Registration processing based on identification of ledger

Abstract

Aspects of the present disclosure relate to an apparatus, such as a network device, that receives first signaling from a terminal device as a registration request and generates a registry notification message based on successful authentication of the terminal device. The apparatus sends a second signaling as a registry transaction notification to a first network entity implementing a licensed distributed ledger (PDL). The apparatus receives a third signaling as a registration acknowledgement message from a second network entity implementing the registry service, and sends a fourth signaling as a registration response to the terminal device.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Application Serial No. 63 / 408,639, filed on September 21, 2022, entitled “Registration Handling of Ledger-Based Identity,” the entire contents of which are incorporated herein by reference. This application also claims priority to U.S. Provisional Application Serial No. 63 / 408,627, filed on September 21, 2022, entitled “Digital Identity Management,” the entire contents of which are incorporated herein by reference. This application also claims priority to U.S. Provisional Application Serial No. 63 / 408,645, filed on September 21, 2022, entitled “Decentralized Identity Authentication and Authorization,” the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure relates to wireless communications and, more particularly, to ledger-based identity processing. Background Art

[0004] A wireless communication system may include one or more network communication devices (such as base stations), which may be referred to as eNodeB (eNB), next generation NodeB (gNB) or other suitable terms. Each network communication device (such as a base station) may support wireless communication of one or more user communication devices, which may also be referred to as user equipment (UE) or other suitable terms. A wireless communication system may support wireless communication with one or more user communication devices by utilizing resources of a wireless communication system, such as time resources (e.g., symbols, time slots, subframes, frames, etc.) or frequency resources (e.g., subcarriers, carriers). In addition, a wireless communication system may support wireless communication across various radio access technologies, including third generation (3G) radio access technology, fourth generation (4G) radio access technology, fifth generation (5G) radio access technology, and other suitable radio access technologies beyond 5G (e.g., sixth generation (6G)).

[0005] In communication systems, digital identity management related to decentralized identifiers (DIDs) and self-sovereign identities (SSIs) involves various processes, such as storage, management, processing and verification of identities and related documents (e.g., verifiable credentials (VCs), cryptography-related information, etc.), and selective data disclosure in distributed platforms (e.g., (multiple) permissioned distributed ledgers) to achieve digital identity-based authentication and authorization. In addition, digital identity management in communication systems may involve multiple network entities, such as identity holders, DID controllers, VC issuers, and / or relying parties (e.g., verifiers), etc. Summary of the invention

[0006] The present disclosure relates to methods, devices and systems for supporting registration processing of ledger-based identities. By utilizing the described technology, role-based registration is implemented for participants (e.g., terminal devices or device applications) that interact with and participate in the identity and trust management framework to achieve DID-based authentication and authorization of DID holders (i.e., subjects or end users). The described technology also implements the deregistration and / or revocation of registered participants that interact with and participate in the identity and trust management framework.

[0007] Various aspects of the present disclosure relate to new permissioned distributed ledger (PDL) services and associated message exchanges and operations. In one or more implementations, the PDL service includes a role-based registration management service; a participant registry service (also referred to herein as a DID operation participant registry service or a ledger identity and trust management participant registry service); a DID registry and a DID resolver service; a DID document registry service, such as for creating and storing, updating and / or deleting and revoking; a verifiable credential data registry service, such as for creating and storing, updating and / or deleting and revoking; and a DID verification service. The described role-based registration and deregistration services provide and support decentralized identity management and related verification for terminal devices and / or device applications.

[0008] In some implementations of the methods and apparatus described herein, a network entity (e.g., an apparatus, a network device) implements a ledger registration management service (L-RMS). The L-RMS receives a registration request from a terminal device and generates a registry notification message based on successful authentication of the terminal device. The L-RMS sends a registry transaction notification to a first network entity that implements PDL. The L-RMS receives a registration confirmation message from a second network entity that implements the registry service and sends a registration response to the terminal device.

[0009] Some implementations of the methods and apparatus described herein may also include: the registration request includes an indication of at least one of the terminal device as a source identifier, service type information, DID, a required access role, or a requested access role. The registry notification message includes at least one of the following: an L-RMS identifier, a source identifier, service type information, a registry service type, a registry service identifier, a registration identifier, a DID, authorization information, an authorized access role, or a lifetime expiration. The registration response may include an indication of a failure result based on an authentication failure, an unacceptable requested access role, or a local policy. Alternatively, the registration response includes an indication of a successful result, an L-RMS identifier, service type information, a registration identifier, an authorized access role, authorization information, or a lifetime expiration. The service type information included in the registration response indicates a DID service provided by the identification and trust management framework. The L-RMS may set a registration identifier, set authorization information, and assign a lifetime expiration for registration. The L-RMS generates a registry transaction notification based on an adaptation transformation of the registry notification message. The registration confirmation message is received from the DID operation participant registry service.

[0010] In some implementations of the methods and apparatus described herein, a network entity (e.g., an apparatus, a terminal device) sends a registration request to a first network entity implementing an L-RMS, the L-RMS authenticates the apparatus; sends a registry transaction notification to a PDL; and receives a registration confirmation message from a registry service. The terminal device also receives a registration response from the L-RMS.

[0011] Some implementations of the methods and apparatus described herein may also include: the registration request includes an indication of at least one of the terminal device as a source identifier, service type information, a DID, a required access role, or a requested access role. The registration response includes an indication of a failure result based at least in part on an authentication failure, the requested access role cannot be accepted, or a local policy. The registration response includes at least one of: an indication of a successful result, an L-RMS identifier, service type information, a registration identifier, an authorized access role, authorization information, or a lifetime expiration. The service type information included in the registration response indicates a DID service provided by the identity and trust management framework.

[0012] In some implementations of the methods and apparatus described herein, a network entity (e.g., an apparatus, a network device) implements an L-RMS. The L-RMS receives first signaling as a registration revocation request associated with a terminal device, the registration revocation request being received from a first network entity implementing a registry service. The L-RMS processes the registration revocation request based on an L-RMS identifier associated with the terminal device, and sends a registration revocation confirmation notification to the registry service that logs the registration revocation.

[0013] Some implementations of the methods and apparatus described herein may further include: a second signaling is sent as a registration revocation confirmation notification to a second network entity implementing the PDL, and the registration revocation confirmation notification is propagated through the PDL network to a registry service that records the registration revocation. The L-RMS sends a registration revocation notification to the terminal device and receives a registration revocation confirmation message from the terminal device. The registration revocation request includes an L-RMS identifier associated with a registration identifier of a DID operation participant registry transaction corresponding to the terminal device. The registration revocation request includes an L-RMS identifier, a source identifier, a registry service type, a registry service identifier, a registration identifier, and / or an authorized access role and a cause value related to the registration revocation.

[0014] In some implementations of the methods and apparatus described herein, a network entity (e.g., apparatus, network device) implements a registry service. The registry service receives first signaling from the PDL as a registry transaction notification, which is generated by the L-RMS based on a registration request from a terminal device and a successful authentication of the terminal device. The registry service records the registry transaction notification and sends a registration confirmation message to the L-RMS, which transmits a registration response to the terminal device.

[0015] Some implementations of the methods and devices described herein may also include: the registry transaction notification includes at least one of the following: an L-RMS identifier, a source identifier, service type information, a registry service type, a registry service identifier, a registration identifier, a DID, an authorized access role, authorization information, or a lifetime expiration. The registration confirmation message includes at least one of the following: an L-RMS identifier, a source identifier, a registration identifier, a registry service type, a registry service identifier, or a success indication. The registry service maintains a record of DID-based identification system participants and is identified as one of the following: a DID operation participant registry service, or a book identification and trust management participant registry service. The registry service may also send a registration revocation request to the L-RMS, the registration revocation request being associated with the terminal device and based on a determination of calling registration revocation. The registry service receives a registry transaction revocation notification from the PDL, and the registry transaction revocation notification is routed from the L-RMS via the PDL. The registry service records the registry transaction revocation notification. The registry service receives a registration revocation confirmation notification from the L-RMS and records the registration revocation confirmation notification. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 An example of a wireless communication system supporting a registration process for a ledger-based identity in accordance with aspects of the present disclosure is illustrated.

[0017] Figure 2Illustrated are examples of generation and use of verifiable claim(s) related to identity authentication and verification in connection with a registration process for a ledger-based identity in accordance with aspects of the present disclosure.

[0018] Figure 3 An example of a DID registry on a distributed ledger and blockchain related to a registration process for a ledger-based identity in accordance with aspects of the present disclosure is illustrated.

[0019] Figure 4 An example of basic architectural elements of an SSI related to a registration process for a ledger-based identity in accordance with aspects of the present disclosure is illustrated.

[0020] Figure 5 An example of a PDL platform service-based identity and trust management framework that supports a registration process for a ledger-based identity in accordance with aspects of the present disclosure is illustrated.

[0021] Figure 6 An example diagram of a role-based registration process supporting a registration process for a ledger-based identity in accordance with aspects of the present disclosure is illustrated.

[0022] Figure 7 An example diagram illustrating a revocation and deregistration process for a role-based registration supporting a registration process for a ledger-based identity in accordance with aspects of the present disclosure is shown.

[0023] Figure 8 and Fig. 9 An example of a block diagram of a device supporting a registration process for a ledger-based identity in accordance with aspects of the present disclosure is illustrated.

[0024] Figures 10 to 16 A flow chart of a method of supporting a registration process for a ledger-based identity according to aspects of the present disclosure is illustrated. DETAILED DESCRIPTION

[0025] Digital identity management related to DID and SSI involves various processes, such as storage, management, processing and verification of identities and related documents (e.g., VC, cryptography related information, etc.), and selective data disclosure in distributed platforms (e.g., (multiple) permissioned distributed ledgers) to achieve digital identity-based authentication and authorization. In addition, digital identity management in communication systems may involve multiple network entities, such as identity holders, DID controllers, VC issuers, and / or relying parties (e.g., verifiers), etc. However, existing PDL platforms do not provide services for supporting digital identities, specific identities, and trust management processes, which involve storage, management, processing, verification, and management (e.g., access control and authorization) of multiple actors, selective data disclosure to relying parties, etc.

[0026] Due to various limitations, PDL platform services related to registration, application registration, identification, and identity management are generally insufficient to support decentralized identity management and related verification processes. For example, current registry services and application registration services do not support role-based access control and authorization settings for registration, which is critical for handling different parties and their corresponding operations for decentralized identity and trust management frameworks. In addition, identification and identity management services do not allow identity holders (e.g., end devices or device applications) to set identifiers for themselves, nor do they allow (e.g., as identity controllers) to set identifiers for another device or object associated with the identity holder. In addition, existing PDL services do not support selective data sharing specific to (multiple) managed identifiers.

[0027] Various aspects of the present disclosure relate to new PDL platform services to support identity (i.e., DID and SSI-based identity) and trust management solutions that rely on PDL and / or any ledger platform for related message exchanges and operations. In one or more implementations, PDL services include role-based registration management services; participant registry services (also referred to herein as DID operation participant registry services or ledger identity and trust management participant registry services); DID registry and DID resolver services; DID document registry services, such as for creation and storage, update and / or deletion and revocation; verifiable credential data registry services, such as for creation and storage, update and / or deletion and revocation; and DID verification services. The described role-based registration and deregistration services provide and support decentralized identity management and related verification for terminal devices and / or device applications.

[0028] By utilizing the described technology, role-based registration is implemented for participants (e.g., terminal devices or device applications) that interact with and participate in the identity and trust management framework to achieve DID-based authentication and authorization of DID holders (i.e., subjects or end users). The described technology also implements the deregistration and / or revocation of registered participants that interact with and participate in the identity and trust management framework.

