credential using their *private key* - the red card they received as part of the setup. In reality they used a wet signature to represent this. This helped convey the concept that once a credential has been signed it is impossible to change the contents of that credential without invalidating the signature - providing integrity to the credential.

For simplicity the scenario did not represent individual attributes that credentials contained - for example a GMC credential might contain the doctors name and their GMC licence number. This was conveyed verbally instead.

During the session, the signature type - CL signatures, and the way that they work in the context of Verifiable Credentials was briefly touched upon. Due to the importance to understand why a doctor couldn't easily share a credential. Specifically the doctor contributes some secret information in a blind manner into the signing protocol as one of the credential attributes. Such that when the credential is signed and given to the doctor, only they can prove they know the secret value that was signed by the issuer. Even the issuer does not know this.

The wall of trusted DIDs and their corresponding public keys was used to discuss how the doctor, or rather their wallet, could verify the signatures on any credentials they were issued to ensure they were valid. The doctor is also capable of refusing a credential or suggesting changes before accepting - for example if the issuer had spelt their name wrong.

### Proof Request

A proof request is an SSI interaction whereby an entity, generally referred to as a verifier, requests proof of certain identity information from a holder - in this scenario the doctor. The verifier is able to additionally specify the credential schema that the identity information should come from and the credential issuer if they wish.

For example, in the ecosystem modelled there were only two hospitals - lets call them Glasgow Hospital and Edinburgh hospital for simplicity, Edinburgh may request proof of a doctors name and DoB contained within an Identity Verification credential and only accept this proof if it was issued by Glasgow hospital (represented by it's DID).

This was a complex interaction that was challenging to represent within the scenario, so verbal communication was used to outline the majority of it. The actor representing the entity asking for a proof from the doctor, wrote this request on a piece of card which was then passed to the doctor. It was made clear that this communication went across an already established DID connection and that proof requests could include a subset of attributes from across multiple credentials.

### Credential presentation

A credential presentation was the final SSI interaction used repeatedly throughout the scenario. This is the process by which a doctor, through the use of their digital wallet, responds to a proof request by creating a cryptographic presentation from one of more verifiable credentials within their wallet.

Within the scenario, this was illustrated by filling out a card and creating a wet signature on this card. The card was then passed to the entity/actor that requested the proof request. Again, a lot of the complexity was conveyed verbally. It was explained that a credential presentation is not the same as giving the credential within a digital wallet to the entity requesting it. A presentation is a new and distinct cryptographic object, that is created from one or more credentials, and can contain any number of attributes from these credentials. This has both privacy and security benefits.

Going back to the hospital example, Edinburgh may request a doctor to prove their name, date of birth and GMC licence number when initially employing a new doctor. This proof request can be responded to in a single credential presentation that combines the attributes from two separate credentials originally issued by different entities into a new object that is still cryptographically verifiable using the public keys of the issuers. The keys that are publicly available and were stuck on the wall during the initial setup.

## Evaluating SSI design principles

The last session of the workshop, involved presenting SSI in the context of traditional identity management systems such as federated and user centric identity management systems.

Then asking for positive and negative aspects of the SSI system presented to them. Challenges to it's implementation were also collected through this process.

After this, eight design principles and their definitions selected from the literature were presented to the group. Mentimeter, a tool for audience engagement, was used to gauge how the participants valued these design principles. A couple of additional questions were also asked.

Before we introduced the design principles from the literature to our audience, we asked them what they thought was the most important feature of future technology that would help them trust it. The list included the following:

-   Use all over the ecosystem, all entities need to participate.

-   Attention for end users, usability, convenience, workable.

-   Buy-in from government and NHS.

-   Future proof.

-   Resilient, reliable, fraud resilient, protection, security.

-   Control.

-   Transparent data sharing, clear, clarity.

Comparing this list with the list of design principles that we distilled from the literature demonstrates that our audience adds two specific principles to the generic list. The first is that they find it important to know that all entities will be involved in the SSI ecosystem, including the government and the NHS. The success of the system depends on buy-in of all of the involved entities, and that is something that should be developed from the start. Second is the attention for usability and convenience. User engagement is important from the start and throughout the development process.

We selected eight principles from the literature and explained the definitions to the participants. Then we asked them to rank the principles in order of importance. The majority selected protection as the most important, followed by control & consent and interoperability. Then we asked to rank importance for each individual principle. Again, the highest scores were for: protection; control and consent; and interoperability. Figures and show the results of the Mentimeter polls. This was used to get a sense of the room and the figures should be interpreted with that in mind

# Workshop results

The workshop led to a number of key learning elements about identity management for healthcare professionals. This can be generally summarised as being complex, fragmented; and time consuming in its current form. The process mapping session led to an increased understanding of the identity landscape within healthcare. We began the session with eight identity moments that we framed as being chronological, the idea behind this was to provide a rough skeleton for participants to expand on in their process maps. It came to light that we missed a key identity moment within a doctors career, namely appraisal and re-validation. A process whereby healthcare professionals must prove to relevant authorities that they have gone through the relevant training to keep their skills up to date such that they can still practice. This is a repetitive process that occurs every three years. It was interesting to find out that even the top level professionals in attendance typically spent a couple of days every three years getting their documents in order for this procedure.

Another point of clarification was that while we positioned the 8 identity moments as chronological, a lot of them happen in parallel. For example, a medical student typically gets identity checked by the GMC prior to graduating, they also spend their final year applying for jobs so that on graduation they are ready to begin their career immediately. It was pointed out that there is no strict temporal relationship between the eight stages initially identified and a large part of the frustrations come from the fact that the majority of these stages are repeated over the course of a doctors career. Each time requiring the same time consuming procedure.

