Digital Identity Middleware with Merkle Tree Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for secure identity and authentication in digital networks are subscriber-related and hardware-dependent, limiting user control over privacy and security, and are not easily shareable across devices.
Innovation Solution
A user-centric system utilizing a unique digital identifier (D-ID) with a D-ID agent on terminal devices and a D-ID middleware, generating pseudonyms and secrets, and employing Merkle trees for secure authentication and access to services, ensuring privacy and security without the need for multiple passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If subscriber-related hardware-based solutions (SIM/eSIM) are used for authentication, then security and reliability are improved, but device compatibility and ease of sharing are worsened
Solution Approach 1:
The system segments the authentication functionality by separating the unique digital identifier (D-ID) from hardware dependencies. The D-ID can be stored in various locations (cloud, local device, hardware module) and used across different devices, allowing the authentication security to be independent of specific hardware platforms.
Solution Approach 2:
The D-ID is designed as a universal identifier that can be used across multiple devices and service providers. Unlike SIM-based solutions tied to specific devices, the D-ID can be accessed from any terminal device, enabling users to share devices and maintain authentication security across different platforms.
2Reliability
If multiple passwords are used for different services, then access control is improved, but user control and privacy are worsened
Solution Approach 1:
The system merges multiple authentication credentials into a single unique digital identifier (D-ID). Instead of managing separate passwords for each service, users have one D-ID that can be used across multiple services, simplifying user control while maintaining access control through the distributed secret system.
Solution Approach 2:
The system introduces an intermediary layer (the D-ID system with Merkle trees and secrets) between the user and service providers. This intermediary manages authentication credentials and allows users to control access without directly managing multiple passwords, enhancing both user control and access control.
3Ease of operation
If personal information is shared with service providers for authentication, then convenience is improved, but privacy is worsened
Solution Approach 1:
The system extracts and separates the authentication function from personal information. Instead of service providers receiving personal data for authentication, they only receive cryptographic proofs (Merkle tree paths) that verify identity without exposing personal information, maintaining convenience while protecting privacy.
Solution Approach 2:
The system uses cryptographic copies (Merkle tree paths) instead of original personal information for authentication. Service providers verify identity through these cryptographic proofs without accessing actual personal data, enabling convenient authentication while preventing personal information exposure.
Data Source
AI summary
A system for providing a user with access to different services of at least one service provider in a network considering privacy and security via a user-related unique digital identifier (D-ID). The system includes: a D-ID middleware; and a D-ID-agent. The D-ID agent is at least partly run on a terminal device of a user and is configured to: generate the D-ID, at least one pseudonym for the user, and a user-defined and pseudonym-specific number of secrets; compute, using the number of secrets and a cryptographic hash function, a root value of a pseudonym-specific Merkle-tree having the secrets as its leafs; transmit the at least one pseudonym and the corresponding root value, both encrypted, to the D-ID middleware; and use a secret of the number of secrets as needed to access a desired service of the different services of the at least one service provider.