Authentication across decentralized and centralized identities

Abstract

A decentralized identity is permitted to authenticate to a centralized identity system on behalf of a centralized identity, and / or a centralized identity is permitted to authenticate to a decentralized identity system on behalf of a decentralized identity. Thus, the principles described herein permit authentication across decentralized and centralized domains. An identity system receives and registers a delegation for a first identity to authenticate as a second identity, wherein one of the identities is a decentralized identity and one of the identities is a centralized identity. Thereafter, when the identity system receives a communication from the first identity to access a resource owned by the second identity, the identity system accesses the registry to determine that the first identity is authorized to authenticate as the second identity, authenticates the first identity as the second identity, and authorizes the first identity to access the resource owned by the second identity.

Description

Background Art

[0001] Most of the documents or records that prove identity currently in use are issued by centralized organizations, such as governments, schools, employers, or other service centers or regulatory organizations. These organizations usually maintain the identity of each member in a centralized identity management system. A centralized identity management system is a centralized information system that is used by organizations to manage published identities, their authentication, authorization, roles, and privileges. Centralized identity management systems have been considered secure because they usually use professionally maintained hardware and software. Typically, the identity issuing organization sets the terms and requirements for registering people with the organization. Finally, when one party needs to verify the identity of another party, the verifying party usually needs to go through the centralized identity management system to obtain information to verify and / or authenticate the identity of the other party.

[0002] A decentralized identifier (DID) is a new type of identifier that is independent of any centralized registry, identity provider, or certificate authority. Distributed ledger technology (such as blockchain) provides the opportunity to use fully decentralized identifiers. Distributed ledger technology uses a global distributed ledger to record transactions between two or more parties in a verifiable manner. Once a transaction is recorded, the data in that part of the ledger cannot be retroactively changed without changing all subsequent parts of the ledger, which provides a fairly secure platform. In a broader sense, a DID may further include a DID method that specifies how a client can register, replace, rotate, and / or recover a key. A DID method may also set an expiration date for a key.

[0003] The subject matter claimed herein is not limited to embodiments that solve any disadvantages or that operate only in environments such as described above. Rather, this background is provided merely to illustrate one exemplary technology area in which some embodiments described herein may be practiced. Summary of the invention

[0004] At least some embodiments described herein relate to allowing a decentralized identity to authenticate to a centralized identity system on behalf of a centralized identity, and / or allowing a centralized identity to authenticate to a decentralized identity system on behalf of a decentralized identity. Thus, the principles described herein allow authentication across decentralized and centralized domains.

[0005] In the case where the decentralized identity is authenticated as a centralized identity, the centralized identity system receives and registers the delegation of the decentralized identity to authenticate as a centralized identity. Thereafter, when the centralized identity system receives a communication from the decentralized identity to access resources owned by the centralized identity, the centralized identity system accesses the registration to determine that the decentralized identity is authorized to authenticate as a centralized identity. In response to the determination, the centralized identity system interacts with the decentralized identity to authenticate the decentralized identity as a centralized identity. Once the authentication is successful, the decentralized identity is authorized to access the resources owned by the centralized identity. Since the traditional identity system is a centralized identity system, this allows the decentralized identity to be used with the traditional identity system without waiting for the identity system to be modified to become a decentralized identity system.

[0006] In the case where the centralized identity is authenticated as a decentralized identity, the decentralized identity system receives and registers the delegation of the centralized identity to authenticate as a decentralized identity. Thereafter, when the decentralized identity system receives a communication from the centralized identity to access resources owned by the decentralized identity, the decentralized identity system accesses the registration to determine that the centralized identity is authorized to authenticate as a decentralized identity. In response to the determination, the decentralized identity system interacts with the centralized identity to authenticate the centralized identity as a decentralized identity. Once the authentication is successful, the centralized identity is authorized to access the resources owned by the decentralized identity. Thus, a user can have both a centralized identity and a decentralized identity, and allow such an identity to work with both a centralized identity system and a decentralized identity system.

