Decentralized Identity Management via Trusted Execution Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing federated identity management systems impose friction on users, are vulnerable to attacks, and rely on untrusted third-party authentication services, which can lead to compromised identities and reduced user experience.
Innovation Solution
A decentralized identity management system using zero-knowledge authentication credentials on a blockchain-based platform, where user identities are established and authenticated through a tamper-evident, immutable data store, utilizing trusted execution environments and cryptographic hash values to secure credentials and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If federated identity management systems are used to allow users to access multiple platforms, then user convenience and cross-platform access are improved, but user friction increases and security vulnerabilities expand due to repeated authentication requests
Solution Approach 1:
The system performs preliminary authentication actions by establishing trust relationships between platforms in advance through decentralized identity verification. Once a user's identity is verified on one platform, this verification is recorded and can be automatically recognized by other trusted platforms, eliminating the need for repeated authentication requests and reducing user friction while maintaining cross-platform access.
2Ease of operation
If federated identity management systems rely on third-party authentication services, then authentication functionality is provided, but security is compromised and identity integrity is reduced due to untrusted intermediaries
Solution Approach 1:
The invention extracts the trust intermediary from the authentication process by implementing direct peer-to-peer verification between platforms using decentralized identity protocols. Each platform independently verifies user identities through cryptographic proofs without relying on third-party authentication services, thereby maintaining authentication functionality while eliminating security compromises associated with untrusted intermediaries.
3Ease of operation
If traditional identity management systems are used, then authentication is provided, but the attack surface is expanded due to excess authentication sessions that could be compromised
Solution Approach 1:
The system implements disposable, short-lived cryptographic tokens for authentication instead of maintaining persistent authentication sessions. Each authentication request uses a fresh token that becomes invalid after use, eliminating the accumulation of excess authentication sessions that could be compromised. This approach maintains authentication capability while significantly reducing the attack surface by preventing session hijacking and replay attacks.
Data Source
AI summary
Provided is a process that establishes user identities within a decentralized data store, like a blockchain. A user's mobile device may establish credential values within a trusted execution environment of the mobile device. Representations of those credentials may be generated on the mobile device and transmitted for storage in association with an identity of the user established on the blockchain. Similarly, one or more key-pairs may be generated or otherwise used by the mobile device for signatures and signature verification. Private keys may remain resident on the device (or known and input by the user) while corresponding public keys may be stored in associated with the user identity on the blockchain. A private key is used to sign representations of credentials and other values as a proof of knowledge of the private key and credential values for authentication of the user to the user identity on the blockchain.