A good example of this comes from what we broadly termed doctor rotation, something commonly experienced within the healthcare system. Especially for young doctors who can rotate to a new location and role as often as every four months. While this is reduces significantly as doctors progress in their career, it still a common occurrence. Every time a doctor moves to a new hospital there are a number of tasks that the doctor needs to complete in order to on-board into the institution:

-   They must complete a full identity verification check to the NHS standards.

-   They must provide evidence supporting all the claims they made in their application. This is typically verified by a consultant and their were estimates it takes up to a full day of their time.

-   They must complete an induction session, taking between one and two days. This induction is required for both new locations (e.g. hospitals) and new trusts and generally includes repeated content due to lack of standardisation across locations and trusts.

-   They must organise an appointment with occupational health, to prove they have up to date vaccinations. If they don't or are unable to prove they do then doctors must have their vaccinations refreshed. Often leading to needless re-vaccinations.

-

Another big bugbear of the group, particularly from attendees still going through training, was keeping track of all the training events they had attended. Including the need to enter this information into multiple distinct silos. This was further exacerbated by frustrating user experiences, different document format requirements and even reviewers specifically asking for physical copies due to the added burden that reviewing digitally uploaded documents entailed. A clear example of how digital tools have failed healthcare professionals by increasing rather than reducing the burden placed on them to manage their professional careers.

To summarise, the process mapping and ensuing discussions highlighted numerous frustrations experienced by healthcare professionals just to meet the requirements for managing their career. A phrase that came up was the need to professionalise the digital experience throughout a doctors career.

The method for conveying the capabilities of SSI and how these might change the identity moments a doctor experiences throughout their career was a success. The majority of participants were engaged and achieved a good level of understanding as shown through the questions that this generated. Many of the participants indicated that they would be receptive to these changes being implemented, in particular a trainee at the RCPE was very supportive.

The workshops additionally surfaced a number of challenges that attendees thought would need be to overcome in order to roll this out within a healthcare system. Many participants were senior professionals within healthcare, so had experiences of other attempts to digitise aspects of healthcare. The three core challenges identified were:

-   **Funding and business model**: Who is paying for these tools and what is in it for them. There is no clear path to monetisation of the system, however for this to work it needs to be well funded in order to produce something that can scale. It was suggested that part of doctors annual fees and membership to organisations like the GMC and the Royal Colleges could be allocated towards a system like this.

-   **Adoption**: An SSI system works only when it achieves large scale adoption. In order for this to happen it needs to be led on a national level and show the benefit to the entire ecosystem. It was also pointed out that while benefit to doctors is relatively easy to show it needs to be able to show benefit to the individual trusted entities. They need to be the ones advocating for this system not the doctors. All stakeholders must be clear on why this shift is happening and what the benefit is too them.

-   **Overreaching**: This technology is new and relatively untested at scale. An interesting point was made that it is important to take small steps to prove its value and build human trust before expanding the scope. Attempting anything too large too quickly and failing could be disastrous for the trust placed in the system and underlying technology.

# Conclusion

To conclude, participants were largely in favour of the technology described in the workshop. At least from the viewpoint of it's worth exploring further. A number of them were keen to be involved in further iterations, offering support finding additional doctors and medical students to further explore the requirements of any technical solution from their perspective. This research as further reinforced the importance of developing user driven systems, ensuring that any solution that does get rolled out is meeting the actual needs of those it is designed for. The research identified overlooked design principles, but also showed that the design principles commonly referred to within the academic literature, when explained, were also considered important by the system users within a healthcare context.

Next steps include developing a proof of concept which can then be validated with real users, this will include validating it against the properties deemed important by participants: Usability and Security. Additionally, A medical students identity interactions in themselves seem complex, it would be valuable to run another workshop specifically focusing on this area. This should provide a different perspective from that gained throughout this workshop.

The professionalisation of the digital experience within a doctors career is long overdue. The COVID-19 crisis has highlighted just how important these solutions can be for the any health service. Staffing needs fluctuate widely across the country, as different regions and hospitals hit their peaks of this crisis at different times. The ability to redeploy doctors to highly stressed areas within the service in minutes rather that days - See figure . While a portion of these induction processes can perhaps be ignored, trusts still have to meet strict legal requirements around identity verification  - this all takes time which could be spent saving lives. In addition to the staffing flexibility an SSI based solution could bring, it also has huge potential to cut costs and increase efficiency. A report from the McKinsey Global Institute estimate that institutions requiring high assurance identification for on-boarding could see a 90 percent reduction in costs . The World Economic forum estimates savings of up to \$205 Billion from seamless and secure sharing of medical information between healthcare organisations .

This seems to be the opportune moment to develop and deploy an SSI solution. However, it is imperative that any solution that is developed, especially if rushed through during a crisis, is clear about what it wants to achieve for who. Furthermore, these solutions should identify a process by which to validate how well they are meeting the predefined aims and requirements of those who are actually going to be using it - healthcare professionals.