[0007] This Summary is provided to introduce a selection of concepts in a simplified form that are further described in the Detailed Description below. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to describe the manner in which the above and other advantages and features of the present invention can be obtained, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments of the invention, which are illustrated in the accompanying drawings. Understanding that these drawings depict only typical embodiments of the invention and are not therefore to be considered limiting of its scope, the invention will be described and explained with additional specificity and detail through the use of the accompanying drawings, in which:

[0009] Figure 1 A flow chart of a method for allowing a decentralized identity to authenticate to a centralized identity system on behalf of a centralized identity according to a first embodiment described herein is illustrated;

[0010] Figure 2The diagram shows a centralized identity environment where a decentralized identity authenticates to a centralized identity system on behalf of a centralized identity and is Figure 1 Examples of environments in which the method may operate;

[0011] Figure 3 A flow chart illustrating a method according to a second embodiment described herein for permitting a centralized identity to authenticate to a decentralized identity system on behalf of a decentralized identity;

[0012] Figure 4 The diagram shows a decentralized identity environment where a centralized identity authenticates to a decentralized identity system on behalf of a decentralized identity and is Figure 3 Examples of environments in which the methods may operate; and

[0013] Figure 5 An example computer system is illustrated in which the principles described herein may be employed. DETAILED DESCRIPTION

[0014] At least some embodiments described herein relate to permitting a decentralized identity to authenticate to a centralized identity system on behalf of a centralized identity, and / or permitting a centralized identity to authenticate to a decentralized identity system on behalf of a decentralized identity. Thus, the principles described herein permit authentication across decentralized and centralized domains. An identity system receives and registers a delegation for a first identity to authenticate as a second identity, wherein one of the identities is a decentralized identity and one is a centralized identity. Thereafter, when the identity system receives a communication from the first identity to access a resource owned by the second identity, the identity system accesses the registration to determine that the first identity is authorized to authenticate as the second identity, authenticates the first identity as the second identity, and authorizes the first identity to access the resource owned by the second identity.

[0015] In the case where the decentralized identity is authenticated as a centralized identity, the centralized identity system receives and registers the delegation of the decentralized identity to authenticate as a centralized identity. Thereafter, when the centralized identity system receives a communication from the decentralized identity to access resources owned by the centralized identity, the centralized identity system accesses the registration to determine that the decentralized identity is authorized to authenticate as a centralized identity. In response to the determination, the centralized identity system interacts with the decentralized identity to authenticate the decentralized identity as a centralized identity. Once the authentication is successful, the decentralized identity is authorized to access the resources owned by the centralized identity. Since the traditional identity system is a centralized identity system, this allows the decentralized identity to be used with the traditional identity system without waiting for the identity system to be modified to become a decentralized identity system.

[0016] In the case where the centralized identity is authenticated as a decentralized identity, the decentralized identity system receives and registers the delegation of the centralized identity to authenticate as a decentralized identity. Thereafter, when the decentralized identity system receives a communication from the centralized identity to access resources owned by the decentralized identity, the decentralized identity system accesses the registration to determine that the centralized identity is authorized to authenticate as a decentralized identity. In response to the determination, the decentralized identity system interacts with the centralized identity to authenticate the centralized identity as a decentralized identity. Once the authentication is successful, the centralized identity is authorized to access the resources owned by the decentralized identity. Thus, a user can have both a centralized identity and a decentralized identity, and allow such an identity to work with both a centralized identity system and a decentralized identity system.

[0017] Conventional identity management systems are based on centralized institutions, such as company directory services, certificate authorities, or domain name registries. From the perspective of cryptographic trust verification, each of these centralized institutions acts as its own root of trust. A centralized identity is an identity that exists in dependence on such a centralized institution. Therefore, such a centralized institution is a "centralized identity system" as the term is used herein. In the figure, a centralized identity system is represented by a triangle pointing downward in the upper right corner of the figure.

