Derived DID Claim Binding for Private Identity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Centralized identity management systems are vulnerable to privacy breaches as they rely on centralized authorities, making it difficult to maintain user privacy and control over identity verification processes.
Innovation Solution
Implementing decentralized identifiers (DIDs) in a distributed ledger system, where a derived decentralized identifier is bound to a verified claim using an association data structure that is encoded to prevent correlation with the source DID, ensuring privacy protection from the claim issuing entity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized identity management system is used to verify identities, then the verification process is secure and reliable, but user privacy is compromised as the centralized authority can access and correlate all identity information
Solution Approach 1:
The identity verification system is segmented into multiple independent components: decentralized identifiers (DIDs) held by users, verified claims stored in distributed ledgers, and relying parties that verify claims without accessing underlying identity data. This segmentation allows verification to occur without centralized control, maintaining reliability while protecting privacy through architectural distribution.
Solution Approach 2:
Verified claims act as intermediaries between identity holders and relying parties. Instead of direct access to identity information, relying parties verify claims that reference DIDs through cryptographic proofs. This intermediary mechanism enables reliable verification while preventing privacy loss, as the claim validates identity without exposing personal information.
2Loss of information
If decentralized identifiers are used to protect user privacy, then user control and privacy are improved, but the complexity of the identity management system increases
Solution Approach 1:
The verified claim structure serves multiple functions simultaneously: it acts as a cryptographic proof of identity, a reference to decentralized identifier data, a verifiable record in the distributed ledger, and a portable credential that can be presented to any relying party. This multi-functionality reduces the need for separate systems for each purpose, managing complexity through consolidation.
Solution Approach 2:
The system changes the fundamental parameters of identity management from centralized databases to decentralized cryptographic proofs. By transforming identity verification from a centralized lookup operation to a distributed cryptographic validation process, the system achieves privacy protection while the standardized DID and claim formats manage the complexity through parameter standardization.
3Measurement precision
If the claim issuing entity can correlate multiple DIDs to the same user, then the verification accuracy is improved, but the privacy of individual DIDs is compromised
Solution Approach 1:
Different parts of the system have different access rights and information quality. Relying parties receive local verification through claims that are sufficient for their specific needs without global knowledge of all user DIDs. The claim issuing entity has localized knowledge of specific claims it issued, but cannot correlate DIDs across different claim contexts without user authorization, maintaining privacy while enabling accurate verification where needed.
Solution Approach 2:
The system implements partial verification where relying parties receive only the specific claim information necessary for their verification needs, not complete identity correlation data. This partial action provides sufficient verification accuracy for each transaction while preventing excessive information gathering that would compromise DID privacy. Users can selectively present claims without revealing their full DID graph.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Using an association data structure corresponding to a derived decentralized identifier of a subject entity to share a verified claim about the subject entity to one or more relying entities. A decentralized identifier of a subject entity is derived from a source decentralized identity of the subject entity. Next, an association data structure is created using the derived decentralized identifier. The association data structure is structured to be interpretable by a relying entity as demonstrating that a verified claim is about the derived decentralized identity. The relying entity is then caused to be provided the verified claim about the subject entity. The verified claim includes the association data structure that was created using the derived decentralized identifier.