Decentralized Identifier Delegation Permissions

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Centralized identity management systems lack control for users over their data when sharing it with third parties, leading to potential unauthorized use and loss of data integrity.

Innovation Solution

Implementing decentralized identifiers (DIDs) with delegation permissions that allow users to control interactions with their data objects, specifying conditions for access and use by third-party entities, ensuring data is only accessed when predefined permissions are met.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If decentralized identifiers are used to provide user control over data, then user control and data integrity are improved, but system complexity increases

Engineering Contradiction:
Improvedata integrityVSAvoidsystem complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments identity management into decentralized identifiers (DIDs) that users control directly, separating the identity verification function from centralized authorities. This segmentation enables users to maintain control over their own identity data while reducing reliance on complex centralized infrastructure.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces delegated permissions as an intermediary mechanism that enables controlled data sharing between parties without requiring centralized coordination. This intermediary layer allows users to grant specific access rights to third parties while maintaining overall control, simplifying the trust model compared to fully centralized systems.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If delegation permissions are implemented to control data access, then unauthorized use is reduced, but processing overhead increases

Engineering Contradiction:
Improveaccess controlVSAvoidprocessing resources
Core Design Contradiction:
ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent implements delegated permissions in advance, allowing users to pre-configure access rules for their data before any third-party access occurs. This preliminary setup eliminates the need for real-time authorization negotiations, reducing processing overhead during actual data access operations.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent uses cryptographic copies of permission credentials that can be verified without contacting the original owner. Third parties receive verified permission tokens that prove authorization without requiring ongoing verification processes, significantly reducing processing resources needed for access control.

Inventive Principle:
Principle #26Copying

3Reliability

If centralized identity management is used to ensure security, then authentication reliability is improved, but user control over data is reduced

Engineering Contradiction:
Improveauthentication securityVSAvoiduser control
Core Design Contradiction:
ReliabilityVSEase of operation

Solution Approach 1:

The patent inverts the traditional centralized model by placing control directly in the hands of users through self-custodied DIDs. Instead of users relying on centralized authorities for authentication, users themselves become the authority, generating and managing their own cryptographic key pairs to prove identity and control data access.

Inventive Principle:
Principle #13The other way round (Inversion)

Solution Approach 2:

The patent enables users to independently manage their own identity verification without requiring centralized identity providers. Users generate their own DIDs, control their private keys, and manage their own permission delegations, eliminating the need for centralized authentication services while maintaining security through cryptographic proofs.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP4026291B1Control of the delegated use of did-related data
Publication Date: 2023.09.20 MICROSOFT TECHNOLOGY LICENSING LLC
  • EP4026291B1 patent drawingFigure 1
  • EP4026291B1 patent drawingFigure 2
  • EP4026291B1 patent drawingFigure 3

AI summary

Embodiments disclosed herein are related to computing systems and methods for a DID owner to control the delegated use of DID-related data. Delegation permissions are attached to DID-related data objects that are provided by the DID owner to a first third-party entity. The delegation permissions specify interactions that should occur between a DID owner and second third-party entities who receive the DID-related data objects from the first third- party entity. The DID-related data objects are provided to the first third-party entity. Various interactions are received from the second third-party entities who attempt to use the DID-related data objects. The second third-party entities are allowed to use the DID-related data objects when the received interactions satisfy the delegation permissions.