[0018] In contrast, in a decentralized identity system, a decentralized identity is used to identify an entity. In contrast to a centralized identifier, a decentralized identity is controlled by the entity it identifies, independent of any centralized authority. In verifying cryptographic trust in that decentralized identity, entities are free to use any shared root of trust. A global distributed ledger (or a decentralized P2P network that provides similar functionality) provides a means of managing the root of trust with no centralized authority and no single point of failure. Such a distributed ledger or network is an example of a "decentralized identity system" as the term is used in this article. More broadly, a decentralized identity system is any distributed system that manages resources owned by a decentralized identity. In the figure, a decentralized identity system is represented by a circle in the upper right corner of the figure.

[0019] Figure 1 A flow chart of a method 100 for allowing a decentralized identity to authenticate to a centralized identity system on behalf of a centralized identity according to a first embodiment described herein is illustrated. Figure 2 A centralized identity environment 200 is illustrated in which a decentralized identity 201 authenticates to a centralized identity system 210 on behalf of a centralized identity 202. In the figure, decentralized identities are represented by downward pointing triangles, and centralized identities are represented by circles.

[0020] Figure 1 Method 100 can be found in Figure 1are executed within the centralized identity environment 200. Therefore, frequent cross-references will now be made to describe Figure 1 and Figure 2 . Figure 2 There are three main components illustrated, decentralized identity 201, centralized identity 202, and centralized identity system 210. Figure 1 In , the actions performed by the centralized identity 202 (or more specifically, the computing system operated by the centralized identity 202) are Figure 1 The actions performed by the decentralized identity 201 (or more specifically, the computing system operated by the decentralized identity 201) are listed in the left column of Figure 1 The actions performed by the centralized identity system 210 are listed in the middle column of Figure 1 are listed in the right column under the heading “Centralized Identity Systems”.

[0021] Centralized identity system 210 recognizes centralized identity 202 as one of the identities that owns resources managed by centralized identity system 210. For example, centralized identity system 210 recognizes that centralized identity 202 owns resource 212. Therefore, if centralized identity 202 were to request certain access to resource 212, centralized identity system 210 would authorize that access once centralized identity 202 is authenticated. However, in this example, centralized identity 202 now wishes to allow decentralized identity 201 to authenticate on behalf of centralized identity 202, so that decentralized identity 201 can access resource 212 as centralized identity 202 does.

[0022] Therefore, reference Figure 1 , the centralized identity 202 sends a delegation to the centralized identity system 210 for the decentralized identity 201 to be authenticated as the centralized identity (action 101). Figure 2 This is represented by arrow 221. Thus, the centralized identity system 210 receives the delegation (action 111). In one embodiment, this communication is performed using a centralized identity protocol. This is represented by arrow 221 having a line consisting of interrupted triangles.

[0023] A centralized identity protocol is a communication protocol that is recognized by a centralized identity system for the purpose of authentication. As an example, OpenID Connect is a centralized identity protocol. For example, delegation can use an extension of a centralized identity protocol. In the example of the OpenID Connect protocol, such an extension can be executed by the centralized identity, establishing a self-issued statement or scope, where the centralized identity makes an executable statement: the decentralized identity can authenticate on behalf of the centralized identity.

[0024] Centralized identity system 210 then registers the delegation so that it can be referenced later when the time comes to execute the delegation (act 112). The remainder of method 100 may be executed each time a communication is received thereafter from decentralized identity 201 to access a resource owned by centralized identity 202. For example, assume that decentralized identity 201 then sends a communication to centralized identity system 210 requesting access to resource 212 owned by centralized identity 202 (act 121). Centralized identity system 210 will then receive the request communication (act 113). The communication is received at Figure 2 222, and may also be based on a centralized identity protocol, represented by a line of arrows 222 consisting of interrupted triangles.