# Acknowledgements

The authors would like to extend their thanks to Dr Manreet Nijjar, an infectious disease consultant and co-founder of truu.id, a company working to realise much of what is discussed throughout this paper. His attendance at the workshop was invaluable. Also thanks to Professor Derek Bell and Pernille Marqvardsen without whom this workshop would not have been possible.


abstract: The composition of Jupiter and the primordial distribution of the heavy elements are determined by its formation history. As a result, in order to constrain the primordial internal structure of Jupiter the growth of the core and the deposition and settling of accreted planetesimals must be followed in detail. In this paper we determine the distribution of the heavy elements in proto-Jupiter and determine the mass and composition of the core. We find that while the outer envelope of proto-Jupiter is typically convective and has an homogeneous composition, the innermost regions have compositional gradients. In addition, the existence of heavy elements in the envelope leads to much higher internal temperatures (several times 10$^4$ K) than in the case of a hydrogen-helium envelope. The derived core mass depends on the actual definition of the core: if the core is defined as the region in which the heavy-element mass fraction is above some limit (say 0.5), then it can be much more massive ($\sim$ 15 M$_{\oplus}$) and more extended (10% of the planet's radius) than in the case where the core is just the region with 100% heavy elements. In the former case Jupiter's core also consists of hydrogen and helium. Our results should be taken into account when constructing internal structure models of Jupiter and when interpreting the upcoming data from the *Juno* (NASA) mission.
author: Michael Lozovsky$^{1,2}$, Ravit Helled$^{1,2,*}$, Eric D. Rosenberg$^1$ & Peter Bodenheimer$^{3}$
title: Jupiter's formation and its primordial internal structure

# Introduction

In the standard model for giant planet formation, core accretion (hereafter, *CA*), the formation of a gaseous planet begins with the growth of a heavy-element core . The exact mass and composition of the core are unknown, but it is commonly agreed that it should be of the order of at least several Earth masses (M$_{\oplus}$) in order to allow the followup of gas accretion. The core's composition is assumed to be rocky and/or icy. Giant planet formation models also typically assume that the accreted solid material (planetesimals) falls all the way to the center, increasing the core's mass. Indeed, at the beginning of their formation, giant planets are capable of binding only a very tenuous envelope so that in-falling planetesimals essentially reach the core directly, but as the growing planet accretes a gaseous atmosphere, the planetesimals do not necessarily reach the core, but instead, dissolve in the gaseous envelope.

A major science objective in giant planet studies is to relate the observed planetary structure to the origin and evolution of the planet. For years now, the existence of a heavy-element (high-Z) core and/or enriched envelope has been taken as support of the *CA* model. The connection between planetary origin and internal structure, however, is non trivial, and in fact, different formation mechanisms and birth environments lead to a large range of compositions and internal structures . Even within the *CA* framework, the primordial internal structures of the planets are not well constrained. For giant exoplanets, an estimate of the total mass of heavy elements in the planet is sufficient for planetary characteriszation because (at present) it is difficult to constrain the heavy-element distribution. A possible approach to this question employs the tidal Love number and is applied to the exoplanet HAT-P 13b by and . This is different for the case of Jupiter for which we have accurate measurements of the gravitational field, and therefore, estimates of its internal density distribution can be determined.

In this paper, we determine the heavy-element distribution and core mass in proto-Jupiter at different stages during its formation in the *CA* model. We follow the accreted planetesimals as they enter the planetary envelope and determine their distribution accounting for settling and convective mixing. Formation models with different solid-surface densities and planetesimal sizes are considered, as well as different definitions of the planetary core. This work aims to provide a more complete theoretical framework for the interpretation of *Juno* data. The initial orbit insertion of the *Juno* (NASA) spacecraft was on July 4th. *Juno* will measure Jupiter's gravitational moments $J_{n}$ and atmospheric composition below the cloud-level . These measurements will provide tighter constraints on Jupiter's density distribution, and hence, its internal structure, with the aim of using this information to better understand Jupiter's origin. In order to link Jupiter's internal structure and formation history, we first need to understand what is the expected internal structure from formation models, and its sensitivity to the various model assumptions. This work aims to explore and put limits on the primordial internal structure of Jupiter, in particular, its core properties.

# Methods and model assumptions

## Planet formation models

In order to determine the heavy-element distribution in proto-Jupiter, we use four giant planet formation models, whose properties are summarized in Table 1. Models are produced using the standard core accretion code described in and updated by . Model-D is the model with solid surface density $\sigma=10$ g cm$^{-2}$ described by Movshovitz et al. (2010). In this model, the grain opacities were determined through detailed simulations of grain settling and coagulation. In models A through C, the grain opacities were determined approximately as a fraction $f\ll1$ of interstellar opacities, with $f$ adjusted to reproduce the formation times found by Movshovitz et al. for $\sigma=10$ g cm$^{-2}$ and $\sigma=6$ g cm$^{-2}$. The formation models provide the distribution of the physical properties of the planetary envelope such as the temperature $T$, pressure $P$, luminosity $L$, opacity $\kappa$, mass $M$, and the total mass of gas (hydrogen and helium in proto-solar ratio) and the total mass of heavy elements as a function of time.

These formation models are derived under the assumption that all the planetesimals settle to the center and join the core, and the inferred crossover time and crossover mass (mass of solids equals the mass of hydrogen-helium gas $M_Z$ = $M_{H+He}$) correspond to the model under this assumption. If the heavy elements are allowed to stay in the envelope and are accounted for self-consistently in the formation model, the formation history, and therefore also crossover mass and crossover time are expected to change as well.

As can be seen from the table, the formation timescale and the core mass are sensitive to the assumed solid-surface densities and planetesimal sizes . Higher solid-surface density $\sigma$ and smaller planetesimal sizes lead to faster growth. The crossover time for the different models ranges between 0.9 and 1.5 Myr. These timescales, however, are calculated for envelopes that are metal-free, the time to reach crossover is expected to be shorter if the heavy elements are taken into account in the calculation , and as a result, these crossover times should be taken as upper bounds.

## Accretion and settling of heavy elements

Note that in the models of Pollack et al. (1996) it was assumed that all the added planetesimal material eventually sank to the core; here we relax that assumption. The accreted planetesimals are assumed to be composed of water (H$_2$O), rock (SiO$_2$), and organic material (CHON) in relative mass fractions of 0.4:0.3:0.3, respectively. The organic material is represented by Hexacosane (C$_{26}$H$_{54}$), which is a paraffin-like substance. The accretion rate of planetesimals is given by the standard fundamental expression (e.g., Equation (1) of Movshovitz et al.), with the gravitational enhancement factor $F_g$ given by . We follow the trajectory of the planetesimal as they pass through the protoplanetary envelope. At each step of the trajectory we compute the motion of the planetesimals in response to gas drag and gravitational forces. The effects of heating, ablation and fragmentation of planetesimals are also included. This calculation provides the distribution of heavy elements in the planetary envelope (see for details).