[0029] Aspects of the present disclosure are described in the context of a wireless communication system. Aspects of the present disclosure are further illustrated and described with reference to device diagrams and flow charts.

[0030] Figure 1An example of a wireless communication system 100 that supports registration processing for ledger-based identities according to various aspects of the present disclosure is illustrated. The wireless communication system 100 may include one or more network entities 102, one or more UEs 104, a core network 106, and a packet data network 108. The wireless communication system 100 may support various radio access technologies. In some implementations, the wireless communication system 100 may be a 4G network, such as an LTE network or an advanced LTE (LTE-A) network. In some other implementations, the wireless communication system 100 may be a 5G network, such as an NR network. In other implementations, the wireless communication system 100 may be a combination of a 4G network and a 5G network, or other suitable radio access technologies, including the Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20. The wireless communication system 100 may support radio access technologies other than 5G. In addition, the wireless communication system 100 may support technologies such as time division multiple access (TDMA), frequency division multiple access (FDMA), or code division multiple access (CDMA).

[0031] One or more network entities 102 may be dispersed throughout a geographic area to form a wireless communication system 100. One or more of the network entities 102 described herein may be or include or may be referred to as a network node, a base station, a network element, a radio access network (RAN), a base transceiver station, an access point, a NodeB, an eNodeB (eNB), a next generation NodeB (gNB), or other suitable terms. The network entity 102 and the UE 104 may communicate via a communication link 110, which may be a wireless or wired connection. For example, the network entity 102 and the UE 104 may perform wireless communication (e.g., receive signaling, send signaling) over a Uu interface.

[0032] The network entity 102 may provide a geographic coverage area 112 for which the network entity 102 supports services (e.g., voice, video, packet data, messaging, broadcast, etc.) for one or more UEs 104 within the geographic coverage area 112. For example, the network entity 102 and the UE 104 may support wireless communications of signals associated with services (e.g., voice, video, packet data, messaging, broadcast, etc.) according to one or more radio access technologies. In some implementations, the network entity 102 may be mobile, for example, a satellite associated with a non-terrestrial network. In some implementations, different geographic coverage areas 112 associated with the same or different radio access technologies may overlap, but different geographic coverage areas 112 may be associated with different network entities 102. The information and signals described herein may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0033] One or more UEs 104 may be dispersed throughout the geographic area of ​​the wireless communication system 100. UE 104 may include or may be referred to as a mobile device, a wireless device, a remote device, a remote unit, a handheld device, a subscriber device, or some other suitable term. In some implementations, UE 104 may be referred to as a unit, a station, a terminal, or a client, etc. Additionally or alternatively, UE 104 may be referred to as an Internet of Things (IoT) device, an Internet of Everything (IoE) device, or a machine type communication (MTC) device, etc. In some implementations, UE 104 may be stationary in the wireless communication system 100. In some other implementations, UE 104 may be mobile in the wireless communication system 100.

[0034] One or more UEs 104 may be devices of different forms or with different capabilities. Figure 1 Some examples of UE 104 are illustrated in FIG. Figure 1 As shown, UE 104 can communicate with various types of devices, such as network entity 102, other UEs 104, or network devices (e.g., core network 106, packet data network 108, relay device, integrated access and backhaul (IAB) node, or another network device), such as Figure 1 Additionally or alternatively, the UE 104 can support communications with other network entities 102 or UEs 104 that can act as relays in the wireless communication system 100.

[0035] The UE 104 may also be capable of supporting wireless communications directly with other UEs 104 via a communication link 114. For example, the UE 104 may support wireless communications directly with another UE 104 via a device-to-device (D2D) communication link. In some implementations, such as vehicle-to-vehicle (V2V) deployments, vehicle-to-everything (V2X) deployments, or cellular V2X deployments, the communication link 114 may be referred to as a sidelink. For example, the UE 104 may support wireless communications directly with another UE 104 via a PC5 interface.

[0036] The network entity 102 may support communication with the core network 106 or with another network entity 102 or both. For example, the network entity 102 may interface with the core network 106 via one or more backhaul links 116 (e.g., via S1, N2, N2 or another network interface). The network entities 102 may communicate with each other via the backhaul links 116 (e.g., via X2, Xn or another network interface). In some implementations, the network entities 102 may communicate directly with each other (e.g., between the network entities 102). In some other implementations, the network entities 102 may communicate with each other or indirectly (e.g., via the core network 106). In some implementations, one or more network entities 102 may include subcomponents, such as access network entities, which may be examples of access node controllers (ANCs). The ANC may communicate with one or more UEs 104 via one or more other access network transport entities (which may be referred to as radio heads, smart radio heads, or transport reception points (TRPs)).

[0037] In some implementations, the network entity 102 may be configured in a decomposed architecture that may be configured to utilize a protocol stack that is physically or logically distributed between two or more network entities 102, such as an integrated access backhaul (IAB) network, an open RAN (O-RAN) (e.g., a network configuration sponsored by the O-RAN Alliance), or a virtualized RAN (vRAN) (e.g., a cloud RAN (C-RAN)). For example, the network entity 102 may include one or more of a central unit (CU), a distributed unit (DU), a radio unit (RU), a RAN intelligent controller (RIC) (e.g., a near real-time RIC (near RT RIC), a non-real-time RIC (non-RT RIC)), a service management and orchestration (SMO) system, or any combination thereof.

[0038] The RU may also be referred to as a radio head, a smart radio head, a remote radio head (RRH), a remote radio unit (RRU), or a transmission reception point (TRP). In a decomposed RAN architecture, one or more components of the network entity 102 may be collocated, or one or more components of the network entity 102 may be located at distributed locations (e.g., separate physical locations). In some implementations, one or more network entities 102 of the decomposed RAN architecture may be implemented as virtual units (e.g., virtual CU (VCU), virtual DU (VDU), virtual RU (VRU)).

[0039] The functional split between CU, DU and RU can be flexible, and different functions can be supported according to the functions performed at the CU, DU or RU (e.g., network layer functions, protocol layer functions, baseband functions, radio frequency functions and any combination thereof). For example, a functional split of a protocol stack can be adopted between a CU and a DU so that the CU can support one or more layers of the protocol stack and the DU can support one or more different layers of the protocol stack. In some implementations, the CU can host upper protocol layer (e.g., Layer 3 (L3), Layer 2 (L2)) functions and signaling (e.g., Radio Resource Control (RRC), Service Data Adaptation Protocol (SDAP), Packet Data Convergence Protocol (PDCP)). The CU can be connected to one or more DUs or RUs, and one or more DUs or RUs can host lower protocol layers, such as Layer 1 (L1) (e.g., physical (PHY) layer) or L2 (e.g., radio link control (RLC) layer, media access control (MAC) layer) functions and signaling, and each can be at least partially controlled by the CU.

[0040] Additionally or alternatively, a functional split of the protocol stack may be employed between the DU and the RU such that the DU may support one or more layers of the protocol stack and the RU may support one or more different layers of the protocol stack. The DU may support one or more different cells (e.g., via one or more RUs). In some implementations, the functional split between the CU and the DU or between the DU and the RU may be within the protocol layer (e.g., some functions of the protocol layer may be performed by one of the CU, DU, or RU, while other functions of the protocol layer may be performed by different ones of the CU, DU, or RU).

[0041] The CU may be further functionally split into CU control plane (CU-CP) and CU user plane (CU-UP) functions. The CU may be connected to one or more DUs via a medium-range communication link (e.g., F1, F1-c, F1-u), and the DU may be connected to one or more RUs via a fronthaul communication link (e.g., an open fronthaul (FH) interface). In some implementations, the medium-range communication link or the fronthaul communication link may be implemented based on interfaces (e.g., channels) between layers of a protocol stack supported by a corresponding network entity 102 communicating via such a communication link.

[0042] The core network 106 may support user authentication, access authorization, tracking, connection, and other access, routing, or mobility functions. The core network 106 may be an evolved packet core (EPC) or a 5G core (5GC), which may include control plane entities that manage access and mobility (e.g., mobility management entity (MME), access and mobility management function (AMF)), and user plane entities that route packets or interconnections to external networks (e.g., serving gateway (S-GW), packet data network (PDN) gateway (P-GW), or user plane function (UPF)). In some implementations, the control plane entities may manage non-access stratum (NAS) functions, such as mobility, authentication, and bearer management (e.g., data bearers, signal bearers, etc.) of one or more UEs 104 served by one or more network entities 102 associated with the core network 106.

[0043] The core network 106 may communicate with the packet data network 108 via one or more backhaul links 116 (e.g., via S1, N2, or another network interface). The packet data network 108 may include an application server 118. In some implementations, one or more UEs 104 may communicate with the application server 118. The UE 104 may establish a session (e.g., a protocol data unit (PDU) session, etc.) with the core network 106 via the network entity 102. The core network 106 may use the established session (e.g., the established PDU session) to route traffic (e.g., control information, data, etc.) between the UE 104 and the application server 118. The PDU session may be an example of a logical connection between the UE 104 and the core network 106 (e.g., one or more network functions of the core network 106).

[0044] In the wireless communication system 100, the network entity 102 and the UE 104 may use the resources of the wireless communication system 100, such as time resources (e.g., symbols, time slots, subframes, frames, etc.) or frequency resources (e.g., subcarriers, carriers) to perform various operations (e.g., wireless communication). In some implementations, the network entity 102 and the UE 104 may support different resource structures. For example, the network entity 102 and the UE 104 may support different frame structures. In some implementations, such as in 4G, the network entity 102 and the UE 104 may support a single frame structure. In some other implementations, such as in 5G and other suitable radio access technologies, the network entity 102 and the UE 104 may support various frame structures (i.e., multiple frame structures). The network entity 102 and the UE 104 may support various frame structures based on one or more digital technologies.

[0045] One or more digital technologies may be supported in the wireless communication system 100, and the digital technologies may include subcarrier spacing and cyclic prefixes. A first digital technology (e.g., μ = 0) may be associated with a first subcarrier spacing (e.g., 15kHz) and a normal cyclic prefix. A first digital technology (e.g., μ = 0) associated with a first subcarrier spacing (e.g., 15kHz) may utilize one slot per subframe. A second digital technology (e.g., μ = 1) may be associated with a second subcarrier spacing (e.g., 30kHz) and a normal cyclic prefix. A third digital technology (e.g., μ = 2) may be associated with a third subcarrier spacing (e.g., 60kHz) and a normal cyclic prefix or an extended cyclic prefix. A fourth digital technology (e.g., μ = 3) may be associated with a fourth subcarrier spacing (e.g., 120kHz) and a normal cyclic prefix. A fifth digital technology (e.g., μ = 4) may be associated with a fifth subcarrier spacing (e.g., 240kHz) and a normal cyclic prefix.

[0046] The time intervals of resources (e.g., communication resources) can be organized according to frames (also referred to as radio frames). Each frame can have a duration, for example, a duration of 10 milliseconds (ms). In some implementations, each frame can include multiple subframes. For example, each frame can include 10 subframes, and each subframe can have a duration, for example, a duration of 1 ms. In some implementations, each frame can have the same duration. In some implementations, each subframe of a frame can have the same duration.

[0047] Additionally or alternatively, the time intervals of resources (e.g., communication resources) can be organized according to time slots. For example, a subframe may include a certain number (e.g., quantity) of time slots. Each time slot may include a certain number (e.g., quantity) of symbols (e.g., orthogonal frequency division multiplexing (OFDM) symbols). In some implementations, the number (e.g., quantity) of time slots of a subframe may depend on the digital technology. For a normal cyclic prefix, a time slot may include 14 symbols. For an extended cyclic prefix (e.g., applicable to a 60kHz subcarrier spacing), a time slot may include 12 symbols. For a normal cyclic prefix and an extended cyclic prefix, the relationship between the number of symbols per time slot, the number of time slots per subframe, and the number of time slots per frame may depend on the digital technology. It should be understood that references to a first digital technology (e.g., μ=0) associated with a first subcarrier spacing (e.g., 15kHz) may be used interchangeably between subframes and time slots.