[0025] In response to the communication (action 113), the centralized identity system 210 accesses the registry to determine that the decentralized identity 201 is authorized to authenticate as the centralized identity 202 (action 114). Otherwise, the centralized identity system 210 can simply deny the request without giving the decentralized identity 201 a chance to authenticate.

[0026] In response to determining that decentralized identity 201 has been given permission to authenticate on behalf of centralized identity 202 (act 114), centralized identity system 210 interacts with decentralized identity 201 (acts 115 and 122) for the purpose of allowing decentralized identity 201 to attempt authentication. Figure 2 202, then the decentralized identity 201 may instead provide the same username and password. If the centralized identity system 210 expects a specific credential for the centralized identity 202, then the decentralized identity 201 may instead provide the same credential.

[0027] Completing method 100, in response to successful authentication (action 115), centralized identity system 210 authorizes decentralized identity 201 to access resources 212 owned by centralized identity 202 (action 116). Therefore, if a user owns both decentralized identity 201 and centralized identity 202, the user can use his decentralized identity 201 to access all resources managed by the centralized identity system or any other centralized identity system. Therefore, the principles described herein can be used to allow decentralized identities to access resources managed by traditional centralized identity management systems.

[0028] In the second embodiment, the roles of the centralized identity and the decentralized identity are reversed, and now the decentralized identity system is authenticated. Specifically, the decentralized identity delegates the authority to the centralized identity to authenticate to the decentralized identity system on behalf of the decentralized identity.

[0029] Figure 3 A flow chart of a method 300 for permitting a centralized identity to authenticate to a decentralized identity system on behalf of a decentralized identity is illustrated according to a second embodiment described herein. Figure 4 A decentralized identity environment 400 is illustrated, in which a centralized identity 402 authenticates to a decentralized identity system 410 on behalf of a decentralized identity 401 . Figure 3 and Figure 4 Similar to Figure 1 and 2 , except that the roles of decentralized identity and centralized identity are reversed. Figure 4 As shown in , multiple identities interact with a decentralized identity system 410 instead of a centralized identity system 210. Figure 3 middle, Figure 3 There is a heading "Decentralized Identity System" in the right column of . Identity 401 and Identity 402 can, but need not, be the same. Figure 2 The corresponding identity 201 and identity 202 are the same identity.

[0030] Decentralized identity system 410 identifies decentralized identity 401 as one of the identities that owns resources managed by decentralized identity system 410. For example, decentralized identity system 410 identifies decentralized identity 401 as owning resource 411. Therefore, if decentralized identity 401 were to request certain access to resource 411, decentralized identity system 410 would authorize that access once decentralized identity 401 is authenticated. However, in this example, decentralized identity 401 now wishes to allow centralized identity 402 to authenticate on behalf of decentralized identity 401, so that centralized identity 402 can access resource 411 just like decentralized identity 401.

[0031] Therefore, reference Figure 3 , decentralized identity 401 sends a delegation to decentralized identity system 410 for centralized identity 402 to authenticate as a decentralized identity (action 301). Figure 4 421. Thus, the decentralized identity system 410 receives the delegation (action 311). In one embodiment, this communication is performed using a decentralized identity protocol. This is represented by arrow 421 having a line consisting of interrupted circles.

[0032] A decentralized identity protocol is a communication protocol recognized by a decentralized identity system for the purpose of authentication. As an example, a decentralized identifier (DID) is a decentralized identity protocol that defines a data model and syntax for decentralized identifiers. For example, a delegation may use an extension of a decentralized identity protocol. In the example of a DID protocol, such an extension may be executed by a decentralized identity, thereby establishing a claim within a DID document that makes an executable statement: a centralized identity may authenticate on behalf of a decentralized identity.

[0033] Decentralized identity system 410 then registers the delegation so that it can be referenced later when the time comes to execute the delegation (act 312). Thereafter, the remainder of method 300 may be executed each time a communication is received from centralized identity 402 to access a resource owned by decentralized identity 401. For example, assume that centralized identity 402 then sends a communication to decentralized identity system 410 requesting access to resource 411 owned by decentralized identity 401 (act 321). Decentralized identity system 410 will then receive the request communication (act 313). The communication is received at Figure 2 422, and may also be in accordance with a decentralized identity protocol, the decentralized identity protocol being represented by a line of arrows 422 consisting of interrupted circles.

