Verified Credential Authentication With DID Privacy and Audit
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in managing and authenticating verified credentials, particularly in indirect relationships between customers and service providers, leading to authorization issues and difficulties in maintaining privacy and compensating issuers for credential usage.
Innovation Solution
A system utilizing blockchain technology and decentralized identifiers (DIDs) to manage and authenticate credentials, enabling issuers to encrypt credentials with audit engines, allowing relying parties to verify authenticity while maintaining privacy and facilitating payment per-use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication systems are used to manage credentials, then authorization can be established, but privacy is compromised and issuer compensation is difficult
Solution Approach 1:
The system segments the credential verification process into distinct cryptographic operations: the issuer signs the credential with its private key, the verifier validates using the issuer's public key from the blockchain, and the credential holder's identity is protected through decentralized identifiers. This segmentation allows authorization to be verified without exposing personal information.
Solution Approach 2:
The blockchain acts as an intermediary that stores public keys and credential verification data without storing sensitive personal information. The blockchain enables the verifier to authenticate the issuer's signature and verify credential validity without directly accessing or storing the credential holder's private information, thus maintaining privacy while enabling reliable authorization.
2Reliability
If direct authentication between issuer and customer is implemented, then authorization is secure, but indirect relationships and third-party access become difficult
Solution Approach 1:
The credential system is designed to be universally verifiable by any relying party that has access to the issuer's public key on the blockchain. The credential structure includes the issuer's signature and the issuer's identifier, allowing any verifier to authenticate the credential without needing a direct relationship with the issuer. This enables third-party access while maintaining the security guarantees of direct authentication.
3Productivity
If credential usage is tracked for compensation, then issuer compensation is enabled, but user identity tracking occurs
Solution Approach 1:
The system extracts the verification event data from the personal identity information. When a credential is verified, the relying party records the verification event (what credential, when, by whom) on the blockchain without storing or transmitting the credential holder's personal identifying information. This allows issuer compensation to be tracked through verification events while keeping identity information separate and protected.
4Ease of operation
If centralized credential management is used, then authorization is simplified, but system complexity and single points of failure increase
Solution Approach 1:
The system enables self-service credential verification where relying parties can independently verify credentials using the issuer's public key stored on the blockchain without needing to contact the issuer or a central authority. The blockchain automatically provides the necessary verification data, and the cryptographic signatures self-validate, reducing system complexity while maintaining authorization simplicity.
Data Source
AI summary
A method, apparatus, system, and computer program product are provided for managing the usage of verified credentials. An issuer of credentials receives a request from a person for a credential. The issuer identifies the credential from information that is controlled by the issuer. The issuer identifies a decentralized identifier (DID) record for an audit engine from a blockchain network. The DID record for the audit engine includes a public key of that is associated with the audit engine. The issuer identifies a DID record for the person from the blockchain network. The DID record for the person includes a public key that is associated with the person. The issuer generates an encrypted credential by encrypting the credential and the DID record for the person based on the public key associated with the audit engine. The issuer sends the encrypted credential to the person.