[0048] In the wireless communication system 100, the electromagnetic (EM) spectrum can be divided into various categories, frequency bands, frequency channels, etc. based on frequency or wavelength. For example, the wireless communication system 100 can support one or more operating frequency bands, such as frequency range names FR1 (410 MHz-7.125 GHz), FR2 (24.25 GHz-52.6 GHz), FR3 (7.125 GHz-24.25 GHz), FR4 (52.6 GHz-114.25 GHz), FR4a or FR4-1 (52.6 GHz-71 GHz), and FR5 (114.25 GHz-300 GHz). In some implementations, the network entity 102 and the UE 104 can perform wireless communications on the one or more operating frequency bands. In some implementations, FR1 can be used by the network entity 102 and the UE 104 and other devices or apparatuses for cellular communication services (e.g., control information, data). In some implementations, FR2 can be used by the network entity 102 and the UE 104 and other devices or apparatuses for short-range, high data rate capabilities.

[0049] FR1 may be associated with one or more digital technologies (e.g., at least three digital technologies). For example, FR1 may be associated with a first digital technology (e.g., μ=0) including a subcarrier spacing of 15 kHz; a second digital technology (e.g., μ=1) including a subcarrier spacing of 30 kHz; a third digital technology (e.g., μ=2) including a subcarrier spacing of 60 kHz. FR2 may be associated with one or more digital technologies (e.g., at least 2 digital technologies). For example, FR2 may be associated with a third digital technology (e.g., μ=2) including a subcarrier spacing of 60 kHz; a fourth digital technology (e.g., μ=3) including a subcarrier spacing of 120 kHz.

[0050] Depending on the implementation, one or more of the network entity 102 and the UE 104 (e.g., an end device or device application) may be operable to implement various aspects of a registration process for a ledger-based identity, as described herein. For example, the network entity 102 (e.g., an apparatus or device) implements an L-RMS that receives a registration request 120 from the UE 104 (e.g., an end device). The L-RMS generates a registry notification message based on successful authentication of the end device and sends a registry transaction notification 122 to a network entity that implements a PDL 124. The L-RMS receives a registration confirmation message 126 from a network entity that implements a registry service 128 and sends a registration response 130 to the end device.

[0051] In various aspects of the registration process for ledger-based identities, decentralized identities and / or SSI-based identity management solutions are discussed in the context of the trust framework created by the electronic identification, authentication and trust services (eIDAS) regulations. According to the current DID specification of W3C, a decentralized identifier (DID) is a new type of identifier for verifiable "self-sovereign" digital identities. DIDs are completely controlled by the DID subject and are independent of any centralized registry, identity provider, or credential authority. DIDs are URLs that associate the DID subject with a trusted way of interacting with that subject. DIDs resolve to DID documents, which are simple documents that describe how to use a specific DID. Each DID document can contain at least a proof purpose, a verification method, and a service endpoint. The proof purpose is combined with the verification method to provide a mechanism for proving things. For example, a DID document can specify that a specific verification method (such as a cryptographic public key or a pseudonymous biometric protocol) can be used to verify the proof created for authentication purposes.

[0052] Service endpoints enable trusted interactions with DID controllers. Since DIDs are only identifiers, they do not provide information about the subject itself. In practice, DIDs are used in conjunction with verifiable claims to support digital interactions that share information about a subject with third parties by proving to these third parties that the DID subject possesses certain proofs or attributes. The proof is based on a cryptographic link between the verifiable claim, the DID subject to which the verifiable claim relates, and the issuer of the verifiable claim, which can be either the own DID subject (a self-asserted claim) or a trusted entity. Trust in the issuer is established by trusting the issuer's DID (e.g., out-of-band, bilateral relationships, trusted lists) or by any other means. Third parties can then use the presented cryptographically protected proof to verify the ownership and trustworthiness of claims about the subject. Since the presentation of claims is entirely managed by the user, they can decide which specific information about themselves to share with third parties, thereby strengthening selective disclosure for attribute privacy and personal data protection.

[0053] Figure 2 An example 200 of the generation and use of (multiple) verifiable claims related to identity authentication and verification related to the registration process of ledger-based identities in accordance with various aspects of the present disclosure is illustrated. As shown in example 200, the information flow for verifiable claim generation and use comes from the W3C working draft of the Verifiable Credentials Data Model (1.0). In this data model, a credential is viewed as a collection of one or more claims made by an issuer 202, and may also include credential metadata and one or more proofs. In this example 200, the issuer 202 issues a credential to a holder 204, which acquires, stores, and presents the credential. The holder 204 sends a presentation to the verifier 206, which requests and verifies. A verifiable data registry 208 receives input from the issuer 202, the holder 204, and the verifier 206, and the verifiable data registry 208 maintains identifiers and schemas.

[0054] Figure 3 An example 300 of a DID registry on a distributed ledger and blockchain associated with a registration process for ledger-based identities according to various aspects of the present disclosure is illustrated. To implement DIDs and VCs, organizations working on SSI rely on the use of distributed ledgers and / or blockchains to support identifier registration. Specifically, the Decentralized Identity Foundation (DIF) proposes the architecture shown in example 300, which includes several components. For example, a user agent 302 is a program, such as a browser, mobile application, or other web-based client, that is responsible for coordinating communications between a holder (204), an issuer (202), and a verifier (206). A universal resolver 304 is a server that features a pluggable system of DID method drivers that enables resolution and discovery of DIDs in any decentralized system. A universal registrar 306 is a server that enables registration of DIDs across any decentralized system that produces compatible drivers. In addition, an identity hub 308 is a secure personal data store that coordinates the storage of signatures and / or encrypted data and relays messages to identity linking devices.

[0055] Figure 4 An example 400 of basic architectural elements of an SSI related to registration processing for ledger-based identities in accordance with aspects of the present disclosure is illustrated, such as related to identity management and identity verification processes from the perspective of the SSI. The basic architectural elements include a DID as an identifier that implements a verifiable decentralized digital identity. A DID refers to any subject (e.g., a person, organization, thing, data model, abstract entity, etc.) determined by a DID controller 402 of the DID. In the context of this report, only natural persons and legal persons are considered subjects.

[0056] A DID can be considered a form of pseudonym used in eIDAS because it has no direct connection to a formal identifier of a natural or legal person. A DID document 404 contains information associated with a DID and typically represents a verification method, such as an encrypted public key, and services related to interactions with the holder. A DID document can be signed by a DID controller. A DID controller 402 of a DID is an entity (individual, organization, or autonomous software) that has the ability to make changes to a DID document (as defined by the DID method). The report identifies the following security processes for DID controllers: proof of possession or control of its private key holder, and a unique DID to the holder.

[0057] A verifiable credential (VC) 406 is a collection of one or more claims made by a VC issuer 408. A verifiable credential 406 is a tamper-proof credential with an author identification that can be cryptographically verified. A VC issuer 408 is a role that a network entity can perform by asserting claims about one or more subjects, creating a verifiable credential based on these claims, and sending the verifiable credential to a holder 410. The security process of the DID controller 402 is identified by the report, including the authentication of the holder identified by its DID, proving that the claimed attributes belong to the holder, and revoking the holder's attributes. A presentation 412 is data derived from one or more verifiable credentials issued by one or more issuers, which is shared with a specific verifier 414. A verifiable presentation 412 is a tamper-proof presentation encoded in such a way that the author identification of the data can be trusted after a cryptographic verification process.

[0058] The VC repository 416 (of the holder 410) is a program, such as a repository or personal verifiable credential wallet, that is used to store and protect access to the holder's verifiable credentials. The use of the VC repository 416 is limited to the holder 410 or other authorized parties. The key wallet 418 (of the holder 410) is an application for generating, managing, storing or using private and public keys. This may need to be protected by a specially protected "secure element" within the wallet, and the use of the keys is limited to the holder. In this report, the wallet is used to cover the repository and key wallet 418 of verifiable data (e.g., DID documents, verifiable credentials). The wallet can be considered a form of secure area (SA application) and can be supported by using a proxy service that can be remotely accessed from the user's device and controlled by using multiple authentication factors.

[0059] The example basic architecture includes a DID registry 420 and a VC registry 422. In order to be able to parse DID documents, DIDs are typically recorded on some underlying system or network. Regardless of the specific technology used, any such system can support recording DIDs and returning the data required to generate DID documents. In this report, this is called a DID registry 420 (or a DID document registry). The DID registry can be based on a distributed ledger, such as a blockchain. The system can function through the creation and verification of intermediary identifiers, keys, and other related data (such as verifiable credential patterns, revocation registries, issuer public keys, etc.), which may be necessary to use verifiable credentials. Some configurations may require an identifier for an associated subject, and some registries (such as registries of UUIDs and public keys) can act as namespaces for identifiers. Holder authentication provides protocol exchanges to obtain authorized access to resources.

[0060] In an example implementation, the European Telecommunications Standards Institute (ETSI) PDL reference architecture describes services such as a registry service, an identification service, and an identification management service (among other services) as described below. Regarding registration: Listing of managed objects with an authority or registration body [Section 5.4.2.5 ETSI-ISG-PDL Registration Platform Service]. A registry service may provide methods for listing ETSI-ISG-PDL managed objects with local or international authorities or registries. Such a registry allows reference to such managed objects for legal, commercial, and operational purposes. Registration requirements may vary by geographic location, but not all registries are associated with the geographic location in which they are used. Certain managed objects (e.g., a PDL serving geographically diverse applications) operate in multiple geographic locations and may require multiple registrations. An ETSI-ISG-PDL managed object may be registered in one or more registries. Registered ETSI-ISG-PDL managed objects will be registered in accordance with the regulations and rules applicable to the region in which they operate.

[0061] About application registration: register and list all applications operating on the platform. Therefore [Clause 5.4.3.21.6 Application registration], application registration is a function to register and list all applications operating on the platform. The ETSI-ISG-PDL platform will maintain a list of all applications registered and operating on it.

[0062] About identity: unambiguously distinguishes an instance of an entity from other instances of that object and other objects. Thus [clause 5.4.2.3 ETSI-ISG-PDL Identity Platform Services], an identity of an entity is a set of contextually relevant numeric identifiers that unambiguously identify the instance of that entity from all other instances of that entity and other objects. An identity may use multiple attributes to uniquely identify it (e.g. two products with the same name have other different attributes, such as different serial numbers).

[0063] ETSI-ISG-PDL identities shall be constructed using one or more context-sensitive numeric identifiers that enable object instances to be unambiguously identified. A numeric identifier is a security object that is unique within a specific namespace. It is recommended to assign a namespace to each numeric identifier. ETSI-ISG-PDL numeric identifiers may be defined within a namespace to ensure their uniqueness. An entity may be used in different contexts. Therefore, for each context the same entity may be identified using a different set of numeric identifiers. This enables the semantics of the use of the entity in each context to be taken into account.

[0064] An ETSI-ISG-PDL managed object may have multiple context-dependent numeric identifiers that are used to establish the identity of the managed object in different situations in which it is used. The ETSI-ISG-PDL identification service provides a single identification token for each instance of an entity across all services, so that all services unambiguously identify that instance in the same way. The ETSI-ISG-PDL identification service is to provide a single numeric identification token for each instance of an entity.