[0034] In response to the communication (action 313), decentralized identity system 410 accesses the registry to determine that centralized identity 402 is authorized to authenticate as decentralized identity 401 (action 314). Otherwise, decentralized identity system 410 may simply deny the request without giving centralized identity 402 a chance to authenticate.

[0035] In response to determining that centralized identity 402 has been given permission to authenticate on behalf of decentralized identity 401 (act 314), decentralized identity system 410 interacts with centralized identity 402 (acts 315 and 322) for the purpose of allowing centralized identity 402 to attempt authentication. Figure 4 423. This interaction may also be in accordance with a decentralized identity protocol, as represented by arrow 423 having a line consisting of interrupted circles. As an example, if decentralized identity system 410 expects a certificate signed by a particular private key of decentralized identity 401, centralized identity 402 may instead provide that same certificate signed by the private key of decentralized identity 401.

[0036] Completing method 300, in response to successful authentication (act 315), decentralized identity system 410 authorizes centralized identity 402 to access resources 411 owned by decentralized identity 401 (act 316). Therefore, if a user has both decentralized identity 401 and centralized identity 402, the user can use either of their identities to authenticate to any identity system, whether centralized or not.

[0037] Centralized identity system 210 may be a computing system. In addition, decentralized identity system 410 may be a collection of distributed computing systems. In addition, decentralized identities 201 and 401, as well as centralized identities 202 and 402, may operate with the help of a computing system. Such a computing system may be described below with respect to Figure 5 In addition, for the methods 100 and 300 described herein, the method may be performed in whole or in part by a computing system executing structured computer executable instructions such that when executed by one or more processors of the computing system, the computing system operates. Such computer executable instructions may be included in a computer program product. Figure 5 Computing system 500 is described.

[0038] Computing systems now increasingly take a variety of forms. A computing system may be, for example, a handheld device, an appliance, a laptop computer, a desktop computer, a mainframe, a distributed computing system, a data center, or even a device that is not conventionally considered to be a computing system, such as a wearable device (e.g., glasses, watches, bracelets, etc.). In this description and claims, the term "computing system" is broadly defined to include any device or system (or combination thereof), the device or system includes at least one physical and tangible processor, and the physical and tangible memory can have computer executable instructions that can be executed by the processor thereon. The memory can take any form and may depend on the nature and form of the computing system. The computing system can be distributed across a network environment and may include multiple constituent computing systems.

[0039] like Figure 5 As shown in , in its most basic configuration, computing system 500 typically includes at least one hardware processing unit 502 and memory 504. Memory 504 can be physical system memory, which can be volatile, non-volatile, or some combination of the two. The term "memory" as used herein can refer to a non-volatile mass storage device such as a physical storage medium. If the computing system is distributed, then processing, memory, and / or storage capabilities can also be distributed.

[0040] There are a number of structures on computing system 500 that are often referred to as "executable components." For example, memory 504 of computing system 500 is illustrated as including executable component 506. The term "executable component" is a name for a structure understood by one of ordinary skill in the computing arts, which structure may be software, hardware, or a combination thereof. For example, when implemented in software, one of ordinary skill in the art would understand that the structure of an executable component may include a software object, routine, method that may be executed on a computing system, whether such executable component is present in a stack of the computing system, or whether the executable component is present on a computer-readable storage medium.

[0041] In this case, those skilled in the art will recognize that the structure of the executable component exists on a computer-readable medium so that when interpreted by one or more processors of the computing system (e.g., by a processor thread), the computing system is caused to perform a function. This structure can be directly computer-readable by the processor (if the executable component is binary, this is the case). Alternatively, the structure can be structured to be interpretable and / or compiled (whether in a single stage or in multiple stages) to generate such a binary that is directly interpretable by the processor. When the term "executable component" is used, this understanding of the example structure of the executable component is well within the understanding of those of ordinary skill in the computing arts.

