Distributed Ledger Identity Attributes for Privacy-Preserving Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing blockchain-based identity management systems lack guarantees for user identity data accessibility and privacy preservation, especially when data is removed from public systems or access is revoked, leading to potential impersonation and security vulnerabilities.
Innovation Solution
A method and system utilizing a distributed ledger to register and verify user identity attributes through multiple network devices, ensuring privacy and security by generating anonymous identifiers and requiring consensus among network devices for data recovery, thus providing controlled access and preventing impersonation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If user identity data is stored only on client systems and shared via agents, then user privacy and control are enhanced, but reliability of data accessibility is worsened when data is removed or access is revoked
Solution Approach 1:
The system segments identity data into two parts: identity attributes (hashes, proofs, verification data) are stored on the distributed ledger for reliability, while sensitive personal information remains on the user's client system for privacy control. This segmentation resolves the contradiction by ensuring data accessibility through ledger storage without compromising user privacy.
Solution Approach 2:
The system introduces an intermediary mechanism where identity attributes are committed to the distributed ledger as verifiable credentials. These attributes act as mediators that enable third-party verification of user identity without exposing sensitive personal data, thus maintaining both accessibility and privacy.
2Loss of information
If user identity data is stored in a public data system, then accessibility to other entities is improved, but privacy control is worsened when data must be continuously accessible
Solution Approach 1:
The system extracts only the necessary verification components (identity attributes, hashes, cryptographic proofs) from the complete identity data and stores them on the distributed ledger. The sensitive personal information remains exclusively on the user's client system, allowing verification without continuous exposure of private data.
Solution Approach 2:
Different parts of the identity system have different storage locations and access characteristics: identity attributes are stored globally on the distributed ledger for verification, while sensitive personal information is stored locally on the user's client system for privacy protection. This local quality differentiation resolves the contradiction between accessibility and privacy.
3Loss of information
If identity data is removed from public systems or access is revoked, then privacy is improved, but security is worsened due to potential impersonation
Solution Approach 1:
The system performs preliminary action by committing identity attributes to the distributed ledger before any potential data removal or access revocation. These pre-committed attributes serve as immutable proof of identity that remains valid even when sensitive data is removed from client systems, preventing impersonation while preserving privacy.
Solution Approach 2:
The system provides beforehand cushioning by storing verifiable identity attributes on the distributed ledger as a backup mechanism. If sensitive data is removed or access revoked, these pre-stored attributes on the ledger provide a safety cushion that maintains security guarantees and prevents impersonation attacks.
4Reliability
If multiple network devices verify identity attributes, then security against impersonation is improved, but device complexity is worsened
Solution Approach 1:
The system uses copying by distributing identical copies of identity attributes and verification data across multiple network devices participating in the consensus mechanism. Each device holds a copy of the verification data, enabling distributed security verification without requiring complex centralized coordination, thus improving security while managing complexity.
Data Source
AI summary
A first network device obtains information about a user device from an identity management device, and registers a user identity attribute request. The first network device commits to a distributed ledger, a first transaction comprising the user identity attribute request. One or more second network devices receive the first transaction; receive from a user device related to the first transaction, at least a user identity attribute and a proof; receive data from an identity management device; verify validity of the proof based on the data received from the identity management device, and commit to the distributed ledger a second transaction comprising a list of user identity attributes and integrity validation data. The first network device further receives second transactions each second transaction comprising the list of user identity attributes and the integrity validation data. The first network device verifies the list of user identity attributes comprised in the second transactions.