Decentralized Identity Private Key Deauthorization via Derived Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In decentralized identity systems, there is a security risk when the private key is lost or stolen, as the holder can impersonate the DID owner, and existing solutions require possession of the private key for deauthorization.
Innovation Solution
The DID owner can deauthorize their private key without having possession of it by authenticating using a derived key and providing user input, such as a familiar story, to prevent unauthorized actions until the key is restored.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the private key is stored on a portable device for decentralized identity control, then the DID owner has full control and security of their identity, but the DID owner risks losing the private key or having it stolen, allowing impersonation
Solution Approach 1:
The system segments the deauthorization function into two independent parts: (1) authentication using a derived key without needing the private key, and (2) deauthorization of the private key. This allows the DID owner to deauthorize a lost or stolen private key by authenticating through an alternative mechanism (derived key from authentication credentials) rather than requiring possession of the private key itself.
Solution Approach 2:
The system introduces an intermediary authentication mechanism (derived key from authentication credentials) that mediates between the DID owner and the private key deauthorization process. This intermediary allows verification of ownership without direct access to the private key, enabling safe deauthorization even when the private key is lost or stolen.
2Ease of operation
If the DID owner needs to deauthorize a lost private key, then security can be maintained, but the DID owner must possess the private key or have access to it, which is impossible if it is lost
Solution Approach 1:
The system inverts the traditional deauthorization approach: instead of requiring the private key to be present for deauthorization (current approach), the system requires authentication credentials that can derive an authentication key without the private key. This inversion enables deauthorization of lost keys by proving ownership through alternative credentials.
Solution Approach 2:
The system enables self-service deauthorization by allowing the DID owner to authenticate and deauthorize their own private key using derived authentication credentials, without requiring intervention from a centralized authority or recovery agent. The DID owner independently manages the deauthorization process even when the private key is inaccessible.
3Reliability
If centralized identity management systems are used, then identity verification is secure and standardized, but the system requires going through the centralized system to obtain verification information, reducing decentralization
Solution Approach 1:
The system extracts the deauthorization function from the centralized identity management system and implements it locally in the decentralized client. This extraction allows the DID owner to deauthorize private keys independently without contacting the centralized system, maintaining decentralization while preserving security through proven ownership verification.
Data Source
AI summary
Embodiments disclosed herein are related to the deauthorization of a private key associated with a decentralized identifier. While a user of a computing system is authenticated as a decentralized identifier, the system detects user input, and determines based on that user input that the private key associated with the decentralized identity is to be revoked. In response to this determination, the private key is deauthorized so that the private key cannot be used to perform actions for the decentralized identity at least until the private key is restored.