[0042] The term "executable component" is also well understood by those of ordinary skill to include structures that are implemented exclusively or nearly exclusively in hardware, such as within a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or any other special purpose circuit. Therefore, the term "executable component" is a term used for structures well known to those of ordinary skill in the computing arts, whether implemented in software, hardware, or a combination. In this description, the term "component" or "vertex" may also be used. As used in this description and cases, this term (whether or not the term is modified with one or more modifiers) is also intended to be synonymous with the term "executable component", or a specific type of such an "executable component", and therefore also has a structure that is well understood by those of ordinary skill in the computing arts.

[0043] In the following description, embodiments are described with reference to actions performed by one or more computing systems. If such actions are implemented in software, one or more processors (of the associated computing system performing the actions) direct the operation of the computing system in response to having executed the computer-executable instructions constituting the executable components. For example, such computer-executable instructions may be embodied on one or more computer-readable media forming a computer program product. Examples of such operations involve manipulation of data.

[0044] Computer-executable instructions (and manipulated data) may be stored in memory 504 of computing system 500. Computing system 500 may also contain communication channels 508 that allow computing system 500 to communicate with other computing systems over network 510, for example.

[0045] Although not all computing systems require a user interface, in some embodiments, computing system 500 includes a user interface 512 for interfacing with a user. User interface 512 may include output mechanism 512A and input mechanism 512B. The principles described herein are not limited to precise output mechanism 512A or input mechanism 512B, as this will depend on the nature of the device. However, output mechanism 512A may include, for example, a speaker, a display, a tactile output, a hologram, virtual reality, etc. Examples of input mechanism 512B may include, for example, a microphone, a touch screen, a hologram, virtual reality, a camera, a keyboard, a mouse or other pointer input, any type of sensor, etc.

[0046] The embodiments described herein may include or utilize special purpose or general purpose computing systems, which include computer hardware, such as, for example, one or more processors and system memory, as discussed in more detail below. The embodiments described herein also include physical and other computer readable media for carrying or storing computer executable instructions and / or data structures. Such computer readable media may be any available media that can be accessed by a general or special purpose computing system. The computer readable medium that stores computer executable instructions is a physical storage medium. The computer readable medium that carries computer executable instructions is a transmission medium. Therefore, by way of example and not limitation, an embodiment may include at least two obviously different types of computer readable media: a storage medium and a transmission medium.

[0047] Computer-readable storage media includes RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other physical and tangible storage media that can be used to store desired program code components in the form of computer-executable instructions or data structures and can be accessed by a general or special purpose computing system.

[0048] A "network" is defined as one or more data links that enable the transmission of electronic data between computing systems and / or components and / or other electronic devices. When information is transmitted or provided to a computing system via a network or other communication connection (hardwired, wireless, or a combination of hardwired or wireless), the computing system appropriately treats the connection as a transmission medium. The transmission medium may include a network and / or data links, which may be used to carry the required program code components in the form of computer executable instructions or data structures and may be accessed by a general or special computing system. Combinations of the above should also be included within the scope of computer-readable media.

[0049] In addition, upon reaching various computing system components, program code components in the form of computer executable instructions or data structures may be automatically transferred from a transmission medium to a storage medium (or vice versa). For example, a computer executable instruction or data structure received over a network or data link may be buffered in RAM within a network interface component (e.g., a "NIC"), and then ultimately transferred to a computing system RAM and / or a less volatile storage medium at the computing system. Thus, it should be understood that a readable medium may be included in a computing system component that also (or even primarily) utilizes a transmission medium.