When the heavy elements (planetesimals) dissolve, they are assumed to be fully vaporized, then, the amount of heavy material that remains at a given layer is limited by its vapor pressure and temperature. Following , we determine the partial pressure of the ablated heavy elements and compare it to the vapor pressure of the layer. If the partial pressure exceeds the vapor pressure, some of the accreted material is assumed to condense and settle to the layer below, leaving the (upper) layer fully saturated. The partial pressure of a given ablated material is calculated using the ideal gas law by, $$P=\frac{\Re\delta m T}{V\mu} \quad,$$ where $\Re$ is the universal gas constant, $\delta m$ is the mass ablated within the layer, $T$ is the temperature, $V$ is the volume of the layer (shell), and $\mu$ is the mean molecular weight of the material. We assume that the vapor pressure of a given substance above the critical temperature becomes infinite. The infinite vapor pressures allow any amount of the substance to be accommodated in the vapor without reaching saturation. The vapor pressure for the different materials is taken from and : $$\begin{aligned}
P^{water}_{vap}&=&e^{-5640.34/T+28.867}, T_{crit} = 647.3 K  \quad,\\
P^{CHON}_{vap}&=&6.46 \cdot 10^{13} e^{-12484.5/T}, T_{crit} = 843.4 K \quad,\\
P^{rock}_{vap}&=&10^{-24605/T+13.176}, T_{crit} = 4,000 K \quad.
%P^{CHON}_{vap}&=&6.46 \cdot 10^{13} e^{-12484.5/T}, T_{crit} = 4,000 K \quad.
\end{aligned}$$ The procedure is then repeated in each successive layer. If the heavy elements reach the innermost layer, they are added to the center of the planet, i.e., the core.

## The heavy-element distribution

The heavy-element mass fraction (Z) at a given layer is calculated by, $$Z=\frac{M_{SiO_2}+M_{H_2O}+M_{CHON} }{M_{SiO_2}+M_{H_2O}+M_{CHON}+M_{H+He}} \quad,$$ where $M_{SiO_2}$, $M_{H_2O}$, $M_{CHON}$, and $M_{H+He}$ are the masses of rock, water, organics, and hydrogen+helium, respectively. In order to derive the Z-profile (heavy-element distribution) within the proto-planet, we first need to determine the mass distribution of the three different materials: rock (SiO$_2$), water (H$_2$O) and organics (CHON). The different vapor pressures of the different accreted materials lead to different mass distributions after settling is considered. Figure shows the mass distributions of the various components at four different time steps for Model-B. The mass distributions are shown before (green) and after (blue) settling is considered. Rock is represented by the dashed-dotted curve, while organics and water are represented by the solid and dashed curves, respectively. The mass of hydrogen and helium (H+He) is represented by the gray-thin curve.

Several conclusions can be drawn from the figure. First, in comparison to H+He, even before settling is applied, the heavy elements are more concentrated towards the planetary center. This is because planetesimals lose mass and break up only when the envelope's density and temperature are high enough for the planetesimals to experience sufficient gas drag. Second, after settling is considered, the distribution of the different materials become non-homogenous: while water and organics tend to remain where they are originally deposited, silicates settle toward the center. This may suggest that the (primordial) envelopes of giant planets are more enriched with volatiles while the refractory materials are concentrated in the deep interior.

## Convective mixing and EOS

Although we find that the distribution of heavy elements due to planetesimal accretion and settling is inhomogeneous, convective mixing can homogenize the envelope's composition. The presence of convection in regions with composition gradients is determined by the ratio between the destabilizing temperature gradient and the stabilizing composition gradient (the Ledoux criterion); if the latter is dominant - the region is assumed to be radiative/conductive and no mixing occurs, although layered-convection could develop in such regions . The stability against convection in each layer accounting for the composition gradients using the Ledoux criterion is given by: $$\nabla-\nabla_{ad}-\nabla_{X}<0 \quad,$$ where $\nabla \equiv \frac{dlnT}{dlnP}$, and $\nabla_{ad}$ is the adiabatic gradient, and $\nabla_{X}\equiv\frac{\partial\ln T(p,\rho,X)}{\partial X_{j}}\cdot\frac{dX_{j}}{d\ln P}$. When convection is inefficient $\nabla \sim \nabla_{rad}$, where $\nabla_{rad}$ is the radiative/conductive gradient.

In order to compute all the relevant physical properties that are required for the convection criterion calculation (e.g., $\nabla_{X},\nabla_{ad}, \kappa$), we must use an equation of state (EOS). The EOS is calculated using the SCVH EOS tables by for hydrogen and helium with an extension for low pressure and temperatures. Since there is no EOS available for organic materials, the heavy elements are represented by a mixture of H$_2$O and SiO$_2$ using the QEOS method . More details on the QEOS calculation can be found in and references therein.

We assume that regions with shallow composition gradients (the outer layers) mix if they are unstable to convection according to the Ledoux criterion, resulting in a homogenous composition with the average Z-value. The outermost regions of the protoplanet are not convective but radiative , and are too cold to maintain heavy elements in a gaseous phase. As a result, grains are likely to form and settle towards inner regions, where they evaporate and mix with the surrounding gas. In order to account for this effect, we settle the heavy material from atmospheric regions with temperatures. For the silicates we take a critical temperature of 1500 K, and of 650 K for the water and organics (hexacosane). This results in two steps in the outer regions of the planet: the outermost region up to a temperature of 650 K is metal-free, there is an intermediate layer of vapor water and organics, and at temperatures higher than 1500K also of vapor rock. The outermost part of the proto-planet is then depleted in heavy elements and has Z $\sim$ 0. The heavy elements that were found to be in these outer regions are added to deeper regions and their contribution to the local heavy-element concentration is included.