[0065] Regarding identity management: Access control based on the identity of an entity. Therefore [clause 5.4.3.4.6 ETSI-ISG-PDL Identity Management Platform], the service Identity Management defines access control based on the identity of an entity that initiates a specific set of operations on a target according to a set of criteria. The ETSI-ISG-PDL Identity Management Platform service depends on the ETSI-ISG-PDL Namespace Platform Service and the ETSI-ISG-PDL Identity Platform Service. The Identity Management Platform Service will be implemented on all ETSI-ISG-PDL compliant platforms. The Identity Management Platform Service and the Identity Platform Service can be two different services. The Identity Platform Service defines how identities are assigned, while the Identity Management Platform Service defines how access is managed based on the assigned identities.

[0066] In terms of registration processing for ledger-based identities, new PDL platform services can be implemented to support identity (i.e., based on DID and SSI) and trust management solutions that rely on PDL and / or any ledger platform for related message exchanges and operations. In one or more implementations, PDL services include role-based registration management services; participant registry services (also referred to herein as DID operation participant registry services or ledger identity and trust management participant registry services); DID registry and DID resolver services; DID document registry services, such as for creation and storage, update and / or deletion and revocation; verifiable credential data registry services, such as for creation and storage, update and / or deletion and revocation; and DID verification services. The described role-based registration and deregistration services provide and support decentralized identity management and related verification for terminal devices and / or device applications.

[0067] By utilizing the described technology, role-based registration is implemented for participants (e.g., terminal devices or device applications) that interact with and participate in the identity and trust management framework to achieve DID-based authentication and authorization of DID holders (i.e., subjects or end users). The described technology also implements the deregistration and / or revocation of registered participants that interact with and participate in the identity and trust management framework.

[0068] Figure 5 An example 500 of an identity and trust management framework based on PDL platform services that supports registration processing for ledger-based identities according to various aspects of the present disclosure is illustrated. With respect to registering DID operation (i.e., DID and / or SSI-based identity and trust management) participants to the PDL platform, new PDL platform services 502 are implemented, such as a role-based registration management service and a DID operation participant registry service. The DID and / or SSI-based identity and trust management solution described in this example covers role-based registration of various actors or participants involved in the PDL platform-based identity and trust management framework, such as shown in example 500.

[0069] The end user or device is an identity holder 504 (e.g., referred to as a subject, such as a person, organization, thing, data model, abstract entity, function, end user, device, etc.). The identity holder 504 can generate a digital identifier by itself, such as a decentralized identifier (DID) or a self-sovereign identifier (SSI), or the digital identifier can be generated and supplied to the identity holder 504 by a service provider or DID controller 506 (i.e., another party or entity that creates a digital identifier on behalf of the identity holder to identify and authenticate the identity holder). Examples include that an organization can be an identity controller for its employees who are identity holders, and a person can be an identity controller for an Internet of Things (IoT) object associated with a person, where the IoT object can be an identity holder, etc.

[0070] A verifiable credential and / or claim issuer 508 (VC issuer) can perform claims about one or more subjects, create a verifiable credential (VC) based on these claims (e.g., a passport, driver's license, and birth certificate), and send the VC to a holder, where the VC includes a collection of one or more claims made by the issuer. A verifiable credential is a tamper-proof credential with an author identification that can be cryptographically verified. An identification holder 504 presents data derived from one or more verifiable credentials issued by one or more issuers (i.e., for authentication and authorization), which is shared with a specific verifier 512 as a presentation 510 for authentication. A verifiable presentation is a tamper-proof presentation that is encoded in such a way that the author identification of the data can be trusted after a cryptographic verification process.

[0071] In order to enable any verifier (such as a service provider or a third-party service provider) to verify the DID and authenticate the identity holder and / or subject, the example 500 implements a new PDL platform service 502 (in addition to the existing PDL service) that is related to role-based registration, storage and management of DIDs, DID documents, VCs, verification of DIDs, and selected opening of data and / or claims (as needed by the service). In addition, the DID-based identity framework may also include services related to governance 514 (i.e., the governance platform service may be a collection of rules and tools for controlling the behavior and functions of the PDL platform to achieve identity and trust management) and off-chain storage 516 (i.e., storing information in a digital machine-readable medium that is not stored on the main chain) to enable data-intensive and / or data-sensitive blockchain-based applications (such as VC) to scale. It is typically used to store non-transactional data that is too large to be efficiently stored in the blockchain or requires the ability to be changed or deleted. Off-chain data is typically only accessible to a subset of nodes participating in the chain.

[0072] The PDL platform services 502 include a role-based registration management service 518 (i.e., operations may involve registration, revocation, and / or deregistration). The role-based registration management service is responsible for the different roles, actors, and / or participants involved in the identity and trust management framework, and provides registry services (and authorization) specific to the corresponding roles of actors in the PDL platform. The different roles include identity holders, identity controllers, VC issuers, ID verifiers, etc. (e.g., any participant or stakeholder involved in the identity and trust management framework).

[0073] The PDL platform services 502 also include a DID operation participant registry service 520. The DID operation participant registry service records and tracks the identity and trust management framework participants registered and deregistered in the PDL platform based on instructions from the role-based registration management service 518. The PDL platform services 502 also include a DID registry and / or DID resolver service 522, which stores and tracks DIDs and their related DID document location information (e.g., address) to enable authorized services and entities to retrieve and verify DID documents.

[0074] The PDL platform services 502 also include a DID document registry service 524 (i.e., operations may involve creating and storing, updating, deleting, and revoking DID documents). The DID document registry service 524 may store and manage DID documents associated with a DID to facilitate DID verification. Each DID document may contain at least a proof purpose, service-specific information that the DID document may use, a verification method, and a service endpoint. The proof purpose is combined with the verification method to provide a mechanism for proving things. For example, a DID document may specify that a specific verification method (such as an encrypted public key or a pseudonymous biometric protocol) may be used to verify a proof created for authentication purposes. The service endpoint implements trusted interaction with the DID controller 506 and authorized verifiers.

[0075] The PDL platform service 502 also includes a verifiable credential (VC) data registry service 526 (i.e., operations may involve creating and storing, updating, deleting, and revoking VCs). The VC registry service 522 may store and manage VCs associated with a DID to facilitate VC-based DID verification and confirmation associated with a service request. The PDL platform service 502 also includes a DID verification management service 528. The DID verification management service may be implemented as a composite service that uses a DID registry service and / or a DID resolver service 522, a DID document registry service 524, and a DID operation participant registry service 520 to retrieve necessary data related to DID verification (i.e., authentication of a subject identified by a DID), and opens selective data to a verifier 512 to enable authorization verification of the subject for (multiple) corresponding services.

[0076] Figure 6 An example diagram 600 of a role-based registration process supporting registration processing for ledger-based identities according to various aspects of the present disclosure is illustrated. The role-based registration process involving a role-based registration management service 602 and a DID operation participant registry service 604 is shown in the example diagram 600. As a prerequisite, the terminal device 606 (i.e., the ID holder) may have been registered to the PDL platform as a normal user of the PDL platform, in which case the ID holder may have a source identity. If the ID holder has not previously performed a general registration on the PDL platform, the ID holder may send an anonymous or any preconfigured identity in the source identity.

[0077] In a first step 608, the ID holder (e.g., terminal device 606, device application) sends (e.g., transmits, transfers) a registration request to the PDL platform and L-RMS, which may include a source identifier, service type information (i.e., as a DID service, indicating that the registration is related to a DID terminal device to act as a DID-based ID holder or user in the identity management framework), an access role indicating that the terminal user or ID holder role is requested, and a DID (i.e., a digital identifier based on a DID or SSI, which is generated by a subject or service provider for the ID holder, and is supplied to the ID holder and provided as part of the DID). Alternatively, the source identifier may include a DID to be registered for the ID holder in the PDL platform. Alternatively, the registration request may be referred to as a DID registration request.

[0078] In a second step 610, the L-RMS may initiate and perform a mutually authenticated communication with the ID holder (e.g., based on local policy) based on any pre-configured credentials (e.g., credentials or public-private key pairs or any keys). In a third step 612, if mutual authentication is performed and successful, the L-RMS processes the registration request.

[0079] In the fourth step 614, the L-RMS determines that the ID holder is to be registered, and generates or sets a registration ID for the ID holder. In addition, the L-RMS generates a registry transaction notification message, which includes the L-RMS ID, the target registry service information (i.e., the registry service name, ID or address related to the DID operation participant registry), the source identifier, the service type information (DID service), the registration ID, the DID, the authorized access role (set to the ID holder), the authorization code and the lifetime expiration (e.g., the validity of the registration). In addition, the message can be transformed into a transaction (i.e., a DID operation participant registry transaction) to add a new participant to the registry (i.e., referred to as the DID operation participant registry). Alternatively, the L-RMS can directly generate a DID operation participant registry transaction, which can include the L-RMS ID, the target registry service information (i.e., the registry service name, ID or address related to the DID operation participant registry), the source identifier, the service type information (DID service), the registration ID, the DID, the authorized access role (set to the ID holder), the authorization code and the lifetime expiration (e.g., the validity of the registration).

[0080] In the fifth step 616, the L-RMS sends (e.g., transmits, transfers) a DID operation participant registry transaction to the configured PDL node 618, the transaction including a registry transaction notification message. It is worth noting that or alternatively, the DID operation participant registry service can be called a ledger identity and trust management participant registry service. Alternatively, the target registry service information can be part of the DID operation participant registry transaction, in which case the L-RMS sends the generated PDL transaction (i.e., DID operation participant registry transaction) to PDL node 1 618 (based on local configuration) in the fourth step 614.

[0081] In a sixth step 620, PDL Node 1 propagates the received registry transaction through the target PDL network (eg, to any PDL Node X 622). In a seventh step 624, PDL Node X 622 (eg, any PDL Node 2) receives the transaction from the target PDL network as a result of the transaction propagation.

[0082] In the eighth step 626, after the transaction is verified and successfully stored in the ledger (e.g., as a result of a PDL consensus process in the ledger associated with the registry service associated with the DID operation participant registry (transaction) based on the target registry service type information), PDL node 2 forwards the transaction to the registry service based on the target registry service information. The registry service transforms the transaction into a message to recover the message (i.e., the DID operation participant registry transaction as a registry transaction notification message). Alternatively, PDL node 2 transforms the transaction into a message and sends the DID operation participant registry transaction as a registry transaction notification message to the registry service.

[0083] In the ninth step 628, the registry service may store the DID operation participant registry transaction and / or information received as part of the registry transaction notification message (or vice versa) in local storage, off-chain and / or in the ledger. In the tenth step 630, the registry service may send (e.g., transmit, transfer) a confirmation message to the L-RMS, which may include the L-RMS ID, source ID, registration ID, registry service type and / or ID, and a result as a success indication. Alternatively, the registry service may send a response (i.e., a confirmation message) to the L-RMS via the PDL node 2 as a confirmation of the eighth step 626. In the eleventh step 632, the L-RMS sends (e.g., transmits, transfers) a registration response L-RMS ID, service type information (DID service), registration ID, authorized access role, authorization information (e.g., code or token) and lifetime expiration to the terminal device 606.

[0084] Regarding the adaptation of identity (i.e., DID) controller registration, the message process flow shown in example diagram 600 can be used to register the identity controller with the identity and trust management framework of the PDL platform, and the above steps provided in example diagram 600 can be applied to the following adaptation specific to the identity controller (rather than the ID holder / subject). In the first step 608, the DID controller sends a registration request to the PDL platform and L-RMS, where the required access role is set to 'ID / DID controller', and the source identity of the DID controller and the source ID of the ID holder are also included together with the other information described in the first step above. The above second and third steps are the same as above.