[0050] Computer executable instructions include, for example, instructions and data, which, when executed at a processor, cause a general purpose computing system, a special purpose computing system, or a special purpose processing device to perform a specific function or group of functions. Alternatively or additionally, the computer executable instructions may configure a computing system to perform a specific function or group of functions. Computer executable instructions may be, for example, binary files or even instructions, such as intermediate format instructions, such as assembly language or even source code, that undergo some translation (such as compilation) before being directly executed by a processor.

[0051] It will be appreciated by those skilled in the art that the present invention can be practiced in a network computing environment with various types of computing system configurations, including personal computers, desktop computers, laptop computers, message processors, handheld devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, mobile phones, PDAs, pagers, routers, switches, data centers, wearable devices (such as glasses or watches), etc. The present invention can also be practiced in a distributed system environment, where both local and remote computing systems linked by a network (by a hardwired data link, a wireless data link, or a combination of a hardwired and wireless data link) perform tasks. In a distributed system environment, program components can be located in both local and remote memory storage devices.

[0052] Those skilled in the art will also appreciate that the present invention can be practiced in a cloud computing environment supported by one or more data centers or portions thereof. The cloud computing environment can be distributed, although this is not required. When distributed, the cloud computing environment can be distributed internationally within an organization and / or have components owned across multiple organizations.

[0053] In this description and in the following claims, "cloud computing" is defined as a model for enabling on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services). The definition of "cloud computing" is not limited to any of the other numerous advantages that can be derived from such a model when properly deployed.

[0054] For example, cloud computing is currently being deployed in the market to provide ubiquitous and convenient on-demand access to a shared pool of configurable computing resources. In addition, the shared pool of configurable computing resources can be quickly provisioned via virtualization, and released with low management effort or service provider interaction, and then expanded accordingly.

[0055] The cloud computing model can consist of various characteristics, such as on-demand, self-service, broad network access, resource pooling, rapid elasticity, measured services, etc. The cloud computing model can also appear in the form of various application service models, such as software as a service ("SaaS"), platform as a service ("PaaS"), and infrastructure as a service ("IaaS"). The cloud computing model can also be deployed using different deployment models, such as private cloud, community cloud, public cloud, hybrid cloud, etc. In this description and claims, a "cloud computing environment" is an environment in which cloud computing is deployed.

[0056] Traditionally, identity management systems are often built on centralized institutions, including but not limited to employer directories, government organizations, email services, certificate authorities, and / or domain name registries. A decentralized identity, on the other hand, is an identity for which authentication can be performed in a decentralized system. An example of such a decentralized system includes a distributed ledger in which a decentralized identity can be recorded. Another example of a decentralized system includes a peer-to-peer system, where authentication is performed within the peer-to-peer system, allowing computing systems within the peer-to-peer system to then take actions based on the authentication.

[0057] The present invention may be implemented in other specific forms without departing from its spirit or essential characteristics. The described embodiments should be considered illustrative and non-restrictive in all aspects. Therefore, the scope of the present invention is indicated by the appended claims rather than by the foregoing description. All changes within the equivalent meaning and scope of the claims are included within their scope.

Claims

1. A centralized identity system, comprising: one or more processors; as well as One or more computer-readable hardware storage devices having computer-executable instructions thereon, the computer-executable instructions being structured such that, when executed by one or more processors, the centralized identity system is configured to, in response to receiving a delegation by a decentralized identity of a decentralized identity system to authenticate as a centralized identity of the centralized identity system, permit the decentralized identity to authenticate on behalf of the centralized identity, wherein the decentralized identity system includes a distributed ledger configured to manage a root of trust via cryptographic trust verification, and the centralized identity system authenticates the centralized identity via a centralized identity registry, the centralized identity system being configured to: registering in the centralized identity registry the delegation received by the decentralized identity as the centralized identity for authentication; receiving, from the decentralized identity, a communication to access a resource owned by the centralized identity; In response to the communication, accessing the centralized identity registry to determine that the decentralized identity is authorized to authenticate as the centralized identity; In response to the determination, authenticating the decentralized identity as the centralized identity via cryptographic trust verification; as well as In response to authentication, the decentralized identity is authorized to access the resource owned by the centralized identity.