The original envelope's temperature (as well as density and pressure) is calculated assuming that all the heavy elements go to the center, and the envelope's composition is a mixture of hydrogen and helium in proto-solar ratio, i.e., the hydrogen-to-helium ratio is set to be 0.705:0.275 . Since in our calculation the heavy elements can remain in the envelope, the contribution of the heavy materials to the envelope's temperature must be considered. In addition, because the temperature profile determines the efficiency of convection, it is important to understand how the heavy elements affect the envelope's temperature. Different materials have different effects on the temperature, and as a result, we compare four temperature profiles: the first is the original temperature profile assuming a H+He envelope, and the other three are the temperature profiles that are inferred when accounting for the effect of the heavy elements assuming three different compositions: pure SiO$_2$, pure H$_2$O, and a SiO$_2$-H$_2$O mixture. These calculations use the original temperature, pressure and density of the envelope and the distribution of heavy material that is dissolved in the envelope ($X,Y,Z$). We then compute the modified temperature profiles that corresponds to the original pressure of the envelope. The temperature as a function of normalized mass for different compositions are presented in Figure .

It is clear from the figure that the addition of heavy elements to the envelope increases its temperature, with SiO$_2$ having the largest effect. The increase in temperature is caused by the change in the opacity when the heavy elements are included. In the innermost regions, the opacity value can increase by about a factor of 100. As expected, the temperature profile of the SiO$_2$-H$_2$O mixture falls between the profiles of pure-rock and pure-water. We therefore suggest that the internal temperatures of young giant planets are higher than typically derived by formation models which do not account for this effect. Since the internal temperatures can reach well over 10$^4$ K, it is possible that the small inner core melts and mixes with the envelope as we discuss below. Although the existence of heavy elements in the envelope leads to a significant increase in temperature, the *temperature gradient* remains about the same, and as a result, the identification of the convective regions in the envelope is not expected to change. The temperature gradient in the convection zones is the adiabatic gradient. In order to verify that, we derive the Z-profile for the different calculated temperature profiles and apply the convection criterion for these new conditions. The results are shown in Figure for formation Model-B. In this calculation the core is defined as the innermost region with heavy element mass fraction larger than 0.5 (see the following section). Indeed, the figure suggests that the change of temperature and the assumed composition of the heavy elements do not affect the mixing pattern. This ensures that the heavy-element profiles we derive in this work are realistic, and are not expected to differ much if other materials are assumed. In the following sections the heavy elements are represented by a mixture of water and silica (50%-50%).

## The definition of the core

Defining the core of a giant planet is not trivial. Jupiter's core mass is typically inferred from structure models that fit the measured gravitational field of the planet . Typically, standard 3-layer interior models infer a core mass between zero and $\sim$`<!-- -->`{=html}10 M$_{\oplus}$, while the total heavy element mass is uncertain and is estimated to be between 10 and 40 M$_{\oplus}$ . Alternative models suggest a massive core (about 14 - 18 M$_{\oplus}$) and a smaller enrichment in heavy elements in Jupiter's gaseous envelope . However, despite the accuracy of interior models, the chemical composition and physical-state of the core cannot be inferred. Moreover, even if a core exists, it is not clear how distinct it is from the layers above it, although for simplicity, it is typically taken to be a separate region, and the core-envelope-boundary (hereafter, CEB) is assumed to have a density (and composition) discontinuity. It is also possible that the CEB is "bleary" (and therefore, not well-defined), and the change in density (and composition) is more continuous. In that case, the core could be more extended and could even consist of some hydrogen and helium .

The original formation models have a small primordial (solid) core in the early stages. The simulations begin with a Mars-size object that accretes planetesimals and gas. The actual core, however, is not modeled. The only thing that is followed is the increase in the core's mass due to the ongoing planetesimal accretion. The innermost region that is physically modeled is the bottom of the envelope, just above the core. Therefore, any possible interaction between the core with the surrounding gaseous envelope is neglected. As suggested by the formation models used in this work, once the core mass reaches $\sim$ 1-2M$_{\oplus}$, the planetesimals dissolve in the envelope. This is in agreement with other giant planet formation models such as the one presented by Pollack et al. (1996) and Venturini et al. (2016). If the core is defined as a pure heavy-element region, the core mass is not expected to increase significantly, suggesting that Jupiter's core is smaller than the typical core masses inferred by *CA* models. Thus, as we discuss below, it may be that our perception of the core should be different (and less conservative), and that the cores of giant planets could be defined as the innermost region that is enriched with heavy elements. In this case, the core is more massive, larger, and diluted with light materials (i.e., H+He). Similar diluted core models for Jupiter have been considered by .

In this work the core is taken to be the innermost region with a heavy-element mass fraction (Z) that is larger than some critical value. We consider two critical values: Core-i with Z$\geq$`<!-- -->`{=html}0.9, and Core-ii with Z$\geq$`<!-- -->`{=html}0.5. In practice, due to the simplifications assumed for computing the disruption and mixing of the accreted material, it can happen that during the runaway gas accretion phase, the Z-profiles dilute too much. This causes the region of Z $\geq$ Z$_{crit}$ to shrink. However, this is a numerical artifact, because the planetesimal disruption model assumes that the envelope is metal-free. In reality, once a steep Z-profile exists in the envelope, the additional accretion of H+He should stay mainly on the top of the planet, leading to an onion-like structure . Following this argument, and in order to not introduce a numerical bias in the mass of the core, we add, to the region of Z $\geq$ Z$_{crit}$, the necessary layers to the core region in order to reach (at least) the same mass of core we had in the previous time step. As we show below, under our core definition, the core is not necessarily distinct from the envelope due to the existence of composition gradients within the planet. This is rather different from the "standard" view of Jupiter's core as a pure-Z region and the existence of a density discontinuity between the core and the envelope.