[0085] In the fourth step 614, the L-RMS determines the registered DID controller and generates or sets a registration ID for the DID controller. In addition, the L-RMS creates a registry transaction notification message, which includes the L-RMS ID, the target registry service information (i.e., the registry service name, ID or address related to the DID operation participant registry), the source identifier of the DID controller, the source ID of the ID holder, the service type information (DID service), the registration ID, the DID, the authorized access role (set to the DID controller), the authorization code and the lifetime expiration (for the validity of the registration). In addition, the message can be transformed into a transaction (i.e., a DID operation participant registry transaction) to add a new participant to the registry (i.e., called a DID operation participant registry). The above-mentioned fifth to eleventh steps (5-11) are the same as above.

[0086] Regarding the adaptation of VC issuer registration, the message process flow shown in the example diagram 600 can be used to register the VC issuer with the identity and trust management framework of the PDL platform, and the above steps provided in the example diagram 600 can be applied to the following adaptations specific to the VC issuer (rather than the ID holder or subject). In the first step 608, the VC issuer sends a registration request to the PDL platform and L-RMS, where the required access role is set to 'VC issuer', and the source identity of the VC issuer and the source ID of the ID holder are also included together with the other information described in the first step above. The above second and third steps are the same as above.

[0087] In the fourth step 614, the L-RMS determines the registered VC issuer and generates or sets a registration ID for the VC issuer. In addition, the L-RMS generates a registry transaction notification message, which includes the L-RMS ID, the target registry service information (i.e., the registry service name, ID or address related to the DID operation participant registry), the source identification of the VC issuer, the source ID of the ID holder, the service type information (DID service), the registration ID, the DID, the authorized access role (set to the VC issuer), the authorization code and the lifetime expiration (for the validity of the registration). In addition, the message can be transformed into a transaction (i.e., a DID operation participant registry transaction) to add a new participant to the registry (i.e., called the DID operation participant registry). The above-mentioned fifth to eleventh steps (5-11) are the same as above.

[0088] Regarding the adaptation of identity (i.e., DID) verifier registration, the message process flow shown in example diagram 600 can be used to register a DID verifier with the identity and trust management framework of the PDL platform, and the above steps provided by example diagram 600 can be applied to the following adaptation of the DID verifier (rather than the ID holder or subject). In the first step 608, the DID verifier sends a registration request to the PDL platform and L-RMS, where the required access role is set to 'DID verifier', and the source identity of the DID verifier is also included together with the other information described in the first step above. The above second and third steps are the same as above.

[0089] In the fourth step 614, the L-RMS determines the registered DID verifier and generates or sets a registration ID for the DID verifier. In addition, the L-RMS generates a registry transaction notification message, which includes the L-RMS ID, the target registry service information (i.e., the registry service name, ID or address related to the DID operation participant registry), the source identifier of the DID verifier, the service type information (DID service), the registration ID, the DID, the authorized access role (set to the DID verifier), the authorization code and the lifetime expiration (for the validity of the registration). In addition, the message can be transformed into a transaction (i.e., a DID operation participant registry transaction) to add a new participant to the registry (i.e., referred to as the DID operation participant registry). The above steps 5 to 11 (5-11) are the same as above.

[0090] The L-RMS may accept the required access role provided by the end device, client, or device application (in the first step) based on the authentication result (e.g., based on the credentials or end user information in any service level agreement (SLA)). In addition, based on local policy, authentication credential evaluation, and authentication results, the L-RMS may determine to deny the required access role requested by the end device. The registry service described in these implementations may use smart contracts to track lifetime-related expiration, linking of all DID-related entries, etc.

[0091] With respect to deregistering and / or revoking the registration of DID operation (i.e., DID or SSI-based identification and trust management) participants from the PDL platform, new PDL platform services 502 are implemented, such as role-based registration management services and DID operation participant registry services (also referred to herein as ledger identification and trust management participant registry services). End users, end devices, clients or device applications (i.e., associated with different registered participants, such as identity holders, identity controllers, VC issuers, ID verifiers) can be deregistered from the PDL platform's identity and trust management framework or DID operation participant registry based on a combination of one or more conditions, such as (i) the registry service identifies that the role-based registration has expired based on lifetime expiration; (ii) a smart contract configured by the registry service, which is used to notify the expiration of the lifetime of any registration associated with the registration ID, and then the registry service calls the deregistration or revocation of the registration; (iii) the governance body monitors the lifetime of the registration and prompts the registry service to revoke the registration if the lifetime of the registration is about to expire; (iv) the governance body identifies that the registered end user has violated any operation based on local policy; and (v) the L-RMS identifies that the registered end user has violated any operation, or has performed an opposite operation or execution based on local policy.

[0092] Figure 7 An example diagram 700 is illustrated of a revocation and cancellation process for a role-based registration supporting a ledger-based identity registration process in accordance with aspects of the present disclosure. The example diagram 700 illustrates the revocation of a role-based registration (i.e., associated with a registered participant), as described in the following process steps.

[0093] In a first step 702, the governance and / or registry service 704 may determine that the registration of a registered participant is to be revoked (which may also take into account the lifetime of the registration). In implementation, the registry service may also be referred to as a DID operation participant registry service, or a DID operation participant registration revocation service. In a second step 706, the registry service 704 sends a registration revocation request related to the terminal user or terminal device registration to the L-RMS 708 based on the L-RMS ID associated with the registration ID related to the DID operation participant registry transaction / information. Alternatively, the registration revocation request may be referred to as a deregistration request, as described herein. The registration revocation request may include an L-RMS ID, a source identifier, a registry service type and / or ID, a registration ID, an authorized access role, and a reason value related to the determination of the registration revocation (e.g., lifetime expiration, error, or any operation violation reason code).

[0094] In the third step 710, after the L-RMS receives a registration revocation request from any registered participant associated with its L-RMS ID, the L-RMS may process and call registration revocation. In the fourth step 712, based on local policies, the L-RMS may perform mutual authentication with the terminal device 714 to authenticate and establish a secure connection. In the fifth step 716, the L-RMS may send a registration revocation notification message to the terminal device, which may include a source identifier, service type information (DID service), a registration ID, and a reason value and / or information. In the sixth step 718, the terminal device 714 may send a registration revocation confirmation (Ack) message to the L-RMS (in response to the fifth step 716), which includes a registration ID and a success indication. In addition, the terminal device 714 may delete all information associated with the registration, such as a registration ID, authorization information, etc.).

[0095] In the seventh step 720, the L-RMS may generate a registration revocation confirmation message and convert it into a transaction (i.e., a registration revocation notification and confirmation), and send (e.g., transmit, transfer) to the PDL node 1 722 based on the local configuration. The registration revocation notification may include information related to the registry transaction, such as a registry service type and / or ID, an L-RMS ID, a source identifier, service type information (DID service), a registration ID, and a revocation indication (or a revocation success indication).

[0096] In the eighth step 724, PDL node 1 722 propagates the received transaction to any PDL node X 726 through the target PDL network. In the ninth step 728, PDL node X 726 (e.g., any PDL node 2) receives the transaction from the target PDL network as a result of the transaction propagation. In the tenth step 730, after the transaction is verified and successfully stored in the ledger (e.g., as a result of the PDL consensus process in the ledger associated with the registry service associated with the DID operation participant (revocation) registry (transaction) based on the target registry service type information), PDL node 2 forwards the transaction to the registry service based on the target registry service information. The registry service transforms the transaction into a message to restore the message (i.e., a registration revocation confirmation message). Alternatively, PDL node 2 transforms the transaction into a message and sends the registration revocation notification and confirmation transaction to the registry service as a registration revocation confirmation message.

[0097] In an eleventh step 732, the registry service may store the registration revocation notification and confirmation transaction and / or information received as part of the registration revocation confirmation message (or vice versa) in local storage, off-chain, and / or in a ledger. The smart contract may be configured to link and maintain registration states (such as successful registrations and revocations) associated with the registration ID and source ID.

[0098] In implementation, alternative steps may be implemented (7-11 or 12-13 may be implemented). In the twelfth step 734, based on local policy, the L-RMS may send a registration revocation confirmation message to the configured registry service (in response to steps two and six), the message including the L-RMS ID, source identifier, registry service type and ID, registration ID, and revocation indication (i.e., successful revocation indication). In the thirteenth step 736, the registry service may store the information received in the registration revocation confirmation message in local storage, off-chain, and / or in an account book. Regardless of the role, by providing the corresponding access role information in the second step 706, the process described in the example diagram 700 may be used to revoke the relevant registration of any terminal device or device application associated with the ID holder, identity controller, VC issuer, and / or ID verifier. In addition, the registry service described in this example may use smart contracts to track lifetime-related expiration, links to all DID-related entries, and the like.

[0099] Figure 8 An example of a block diagram 800 of a device 802 supporting registration processing for ledger-based identities in accordance with various aspects of the present disclosure is illustrated. The device 802 may be an example of a network entity 102, such as a device implementing L-RMS, or as a device implementing a registry service, as described herein. The device 802 may support wireless communications with one or more network entities 102, UEs 104, or any combination thereof. The device 802 may include components for bidirectional communications, including components for sending and receiving communications (such as a processor 804, a memory 806, a transceiver 808, and an I / O controller 810). These components may be in electronic communication or otherwise coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces (e.g., a bus).

[0100] The processor 804, the memory 806, the transceiver 808, or various combinations thereof, or various components thereof may be examples of means for performing various aspects of the present disclosure described herein. For example, the processor 804, the memory 806, the transceiver 808, or various combinations thereof, or components thereof may support methods for performing one or more of the operations described herein.

[0101] In some implementations, the processor 804, memory 806, transceiver 808, or various combinations or components thereof may be implemented in hardware (e.g., in a communications management circuit system). The hardware may include a processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof, which is configured to or otherwise supports means for performing the functions described in the present disclosure. In some implementations, the processor 804 and the memory 806 coupled to the processor 804 may be configured to perform one or more functions described herein (e.g., by executing instructions stored in the memory 806 by the processor 804).

[0102] For example, according to the examples disclosed herein, the processor 804 may support wireless communication at the device 802. The processor 804 may be configured to or otherwise support a component for: receiving a first signaling from a terminal device as a registration request; generating a registration table notification message based at least in part on a successful authentication of the terminal device; sending a second signaling to a first network entity implementing a PDL as a registration table transaction notification; receiving a third signaling from a second network entity implementing a registration table service as a registration confirmation message; and sending a fourth signaling to the terminal device as a registration response.

[0103] In addition, the processor 804 may be configured to or otherwise support any one or a combination of the following: the registration request includes an indication of the terminal device as at least one of a source identifier, service type information, a DID, a required access role, or a requested access role. If the terminal device or the application of the terminal device belongs to a DID holder, at least one of the required access role or the requested access role is indicated as a DID holder. If the terminal device or the application of the terminal device belongs to a DID controller, at least one of the required access role or the requested access role is indicated as a DID controller. If the terminal device or the application of the terminal device belongs to a VC issuer, at least one of the required access role or the requested access role is indicated as a VC issuer. If the terminal device or the application of the terminal device belongs to a DID verifier, at least one of the required access role or the requested access role is indicated as a DID verifier. The registry notification message includes at least one of the following: an L-RMS identifier, a source identifier, a service type information, a registry service type, a registry service identifier, a registration identifier, a DID, authorization information, an authorized access role, or a lifetime expiration. The registration response includes an indication of a failure result based at least in part on an authentication failure, a requested access role that cannot be accepted, or a local policy. The registration response includes at least one of the following: an indication of a successful result, an L-RMS identifier, service type information, a registration identifier, an authorized access role, authorization information, or a lifetime expiration. The authorization information included in the registration response indicates a code or token. The service type information included in the registration response indicates a DID service provided by an identification and trust management framework. The method also includes setting a registration identifier, setting authorization information, and allocating a lifetime expiration for registration. The method also includes generating a registry transaction notification based at least in part on an adaptation transformation of a registry notification message. The registry transaction notification includes at least one of the following: an L-RMS identifier, a source identifier, service type information, a registry service type, a registry service identifier, a registration identifier, a DID, an authorized access role, authorization information, or a lifetime expiration. The registration confirmation message includes at least one of the following: an L-RMS identifier, a source identifier, a registration identifier, a registry service type, a registry service identifier, or a success indication. The registration confirmation message is received from a DID operation participant registry service.