2. The centralized identity system of claim 1, wherein the delegation is received through the centralized identity system using an extension of a centralized identity protocol.

3. The centralized identity system of claim 2, wherein the communication is received according to the centralized identity protocol.

4. The centralized identity system of claim 3, wherein the authentication of the decentralized identity occurs according to a decentralized identity protocol.

5. The centralized identity system of claim 1, wherein the delegation is received by the centralized identity system as a declaration of a centralized identity protocol.

6. The centralized identity system of claim 5, wherein the communication is received according to the centralized identity protocol.

7. The centralized identity system of claim 6, wherein the authentication of the decentralized identity occurs according to a decentralized identity protocol.

8. The centralized identity system of claim 1, wherein the communication is received according to a centralized identity protocol.

9. The centralized identity system of claim 8, wherein the authentication of the decentralized identity occurs according to a decentralized identity protocol.

10. A method for a decentralized identity system to permit a centralized identity of a centralized identity system to authenticate on behalf of a decentralized identity of the decentralized identity system, wherein the decentralized identity system includes a distributed ledger configured to manage a trust root via cryptographic trust verification, and the centralized identity system authenticates the centralized identity via a centralized identity registry, the method comprising: Receiving a delegation for the centralized identity of the centralized identity system to authenticate the decentralized identity of the decentralized identity system: registering in the centralized identity registry the delegation received by the centralized identity for authentication as the decentralized identity; receiving, from the centralized identity, a communication to access a resource owned by the decentralized identity; In response to the communication, accessing the centralized identity registry to determine that the centralized identity is authorized to authenticate as the decentralized identity; In response to the determination, authenticating the decentralized identity as the centralized identity via cryptographic trust verification; as well as In response to authentication, the centralized identity is authorized to access the resource owned by the decentralized identity.

11. The method of claim 10, using an extension of a decentralized identity protocol, the delegation being received through the decentralized identity system.

12. The method of claim 11, wherein the communication is received in accordance with the decentralized identity protocol.

13. The method of claim 12, wherein the authentication of the decentralized identity occurs according to the decentralized identity protocol.

14. The method of claim 10, wherein the delegation is received by the decentralized identity system as a declaration of a decentralized identity protocol.

15. The method of claim 14, wherein the communication is received in accordance with the decentralized identity protocol.

16. The method of claim 15, wherein the authentication of the decentralized identity occurs according to a decentralized identity protocol.

17. The method of claim 10, wherein the communication is received according to a decentralized identity protocol.

18. The method of claim 17, wherein the authentication of the decentralized identity occurs according to the decentralized identity protocol.

19. A computer program product comprising one or more computer-readable hardware storage devices having computer-executable instructions thereon, the computer-executable instructions being structured such that when executed by one or more processors of a centralized identity system, the centralized identity system is configured to, in response to receiving a delegation by a decentralized identity of a decentralized identity system to authenticate as a centralized identity of the centralized identity system, permit the decentralized identity to authenticate on behalf of the centralized identity, wherein the decentralized identity system comprises a distributed ledger configured to manage a root of trust via cryptographic trust verification, and the centralized identity system authenticates the centralized identity via a centralized identity registry, the centralized identity system being configured to: registering in the centralized identity registry the delegation received by the decentralized identity as the centralized identity for authentication; receiving, from the decentralized identity, a communication to access a resource owned by the centralized identity; In response to the communication, accessing the centralized identity registry to determine that the decentralized identity is authorized to authenticate as the centralized identity; In response to the determination, authenticating the decentralized identity as the centralized identity via cryptographic trust verification; as well as In response to authentication, the decentralized identity is authorized to access the resource owned by the centralized identity.

20. The computer program product of claim 19, the communication being received according to a centralized identity protocol, the authentication of the decentralized identity occurring according to the decentralized identity protocol.

Images