The rate of solid accretion during the phase of runaway gas accretion is not well-understood. After crossover is reached, the proto-planet starts to accrete gas rapidly, and the planetary composition from this point on depends on the composition of the accreted gas as well as of the planetesimal accretion rate during this formation phase, both are poorly known . As a result, more robust predictions in terms of composition and internal structure can be made up to crossover time. Nevertheless, in section we also present calculations in which the planetary formation goes all the way to a Jupiter-mass assuming that the accreted gas has a solar composition, and that no planetesimals are accreted during runaway gas accretion. Thus, on the contrary, if during runaway accretion a large fraction of heavy elements were accreted, the final composition of the envelope would be super-solar super-solar, and in that case our results should be taken as a lower bound for the envelope (atmospheric) enrichment of Jupiter. In addition, it is possible that during rapid gas accretion some material from the outer part of the core will mix into the envelope, and thus reduce the mass of the core. This, however, must be modeled in detail before conclusions on core erosion during formation can be made.

# Results

Figures  - show the distributions of the high-Z material (in mass fraction, $Z$) as a function of normalized mass at different times for the four different formation models. The blue curve represents the original distribution of heavy elements after settling is also included, while the dashed-dotted orange and dashed black curves show the Z-profiles after convective mixing is considered for Core-i, Core-ii, respectively. The time, total mass of heavy elements (M$_Z$), total mass of hydrogen and helium (M$_{H+He}$), and calculated core mass (M$_{core}$) are given in the header of each panel. It can be seen that at early times, the protoplanet is composed of mostly heavy elements, while only the outermost layers are depleted in heavy elements (blue curve). At each time step, we first derive the composition gradient, then the innermost layers with a heavy-element mass fraction $Z$ that is larger than the critical value are added to core, and the rest of the envelope is allowed to mix according to the Ledoux criterion. As discussed above, if the mass of the core region is smaller than the core mass calculated in the previous model, we add a few layers above the core region until the correct core mass is reached. Otherwise, we simply collect all the layers with heavy-element mass fraction that is larger than the critical value, and derive the new core mass. As time progresses, the heavy-element distribution becomes more gradual and but in the inner region the gradient is steep enough to inhibit convective mixing. In all cases, the bottom of the envelope reaches very high temperatures (over $10^4$ K) due to the existence of heavy elements.

It is interesting to note that for the formation models with $\sigma = 6$ g cm$^{-2}$ the distribution of the heavy elements is more gradual than the ones for the case of $\sigma=10$ g cm$^{-2}$. This seems to be linked to the total formation timescale, in particular, the length of the slow gas accretion phase. When $\sigma=10$ g cm$^{-2}$ the planetary structure is more similar to a standard core+envelope structure. Model-D is the closest to having a core+envelope structure since the solid surface density is high, and the planetesimals are large, so even with dissolution of planetesimals in the envelope, most of the accreted heavy elements tend to be in the deep interior.

For the case of Core-ii, the calculated core mass is larger, especially at later times, but the core's density is lower because in this case the core consists of a larger fraction of hydrogen and helium. In addition, the core has a gradual change in the heavy-element mass fraction, which is decreasing towards the core's outer region. Both Core-i and Core-ii consist of hydrogen and helium and have composition gradients. This suggests that the cores of giant planets can have very different physical properties (mass, composition, radius, etc.) and can be more complex than the standard cores that are typically assumed.

The crossover times and the corresponding inferred core masses are summarized in Table and are denoted by $t_{cross}$ and $M_{cross}$. As the planetesimal's size increases, the time to reach crossover increases as well, while for higher solid-surface densities, the formation process is shorter and therefore the time to crossover decreases. This is because small planetesimals tend to form smaller cores, and high solid-surface densities correspond to higher solid accretion rates, which reduce the formation timescale. It should be kept in mind, however, that the crossover times presented here correspond to formation models that assume a metal-free envelope, and the actual crossover time could be significantly shorter when the heavy elements in the envelope are included . Based on the work of , $t_{cross}$ is expected to change by a factor of a few. The derived core masses are between about 5 and 20 $M_{\oplus}$, with the core mass depending on the critical value that is applied as well as on the assumed planetesimal size and solid-surface density. These values are significantly higher than the $\sim$`<!-- -->`{=html}2 M$_{\oplus}$ that is expected from a pure heavy-element core, and at the same time also different from a massive core of a similar mass assuming that all the accreted planetesimals go to the center. Thus, these cores are massive, extended, and have compositional gradients and are not pure-Z.

Figure shows the envelope's (H+He) mass and the core masses for the two core cases as a function of time until crossover is reached for the four formation models. As can be seen from the figure, the calculated core mass is typically smaller than the total heavy element mass for Core-i, but is larger than the total heavy-element mass for Core-ii. For the models with $\sigma = 6$ g cm$^{-2}$, the derived core masses are smaller by more than a factor of two than for the cases with $\sigma = 10$ g cm$^{-2}$. Another interesting thing to note is that the H+He curve and the curve of Core-ii meet at about the same time as the original M$_Z$, although this may suggest that the crossover time is not expected to change much, it is clear that the core properties in our models are very different since Core-ii can contain a large fraction of H+He near crossover as we show in the following section.