[0104] Additionally or alternatively, according to the examples disclosed herein, device 802 may include a processor and a memory coupled to the processor, the processor being configured to: receive a first signaling from a terminal device as a registration request; generate a registry notification message based at least in part on a successful authentication of the terminal device; send a second signaling to a first network entity that implements the PDL as a registry transaction notification; receive a third signaling from a second network entity that implements the registry service as a registration confirmation message; and send a fourth signaling to the terminal device as a registration response.

[0105] In addition, the wireless communication at the device 802 may include any one or a combination of the following: the registration request includes an indication of the terminal device as at least one of a source identifier, service type information, a DID, a required access role, or a requested access role. If the terminal device or the application of the terminal device belongs to a DID holder, at least one of the required access role or the requested access role is indicated as a DID holder. If the terminal device or the application of the terminal device belongs to a DID controller, at least one of the required access role or the requested access role is indicated as a DID controller. If the terminal device or the application of the terminal device belongs to a VC issuer, at least one of the required access role or the requested access role is indicated as a VC issuer. If the terminal device or the application of the terminal device belongs to a DID verifier, at least one of the required access role or the requested access role is indicated as a DID verifier. The registry notification message includes at least one of the following: an L-RMS identifier, a source identifier, a service type information, a registry service type, a registry service identifier, a registration identifier, a DID, authorization information, an authorized access role, or a lifetime expiration. The registration response includes an indication of a failure result based at least in part on an authentication failure, a requested access role that cannot be accepted, or a local policy. The registration response includes at least one of the following: an indication of a successful result, an L-RMS identifier, a service type information, a registration identifier, an authorized access role, authorization information, or a lifetime expiration. The authorization information included in the registration response indicates a code or a token. The service type information included in the registration response indicates a DID service provided by an identification and trust management framework. A memory coupled to the processor is configured to set a registration identifier, set authorization information, and allocate a lifetime expiration for registration. The memory coupled to the processor is configured to generate a registry transaction notification based at least in part on an adaptation transformation of a registry notification message. The registry transaction notification includes at least one of the following: an L-RMS identifier, a source identifier, a service type information, a registry service type, a registry service identifier, a registration identifier, a DID, an authorized access role, authorization information, or a lifetime expiration. The registration confirmation message includes at least one of the following: an L-RMS identifier, a source identifier, a registration identifier, a registry service type, a registry service identifier, or a success indication. The registration confirmation message is received from a DID operation participant registry service.

[0106] According to examples disclosed herein, a processor 804 of a device 802, such as a UE 104, may support wireless communications. The processor 804 includes at least one controller coupled to at least one memory and configured or operable to cause the processor to: receive first signaling from a terminal device as a registration request; generate a registry notification message based at least in part on successful authentication of the terminal device; send second signaling to a first network entity implementing a permissioned distributed ledger (PDL) as a registry transaction notification; receive third signaling from a second network entity implementing a registry service as a registration confirmation message; and send fourth signaling to the terminal device as a registration response.

[0107] In another example, according to examples disclosed herein, the processor 804 may support wireless communications at the device 802. The processor 804 may be configured to or otherwise support a component for: receiving first signaling as a registration revocation request associated with a terminal device, the registration revocation request received from a first network entity implementing a registry service; processing the registration revocation request based at least in part on an L-RMS identifier associated with the terminal device; and sending second signaling as a registration revocation confirmation notification to the registry service recording the registration revocation.

[0108] In addition, the processor 804 can be configured to or otherwise support any one or a combination of the following: the second signaling is sent as a registration revocation confirmation notification to the second network entity implementing the PDL, and the registration revocation confirmation notification is propagated through the PDL network to the registry service that records the registration revocation. The method also includes: sending a third signaling to the terminal device as a registration revocation notification; and receiving a fourth signaling from the terminal device as a registration revocation confirmation message. The registration revocation request includes an L-RMS identifier associated with the registration identifier of the DID operation participant registry transaction corresponding to the terminal device. The registration revocation request includes at least one of the following: an L-RMS identifier, a source identifier, a registry service type, a registry service identifier, a registration identifier or an authorized access role and a reason value related to the registration revocation. The registration revocation confirmation notification includes registry transaction information as at least one of the following: a registry service type, a registry service identifier, an L-RMS identifier, a source identifier, service type information, a registration identifier, or a revocation success indication.

[0109] Additionally or alternatively, according to the examples disclosed herein, device 802 may include a processor and a memory coupled to the processor, the processor being configured to: receive first signaling as a registration revocation request associated with a terminal device, the registration revocation request being received from a first network entity implementing a registry service; process the registration revocation request based at least in part on an L-RMS identifier associated with the terminal device; and send second signaling as a registration revocation confirmation notification to the registry service that records the registration revocation.

[0110] In addition, the wireless communication at device 802 may include any one of the following or a combination thereof: a second signaling is sent as a registration revocation confirmation notification to a second network entity implementing the PDL, and the registration revocation confirmation notification is propagated through the PDL network to a registry service that records the registration revocation. A memory coupled to the processor is configured to: send a third signaling to the terminal device as a registration revocation notification; and receive a fourth signaling from the terminal device as a registration revocation confirmation message. The registration revocation request includes an L-RMS identifier associated with a registration identifier of a DID operation participant registry transaction corresponding to the terminal device. The registration revocation request includes at least one of the following: an L-RMS identifier, a source identifier, a registry service type, a registry service identifier, a registration identifier or an authorized access role and a cause value related to the registration revocation. The registration revocation confirmation notification includes registry transaction information as at least one of the following: a registry service type, a registry service identifier, an L-RMS identifier, a source identifier, service type information, a registration identifier, or a revocation success indication.

[0111] In another example, according to examples disclosed herein, the processor 804 may support wireless communication at the device 802. The processor 804 may be configured to or otherwise support a component for: receiving a first signaling from the PDL as a registry transaction notification, the registry transaction notification being generated by the L-RMS based at least in part on a registration request from the terminal device and a successful authentication of the terminal device; recording the registry transaction notification; and sending a second signaling to the L-RMS as a registration confirmation message, the L-RMS transmitting a registration response to the terminal device.

[0112] In addition, the processor 804 may be configured to or otherwise support any one or a combination of the following: the registry transaction notification includes at least one of the following: an L-RMS identifier, a source identifier, a service type information, a registry service type, a registry service identifier, a registration identifier, a DID, an authorized access role, authorization information, or a lifetime expiration. The registration confirmation message includes at least one of the following: an L-RMS identifier, a source identifier, a registration identifier, a registry service type, a registry service identifier, or a success indication. The method also includes maintaining a record of DID-based identification system participants, which are identified as at least one of a DID operation participant registry service or a book identification and trust management participant registry service. The method also includes sending a third signaling to the L-RMS as a registration revocation request, the registration revocation request being associated with the terminal device and at least partially based on a determination to call registration revocation. The method also includes receiving a fourth signaling from the PDL as a registry transaction revocation notification, the registry transaction revocation notification being routed from the L-RMS via the PDL; and recording the registry transaction revocation notification. The method also includes receiving a fourth signaling from the L-RMS as a registration revocation confirmation notification; and recording the registration revocation confirmation notification.

[0113] Additionally or alternatively, according to the examples disclosed herein, device 802 may include a processor and a memory coupled to the processor, the processor being configured to: receive first signaling from the PDL as a registry transaction notification, the registry transaction notification being generated by the L-RMS based at least in part on a registration request from the terminal device and a successful authentication of the terminal device; record the registry transaction notification; and send second signaling to the L-RMS as a registration confirmation message, the L-RMS transmitting a registration response to the terminal device.

[0114] In addition, the wireless communication at the device 802 may include any one or a combination of the following: the registry transaction notification includes at least one of the following: an L-RMS identifier, a source identifier, a service type information, a registry service type, a registry service identifier, a registration identifier, a DID, an authorized access role, authorization information, or a lifetime expiration. The registration confirmation message includes at least one of the following: an L-RMS identifier, a source identifier, a registration identifier, a registry service type, a registry service identifier, or a success indication. The memory coupled to the processor is configured to maintain a record of DID-based identification system participants, and the device is identified as at least one of a DID operation participant registry service or a book identification and trust management participant registry service. The memory coupled to the processor is configured to send a third signaling to the L-RMS as a registration revocation request, the registration revocation request is associated with the terminal device and is at least partially based on the determination of invoking registration revocation. The memory coupled to the processor is configured to: receive a fourth signaling from the PDL as a registry transaction revocation notification, the registry transaction revocation notification is routed from the L-RMS via the PDL; and record the registry transaction revocation notification. The memory coupled to the processor is configured to: receive fourth signaling from the L-RMS as a registration revocation confirmation notification; and record the registration revocation confirmation notification.

[0115] The processor 804 may include an intelligent hardware device (e.g., a general purpose processor, a DSP, a CPU, a microcontroller, an ASIC, an FPGA, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some implementations, the processor 804 may be configured to operate a memory array using a memory controller. In some other implementations, the memory controller may be integrated into the processor 804. The processor 804 may be configured to execute computer-readable instructions stored in a memory (e.g., a memory 806) to cause the device 802 to perform various functions of the present disclosure.

[0116] The memory 806 may include random access memory (RAM) and read-only memory (ROM). The memory 806 may store computer-readable computer executable code, which includes instructions that, when executed by the processor 804, cause the device 802 to perform various functions described herein. The code may be stored in a non-transitory computer-readable medium such as a system memory or another type of memory. In some implementations, the code may not be directly executable by the processor 804, but may cause a computer (e.g., when compiled and executed) to perform the functions described herein. In some implementations, the memory 806 may include a basic I / O system (BIOS), which may control basic hardware or software operations, such as interaction with peripheral components or devices.

[0117] I / O controller 810 can manage input and output signals of device 802. I / O controller 810 can also manage peripheral devices that are not integrated into device 2402. In some implementations, I / O controller 810 can represent a physical connection or port to an external peripheral device. In some implementations, I / O controller 810 can utilize an operating system, such as Or another known operating system. In some implementations, I / O controller 810 can be implemented as part of a processor such as processor 804. In some implementations, a user can interact with device 802 via I / O controller 810 or via hardware components controlled by I / O controller 810.

[0118] In some implementations, the device 802 may include a single antenna 812. However, in some other implementations, the device 802 may have more than one antenna 812 (i.e., multiple antennas), including multiple antenna panels or antenna arrays, which are capable of concurrently sending or receiving multiple wireless transmissions. The transceiver 808 can communicate bidirectionally via one or more antennas 812, wired or wireless links, as described herein. For example, the transceiver 808 can represent a wireless transceiver and can communicate bidirectionally with another wireless transceiver. The transceiver 808 may also include a modem for modulating packets, providing the modulated packets to one or more antennas 812 for transmission, and demodulating packets received from one or more antennas 812.

[0119] Fig. 9 An example of a block diagram 900 of a device 902 supporting registration processing for ledger-based identification according to aspects of the present disclosure is illustrated. The device 902 may be an example of a network entity 102, such as an end device or a device application, as described herein. The device 902 may support wireless communications with one or more network entities 102, UEs 104, or any combination thereof. The device 902 may include components for bidirectional communications, including components for sending and receiving communications (such as a processor 904, a memory 906, a transceiver 908, and an I / O controller 910). These components may be in electronic communication or otherwise coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more interfaces (e.g., a bus).