## The composition of the core

Since in our analysis the core is defined by a critical Z-value of the innermost layers, we can derive the core's composition as a function of time. Figure shows the derived core composition at various times. The top and bottom correspond for formation models B and C, respectively. We find that as time progresses, the mass of the core and the percentage of hydrogen and helium increase. While the initial core has a similar composition to that of the planetesimals, as it grows in mass, the overall composition changes because of the different distributions of the materials when settling is considered. The core is found to consist of a larger fraction of rock compared to water and CHON in Model-C and Model-D (formation models with $\sigma$=10 g/cm$^2$) , and has almost the initial proportions for Model-A and Model-B (formation models with $\sigma$=6 g/cm$^2$). The derived core compositions for the four formation models at crossover time are listed in Table .

It is interesting to note that although the derived core masses are different, the composition of the core is about the same. Moreover, we find that the core's composition is more sensitive to the assumed solid-surface density than to the planetesimals' size. In addition, the difference between the case of Core-i and Core-ii is not very large, which suggests that there are not many internal layers with heavy-element fractions between Z$\geq$`<!-- -->`{=html}0.9 and Z$\geq$`<!-- -->`{=html}0.5, i.e., the composition gradient is relatively steep. This is indeed demonstrated in the figures that show the distribution of heavy elements within the planets at various times.

## Modeling the formation up to a Jupiter Mass

In the previous sections, the formation of Jupiter was followed only up to crossover time (i.e., when $M_{H+He}=M_{Z}$ in the original formation models). Here we follow the planetary formation including runaway gas accretion up to the stage when Jupiter's mass is reached for Model-A and Model-C. The distribution of the heavy elements at various times is shown in Figure and Figure , respectively. The accreted gas is assumed to have a proto-solar composition. We consider the two different core definitions. After crossover is reached, the gas accretion rate increases rapidly and the proto-planet accretes large amounts of gas (H+He). The total mass of the planet increases rapidly and the core becomes very small relative to the envelope. The most massive cores we derive are for Model-C, with a mass of about 13 M$_{\oplus}$ and 20 M$_{\oplus}$, for the cases of Core-i and Core-ii, respectively.

As can be seen from the figures, when we allow the outer regions to mix by convection the original heavy-element distribution (blue-curve) can break into a few different regions, with the outermost regions becomes nearly metal-free due to grain settling. Towards the end of the formation, convective regions are found to be separated by stable (radiative/conductive) layers, resulting in "stairs". These stairs could be a numerical artifact, but they might also indicate that giant planets could have several convective regions that are separated by thin radiative layers . Regions with high fraction of heavy elements that are found to be stable against convection could in principle develop layered-convection . The importance of the primordial internal structure of Jupiter on its planetary evolution has been recently investigated by our group , and we hope to combine these two aspects self-consistently in the future. In the innermost regions with the steep composition gradients, slow mixing could essentially occur by double-diffusive/layered convection at later stages in the planetary evolution. We therefore suggest that future giant planet formation and evolution models should account for this effect, as it can change the predicted distribution of heavy elements in proto-Jupiter and the cooling history of the planet .

Figure shows the final models for Core-i and Core-ii for Model-A (top) and Model-C (bottom). The "final model" in our case is defined by the mass of the planet, i.e., when the planet reaches a mass of $\sim 1M_J$ and gas accretion is terminated. In both cases, there is an inner region with a composition gradient (above the small primordial core). While this region is of the order of 5% of the planet's radius, this configuration can affect the long-term evolution of the planet. The envelope above the core is found to be fully mixed, suggesting an adiabatic outer envelope. The inner regions with composition gradients can mimic the existence of a massive core. As a result, this option should be accounted for when inferring Jupiter's core mass from gravitational data.

# Discussion & Conclusions

We present a calculation of Jupiter's formation and primordial internal structure in the *CA* model, including the enrichment of the planetary envelope as a result of planetesimal accretion and settling. We follow the distribution of heavy elements within the proto-planet during its growth, taking into account the re-distribution of heavy elements due to settling and convective mixing in the outer envelope. It is found that a substantial amount of the ablated heavy material remains in the planetary envelope. Since different assumed solid-surface densities and planetesimal sizes lead to different core masses, it is clear that the birth environment of the planet has an impact on its final internal structure.

If the core is defined by a pure heavy-element region that is not interacting with the enriched envelope, Jupiter's core is predicted to have a mass of $\sim$ 1-2M$_{\oplus}$. After that core mass is reached, the accreted planetesimals dissolve in the envelope. Here, we consider an alternative definition of Jupiter's core, accounting for two different critical values for Z and investigate how they affect the predicted internal structure and core mass of proto-Jupiter. We find that under this definition Jupiter's core is massive ($\sim$ 15 -20 M$_{\oplus}$) but also consists of a non-negligible fraction of H+He. Naturally, when the core is defined by Z$>$`<!-- -->`{=html}0.5, the inferred core mass is larger, and the core is more extended and has larger fractions of H+He. At crossover, the fraction of H+He for the core definition of Z$>$`<!-- -->`{=html}0.9 is typically 4-6 %, and in the case of Z$>$`<!-- -->`{=html}0.5, 11-15 %. Our analysis suggests that traditional planet formation models considering a heavy-element core surrounded by a H+He envelope are over-simplified, and future formation (and structure) models should account for the existence of heavy elements in the envelope, and their distribution self-consistently. This will lead to a more accurate prediction of the primordial internal structure of giant planets, and in particular, their core masses. We suggest that a natural next step is to follow the evolution of the planet and investigate whether the composition gradients will persist in Jupiter today .

While in most *CA* models the terms "heavy material" and "core" are essentially the same, we show that there is an important difference between the two, because most of the accreted heavy elements remain in the planetary envelope, and the core mass is significantly smaller than the total heavy-element mass. When convective mixing is considered, we find that the heavy elements are homogeneously distributed along the envelope. Thus, the innermost regions which have a steep enough composition gradient can remain stable against convection. These regions can also consist of hydrogen and helium and could be viewed as "extra-extended cores". The "extended cores" are of the order of 20 M$_{\oplus}$ in mass, but with lower density than that of a pure-Z core due to the existence of H+He. Such a core should be considered in future internal structure models of Jupiter. The results of this work are relevant for the data interpretation from the *Juno* (NASA) mission to Jupiter. We suggest that Jupiter's core can be significantly smaller than predicted by standard core accretion models. At the same time, we also find that the innermost region of Jupiter can be enriched in heavy elements, and mimic a massive core, with the difference that the core is larger and has a relatively low mean density. We hope that with *Juno's* accurate gravitational measurements it will be possible to discriminate between the no/small core case, and the extended massive (but not very dense) core case for Jupiter. Since our model suggests that composition gradients may exist in Jupiter's deep interior, such a (non-adiabatic) configuration should be considered in structure models. A non-adiabatic interior can affect the temperature profile within the planet and the efficiency of convection.

Our study emphasizes the importance of determining the heavy-element accretion rate during runaway gas accretion. The predicted composition of the Jupiter (and giant planets in general) depends on the *assumed* gas composition and the solid accretion rate that is expected during runaway gas accretion. If during runaway a significant amount of heavy elements are accreted onto the planet, the composition of the outer envelope could be enriched as well. It is therefore extremely important to determine the heavy-element accretion rate during the last stages of giant planet formation, since it is directly linked to the prediction of the planetary composition .

The work presented here should be taken only as a first step towards more advanced and detailed investigations of Jupiter's formation and primordial internal structure. It is clear that the existence of heavy elements in the envelope can affect the growth history of giant planets, the physical properties of the envelope, and the predicted primordial internal structure and these should be simulated and included in future giant planet formation models. Future studies could also include the impact of the heavy elements on the (gas+dust) opacity in the envelope as well as re-condensation of the heavy elements in the envelope and the formation of clouds for various species, and the possibility of layered-convection in regions where composition gradients exist. Moreover, this work has not included miscibility of the materials in hydrogen . This could also affect the evolution of the planet and the predicted internal structure. Finally, our study demonstrates the importance of simulating the core in more detail. It would be desirable to model the core using physical equations of state, and to investigate the core-envelope interaction. A more detailed analysis of the core's physical properties, its cooling rate, and the properties of the core-envelope boundary are crucial for constraining the internal structure of Jupiter. Such studies can put tighter limits on the predicted core mass (and physical properties) of Jupiter's primordial core.

## Acknowledgments

We thank D. Stevenson, A. Vazan, A. Kovez, J. Venturini, and M. Podolak for valuable discussions and suggestions. R. H. acknowledges support from the Israel Space Agency under grant 3-11485, and from the United States - Israel Binational Science Foundation (BSF) grant 2014112. P. B. received support from a grant from the NASA Origins program.

|  |  |  |  |  |
|:--:|:--:|:--:|:--:|:--:|
| Formation Model | $\sigma$ | planetesimal size | M$_{\text{core}}$ at crossover time | crossover time |
|  | ($g/cm^{2}$) | ($km$) | ($M_\oplus$) | ($Myr$) |
| Model-A | 6 | 100 | 7.5 | 1.54 |
| Model-B | 6 | 0.5 | 7.6 | 1.33 |
| Model-C | 10 | 1 | 15.7 | 0.90 |
| Model-D | 10 | 100 | 16.0 | 0.94 |

Properties of the four baseline formation models.

|  |  |  |  |  |
|:---|:---|:---|:---|:---|
| Formation Model | $M_{core}$, Core-i | $t_{cross}$, Core-i | $M_{core}$, Core-ii | $t_{cross}$, Core-ii |
|  | ($M_{\oplus}$) | (Myr) | ($M_{\oplus}$) | (Myr) |
| Model-A | 5.30 | 1.39 | 8.09 | 1.55 |
| Model-B | 5.74 | 1.20 | 8.08 | 1.33 |
| Model-C | 13.28 | 0.86 | 19.72 | 0.90 |
| Model-D | 13.17 | 0.92 | 17.98 | 0.96 |

The inferred core mass and modified crossover time ($M_{Core}=M_{H+He}$ instead of the original $M_Z=M_{H+He}$) for the different formation models and various core definitions.

|   **Core-i**    |            |             |            |          |
|:---------------:|:----------:|:-----------:|:----------:|:--------:|
| Formation Model | $H+He$ (%) | SiO$_2$ (%) | H$_2$O (%) | CHON (%) |
|     Model-A     |    4.7     |    28.6     |    38.2    |   28.6   |
|     Model-B     |    5.2     |    28.5     |    37.9    |   28.4   |
|     Model-C     |    3.7     |    37.3     |    30.1    |   28.9   |
|     Model-D     |    5.2     |    36.2     |    30.1    |   28.4   |
|   **Core-ii**   |            |             |            |          |
| Formation Model | $H+He$ (%) | SiO$_2$ (%) | H$_2$O (%) | CHON (%) |
|     Model-A     |    21.0    |    23.7     |    31.6    |   23.7   |
|     Model-B     |    19.0    |    24.4     |    32.3    |   24.2   |
|     Model-C     |    19.2    |    31.6     |    25.0    |   24.2   |
|     Model-D     |    14.0    |    33.2     |    27.0    |   25.8   |

The composition of Jupiter's core at crossover for Core-i (top) and Core-ii (bottom) for the four formation models (see text for details).