[0120] The processor 904, memory 906, transceiver 908, or various combinations thereof, or various components thereof may be examples of means for performing various aspects of the present disclosure described herein. For example, the processor 904, memory 906, transceiver 908, or various combinations thereof, or components thereof may support methods for performing one or more of the operations described herein.

[0121] In some implementations, the processor 904, memory 906, transceiver 908, or various combinations or components thereof may be implemented in hardware (e.g., in a communications management circuit system). The hardware may include a processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof, which is configured to or otherwise supports means for performing the functions described in the present disclosure. In some implementations, the processor 904 and the memory 906 coupled to the processor 904 may be configured to perform one or more functions described herein (e.g., by executing instructions stored in the memory 906 by the processor 904).

[0122] For example, according to the examples disclosed herein, the processor 904 may support wireless communication at the device 902. The processor 904 may be configured to or otherwise support a component for: sending a first signaling as a registration request for a terminal device to a first network entity implementing an L-RMS, the L-RMS authenticating the terminal device, sending a registration table transaction notification to the PDL, and receiving a registration confirmation message from the registration table service; and receiving a second signaling as a registration response from the L-RMS.

[0123] In addition, the processor 904 may be configured to or otherwise support any one or a combination of the following: the registration request includes an indication of the terminal device as at least one of a source identifier, service type information, a DID, a required access role, or a requested access role. If the terminal device or the application of the terminal device belongs to a DID holder, at least one of the required access role or the requested access role is indicated as a DID holder. If the terminal device or the application of the terminal device belongs to a DID controller, at least one of the required access role or the requested access role is indicated as a DID controller. If the terminal device or the application of the terminal device belongs to a VC issuer, at least one of the required access role or the requested access role is indicated as a VC issuer. If the terminal device or the application of the terminal device belongs to a DID verifier, at least one of the required access role or the requested access role is indicated as a DID verifier. The registration response includes an indication based at least in part on an authentication failure, an inability to accept the requested access role, or a failure result of a local policy. The registration response includes at least one of the following: an indication of a successful result, an L-RMS identifier, service type information, a registration identifier, an authorized access role, authorization information, or a lifetime expiration. The authorization information included in the registration response indicates a code or token. The service type information included in the registration response indicates a DID service provided by the identity and trust management framework.

[0124] Additionally or alternatively, according to the examples disclosed herein, device 902 may include a processor and a memory coupled to the processor, the processor being configured to: send a first signaling as a registration request to a first network entity implementing L-RMS, the L-RMS authenticating the device, sending a registry transaction notification to the PDL, and receiving a registration confirmation message from the registry service; and receiving a second signaling as a registration response from the L-RMS.

[0125] In addition, the wireless communication at the device 902 may include any one or a combination of the following: the registration request includes an indication of the device as at least one of a source identification, service type information, a DID, a required access role, or a requested access role. If the device or the application of the device belongs to a DID holder, at least one of the required access role or the requested access role is indicated as a DID holder. If the device or the application of the device belongs to a DID controller, at least one of the required access role or the requested access role is indicated as a DID controller. If the device or the application of the device belongs to a VC issuer, at least one of the required access role or the requested access role is indicated as a VC issuer. If the device or the application of the device belongs to a DID verifier, at least one of the required access role or the requested access role is indicated as a DID verifier. The registration response includes an indication of a failure result based at least in part on an authentication failure, a requested access role that cannot be accepted, or a local policy. The registration response includes at least one of the following: an indication of a successful result, an L-RMS identifier, service type information, a registration identifier, an authorized access role, authorization information, or a lifetime expiration. The authorization information included in the registration response indicates a code or a token. The service type information included in the registration response indicates a DID service provided by the identity and trust management framework.

[0126] The processor 904 may include an intelligent hardware device (e.g., a general purpose processor, a DSP, a CPU, a microcontroller, an ASIC, an FPGA, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some implementations, the processor 904 may be configured to operate a memory array using a memory controller. In some other implementations, the memory controller may be integrated into the processor 904. The processor 904 may be configured to execute computer-readable instructions stored in a memory (e.g., a memory 906) to cause the device 902 to perform various functions of the present disclosure.

[0127] The memory 906 may include random access memory (RAM) and read-only memory (ROM). The memory 906 may store computer-readable computer executable code, which includes instructions that, when executed by the processor 904, cause the device 902 to perform various functions described herein. The code may be stored in a non-transitory computer-readable medium such as a system memory or another type of memory. In some implementations, the code may not be directly executable by the processor 904, but may cause a computer (e.g., when compiled and executed) to perform the functions described herein. In some implementations, the memory 906 may include a basic I / O system (BIOS), which may control basic hardware or software operations, such as interaction with peripheral components or devices.

[0128] I / O controller 910 can manage input and output signals of device 902. I / O controller 910 can also manage peripheral devices that are not integrated into device 2402. In some implementations, I / O controller 910 can represent a physical connection or port to an external peripheral device. In some implementations, I / O controller 910 can utilize an operating system, such as Or another known operating system. In some implementations, I / O controller 910 can be implemented as part of a processor such as processor 904. In some implementations, a user can interact with device 902 via I / O controller 910 or via hardware components controlled by I / O controller 910.

[0129] In some implementations, the device 902 may include a single antenna 912. However, in some other implementations, the device 902 may have more than one antenna 912 (i.e., multiple antennas), including multiple antenna panels or antenna arrays, which are capable of concurrently sending or receiving multiple wireless transmissions. The transceiver 908 can communicate bidirectionally via one or more antennas 912, wired or wireless links, as described herein. For example, the transceiver 908 can represent a wireless transceiver and can communicate bidirectionally with another wireless transceiver. The transceiver 908 may also include a modem for modulating packets, providing the modulated packets to one or more antennas 912 for transmission, and demodulating packets received from one or more antennas 912.

[0130] Fig.10 A flow chart of a method 1000 for supporting a registration process for a ledger-based identity according to aspects of the present disclosure is illustrated. The operations of the method 1000 may be implemented by a device or component thereof as described herein. For example, the operations of the method 1000 may be performed by a network entity 102, such as a device implementing an L-RMS, as described in reference Figures 1 to 9In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform various aspects of the described functions.

[0131] At 1002, the method may include receiving first signaling from a terminal device as a registration request. The operations of 1002 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1002 may be described by reference to Figure 1 The device is used to perform the above.

[0132] At 1004, the method may include generating a registry notification message based at least in part on successful authentication of the terminal device. The operations of 1004 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1004 may be described by reference to Figure 1 The device is used to perform the above.

[0133] At 1006, the method may include sending a second signaling as a registry transaction notification to the first network entity implementing the PDL. The operations of 1006 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1006 may be described by reference to Figure 1 The device is used to perform the above.

[0134] At 1008, the method may include receiving third signaling as a registration confirmation message from a second network entity implementing a registry service. The operations of 1008 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1008 may be described with reference to Figure 1 The device is used to perform the above.

[0135] At 1010, the method may include sending a fourth signaling to the terminal device as a registration response. The operations of 1010 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1010 may be described with reference to Figure 1 The device is used to perform the above.

[0136] Fig.11 A flow chart of a method 1100 for supporting a registration process for a ledger-based identity according to aspects of the present disclosure is illustrated. The operations of the method 1100 may be implemented by a device or component thereof as described herein. For example, the operations of the method 1100 may be performed by a network entity 102, such as a device implementing L-RMS, as described in reference Figures 1 to 9 In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform various aspects of the described functions.

[0137] At 1102, the method may include setting a registration identifier, setting authorization information, and assigning a lifetime expiration for the registration. The operations of 1102 may be performed according to examples described herein. In some implementations, aspects of the operations of 1102 may be described by reference to Figure 1 The device is used to perform the above.

[0138] At 1104, the method may include generating a registry transaction notification based at least in part on an adaptation transformation of the registry notification message. The operations of 1104 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1104 may be described by reference to Figure 1 The device is used to perform the above.

[0139] Fig.12 A flow chart of a method 1200 for supporting a registration process for a ledger-based identity according to aspects of the present disclosure is illustrated. The operations of the method 1200 may be implemented by a device or component thereof as described herein. For example, the operations of the method 1200 may be performed by a network entity 102, such as a device implementing L-RMS, as described in reference Figures 1 to 9 In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform various aspects of the described functions.

[0140] At 1202, the method may include receiving first signaling as a registration deregistration request associated with a terminal device, the registration deregistration request received from a first network entity implementing a registry service. The operations of 1202 may be performed according to examples described herein. In some implementations, aspects of the operations of 1202 may be implemented by reference to Figure 1 The device is used to perform the above.

[0141] At 1204, the method may include processing a registration revocation request based at least in part on an L-RMS identifier associated with the terminal device. The operations of 1204 may be performed according to examples described herein. In some implementations, aspects of the operations of 1204 may be described with reference to Figure 1 The device is used to perform the above.

[0142] At 1206, the method may include sending a second signaling as a registration cancellation confirmation notification to a registry service that records the registration cancellation. The operations of 1206 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1206 may be described by reference to Figure 1 The device is used to perform the above.

[0143] Fig.13A flow chart of a method 1300 for supporting a registration process for a ledger-based identity according to aspects of the present disclosure is illustrated. The operations of the method 1300 may be implemented by a device or component thereof as described herein. For example, the operations of the method 1300 may be performed by a network entity 102, such as a device implementing L-RMS, as described in reference Figures 1 to 9 In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform various aspects of the described functions.

[0144] At 1302, the method may include sending a third signaling to the terminal device as a registration revocation notification. The operations of 1302 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1302 may be described by reference to Figure 1 The device is used to perform the above.

[0145] At 1304, the method may include receiving fourth signaling from the terminal device as a registration deregistration confirmation message. The operations of 1304 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1304 may be described with reference to Figure 1 The device is used to perform the above.

[0146] Fig.14 A flow chart of a method 1400 for supporting a registration process for a ledger-based identity according to aspects of the present disclosure is illustrated. The operations of the method 1400 may be implemented by a device or component thereof as described herein. For example, the operations of the method 1400 may be performed by a network entity 102, such as a terminal device or a device application, as described in reference Figures 1 to 9 In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform various aspects of the described functions.

[0147] At 1402, the method may include sending a first signaling as a registration request for a terminal device to a first network entity implementing an L-RMS, the L-RMS authenticating the terminal device, sending a registration table transaction notification to the PDL, and receiving a registration confirmation message from the registration table service. The operations of 1402 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1402 may be implemented by reference to Figure 1 The device is used to perform the above.

[0148] At 1404, the method may include receiving second signaling from the L-RMS as a registration response. The operations of 1404 may be performed according to examples described herein. In some implementations, aspects of the operations of 1404 may be described with reference to Figure 1The device is used to perform the above.

[0149] Fig.15 A flow chart of a method 1500 for supporting a registration process for a ledger-based identity according to aspects of the present disclosure is illustrated. The operations of the method 1500 may be implemented by a device or component thereof as described herein. For example, the operations of the method 1500 may be performed by a network entity 102, such as a device implementing a registry service, as described in reference to Figures 1 to 9 In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform various aspects of the described functions.

[0150] At 1502, the method may include receiving first signaling from the PDL as a registry transaction notification, the registry transaction notification generated by the L-RMS based at least in part on a registration request from the terminal device and a successful authentication of the terminal device. The operations of 1502 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1502 may be described with reference to Figure 1 The device is used to perform the above.

[0151] At 1504, the method may include logging a registry transaction notification. The operations of 1504 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1504 may be described by reference to Figure 1 The device is used to perform the above.

[0152] At 1506, the method may include sending a second signaling as a registration confirmation message to the L-RMS, which transmits a registration response to the terminal device. The operations of 1506 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1506 may be described with reference to Figure 1 The device is used to perform the above.

[0153] Fig.16 A flow chart of a method 1600 for supporting registration processing of ledger-based identities according to aspects of the present disclosure is illustrated. The operations of the method 1600 may be implemented by a device or component thereof as described herein. For example, the operations of the method 1600 may be performed by a network entity 102, such as a device implementing a registry service, as described in reference Figures 1 to 9 In some implementations, the device may execute a set of instructions to control the functional elements of the device to perform the described functions. Additionally or alternatively, the device may use dedicated hardware to perform various aspects of the described functions.

[0154] At 1602, the method may include maintaining a record of DID-based identification system participants, the participants being identified as at least one of a DID operation participant registry service or a ledger identification and trust management participant registry service. The operations of 1602 may be performed according to examples described herein. In some implementations, aspects of the operations of 1602 may be performed by reference to Figure 1 The device is used to perform the above.

[0155] At 1604, the method may include sending a third signaling to the L-RMS as a registration revocation request, the registration revocation request being associated with the terminal device and based at least in part on the determination to invoke registration revocation. The operations of 1604 may be performed according to examples described herein. In some implementations, aspects of the operations of 1604 may be described with reference to Figure 1 The device is used to perform the above.

[0156] At 1606, the method may include receiving a fourth signaling from the PDL as a registry transaction revocation notification, the registry transaction revocation notification being routed from the L-RMS via the PDL. The operations of 1606 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1606 may be described by reference to Figure 1 The device is used to perform the above.

[0157] At 1608, the method may include recording a registry transaction revocation notification. The operations of 1608 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1608 may be described by reference to Figure 1 The device is used to perform the above.

[0158] At 1610, the method may include receiving a fourth signaling from the L-RMS as a registration deregistration confirmation notification. The operations of 1610 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1610 may be described with reference to Figure 1 The device is used to perform the above.

[0159] At 1612, the method may include recording a registration revocation confirmation notification. The operations of 1612 may be performed according to the examples described herein. In some implementations, aspects of the operations of 1612 may be described by reference to Figure 1 The device is used to perform the above.

[0160] It should be noted that the methods described herein describe possible implementations, and that the operations and steps may be rearranged or otherwise modified, and other implementations are possible. Furthermore, aspects from two or more methods may be combined.

[0161] The various illustrative blocks and components described in conjunction with the disclosure herein may be implemented or executed with a general purpose processor, DSP, ASIC, CPU, FPGA or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in an alternative, the processor may be any processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors in combination with a DSP core, or any other such configuration).

[0162] The functions described herein may be implemented in hardware, software executed by a processor, firmware, or any combination thereof. If implemented in software executed by a processor, the functions may be stored on or sent via a computer-readable medium as one or more instructions or codes. Other examples and implementations are within the scope of this disclosure and the appended claims. For example, due to the nature of software, the functions described herein may be implemented using software executed by a processor, hardware, firmware, hard wiring, or any combination of these. Features that implement the functions may also be physically located in various locations, including being distributed so that portions of the functions are implemented in different physical locations.

[0163] Computer-readable media include both non-transient computer storage media and communication media, and communication media include any medium that facilitates the transmission of computer programs from one place to another. Non-transient storage media can be any available medium that can be accessed by a general or special-purpose computer. As an example and not limitation, non-transient computer-readable media can include RAM, ROM, electrically erasable programmable ROM (EEPROM), flash memory, compact disk (CD) ROM or other optical disk storage, disk storage or other magnetic storage devices, or can be used to carry or store desired program code devices in the form of instructions or data structures and can be accessed by a general or special-purpose computer, or any other non-transient medium of a general or special-purpose processor.

[0164] Any connection may be appropriately referred to as a computer-readable medium. For example, if the software is sent from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technology (such as infrared, radio, and microwave), the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technology (such as infrared, radio, and microwave) is included in the definition of computer-readable medium. Disks and optical disks as used herein include CDs, laser disks, optical disks, digital versatile disks (DVDs), floppy disks, and Blu-ray disks, wherein disks typically reproduce data magnetically, and optical disks reproduce data optically with lasers. Combinations of the above are also included within the scope of computer-readable media.

[0165] As used herein, including in the claims, "or" used in a list of items (e.g., a list of items beginning with a phrase such as "at least one of" or "one or more of" or "one or both of") represents an inclusive list, so that, for example, a list of at least one of A, B, or C means A or B or C or AB or AC or BC or ABC (i.e., A and B and C). Similarly, a list of one or more of A, B, or C refers to A or B or C or AB or AC or BC or ABC (i.e., A and B and C). In addition, as used herein, the phrase "based on" should not be interpreted as a reference to a closed set of conditions. For example, an example step described as "based on condition A" may be based on both condition A and condition B without departing from the scope of the present disclosure. In other words, as used herein, the phrase "based on" should be interpreted in the same manner as the phrase "based at least in part on". In addition, as used herein, including in the claims, a "set" may include one or more elements.

[0166] When referring to a network entity, the terms "send," "receive," or "transmit" may refer to any part of a network entity of a RAN (e.g., base station, CU, DU, RU) that communicates with another device (e.g., directly or via one or more other network entities).

[0167] The descriptions described herein in conjunction with the accompanying drawings describe example configurations and do not represent all examples that may be implemented or within the scope of the claims. The term "example" as used herein means "used as an example, instance, or illustration," rather than "preferred" or "better than other examples." The detailed description includes specific details to facilitate understanding of the described techniques. However, these techniques may be practiced without these specific details. In some cases, known structures and devices are shown in block diagram form to avoid confusing the concepts of the described examples.

[0168] The description herein is provided to enable one of ordinary skill in the art to make or use the present disclosure. Various modifications to the present disclosure will be clear to one of ordinary skill in the art, and the general principles defined herein may be applied to other variations without departing from the scope of the present disclosure. Therefore, the present disclosure is not limited to the examples and designs described herein, but should conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A device for wireless communication, comprising: at least one memory; as well as at least one processor coupled to the at least one memory and configured to cause the apparatus to: receiving a first signaling from a terminal device as a registration request; generating a registry notification message based at least in part on successful authentication of the terminal device; sending second signaling as a registry transaction notification to a first network entity implementing a permissioned distributed ledger (PDL); receiving third signaling as a registration confirmation message from a second network entity implementing a registration form service; as well as A fourth signaling is sent to the terminal device as a registration response.

2. An apparatus according to claim 1, wherein the registration request includes an indication of the terminal device as at least one of a source identification, service type information, a decentralized identifier (DID), a required access role, or a requested access role.

3. The apparatus of claim 2, wherein at least one of the required access role or the requested access role is indicated as at least one of: DID holder, if the terminal device or the application of the terminal device belongs to the DID holder or the identifier holder; or DID controller, if the terminal device or the application of the terminal device belongs to the DID controller or identification controller.

4. The apparatus of claim 2, wherein at least one of the required access role or the requested access role is indicated as at least one of: A verifiable credential (VC) issuer, if the terminal device or the application of the terminal device belongs to the VC issuer; or DID verifier, if the terminal device or the application of the terminal device belongs to the DID verifier.

5. The apparatus of claim 1 , wherein the registry notification message comprises at least one of: a ledger registration management service (L-RMS) identifier, a source identifier, service type information, a registry service type, a registry service identifier, a registration identifier, a decentralized identifier (DID), authorization information, an authorized access role, or a lifetime expiration.

6. The apparatus of claim 1, wherein the registration response includes an indication of a failure result based at least in part on an authentication failure, an unacceptable requested access role, or a local policy.

7. The apparatus of claim 1, wherein the registration response comprises at least one of: an indication of a successful outcome, a Ledger Registration Management Service (L-RMS) identifier, service type information, a registration identifier, an authorized access role, authorization information, or a lifetime expiration.

8. The apparatus of claim 7, wherein the at least one processor is configured to cause the apparatus to set the registration identifier, set the authorization information, and assign the lifetime expiration for registration.

9. The apparatus of claim 1, wherein the at least one processor is configured to cause the apparatus to generate the registry transaction notification based at least in part on an adaptation transformation of the registry notification message.

10. The apparatus of claim 1, wherein the registration confirmation message comprises at least one of: a ledger registration management service (L-RMS) identifier, a source identifier, a registration identifier, a registry service type, a registry service identifier, or a success indication.

11. An apparatus for wireless communication, comprising: at least one memory; as well as at least one processor coupled to the at least one memory and configured to cause the apparatus to: sending first signaling as a registration request to a first network entity implementing a ledger registry management service (L-RMS), the L-RMS authenticating the device, sending a registry transaction notification to a permissioned distributed ledger (PDL) node or network, and receiving a registration confirmation message from the registry service; as well as A second signaling is received from the L-RMS as a registration response.

12. An apparatus for wireless communication, comprising: at least one memory; as well as at least one processor coupled to the at least one memory and configured to cause the apparatus to: receiving first signaling as a registration deregistration request associated with a terminal device, the registration deregistration request being received from a first network entity implementing a registry service; processing the registration revocation request based at least in part on a Ledger Registration Management Service (L-RMS) identifier associated with the terminal device; as well as A second signaling is sent to the registry service that records the registration deregistration as a registration deregistration confirmation notification.

13. The apparatus of claim 12, wherein the second signaling is sent as the registration revocation confirmation notification to a second network entity implementing a permissioned distributed ledger (PDL) node or network, the registration revocation confirmation notification being propagated through the PDL network to the registry service that records the registration revocation.

14. The apparatus of claim 12, wherein the at least one processor is configured to cause the apparatus to: Sending a third signaling to the terminal device as a registration revocation notification or a deregistration notification; and A fourth signaling is received from the terminal device as a registration deregistration confirmation message or a deregistration confirmation message.

15. The apparatus of claim 12, wherein the registration revocation request comprises an L-RMS identifier associated with a registration identifier of a decentralized identifier (DID) operation participant registry information transaction corresponding to the terminal device.

16. The apparatus of claim 12, wherein the registration revocation request comprises at least one of: an L-RMS identifier, a source identifier, a registry service type, a registry service identifier, a registration identifier, or an authorized access role and a cause value associated with the registration revocation.

17. The apparatus of claim 12, wherein the registration revocation confirmation notification comprises registry transaction information that is at least one of: a registry service type, a registry service identifier, an L-RMS identifier, a source identifier, service type information, a registration identifier, or a revocation success indication.

18. An apparatus for wireless communication, comprising: at least one memory; as well as at least one processor coupled to the at least one memory and configured to cause the apparatus to: receiving first signaling from a permissioned distributed ledger (PDL) node or network as a registry transaction notification generated by a ledger registration management service (L-RMS) based at least in part on a registration request from an end device and a successful authentication of the end device; Recording the registry transaction notification; as well as A second signaling is sent to the L-RMS as a registration confirmation message, and the L-RMS transmits a registration response to the terminal device.

19. The apparatus of claim 18, wherein the at least one processor is configured to cause the apparatus to send third signaling to the L-RMS as a registration revocation request, the registration revocation request being associated with the terminal device and based at least in part on a determination to invoke registration revocation or deregistration.

20. The apparatus of claim 19, wherein the at least one processor is configured to cause the apparatus to receive the fourth signaling as at least one of: a registry transaction revocation notification from the PDL node or network, the registry transaction revocation notification being routed from the L-RMS via the PDL node or network, and the registry transaction revocation notification being recorded; or A registration deregistration confirmation notification is received from the L-RMS, and the registration deregistration confirmation notification is recorded.

Images