Session Management Unit for DIDcomm Connection Reuse
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Implementing self-sovereign user authentication is complex due to the need for integrating self-sovereign identity (SSI) functions into existing systems and establishing new DIDcomm connections for each login, which requires multiple operation procedures and increases time and effort for users.
Innovation Solution
An information processing device and method that generate an invitation code with a session ID for DIDcomm connections, allowing the reuse of established connections by recording session IDs and client IDs, and using ID tokens to simplify user authentication by converting SSI certificates into widely used formats like OpenID Connect tokens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If self-sovereign identity (SSI) functions are integrated into existing systems, then user authentication security is improved, but system complexity increases
Solution Approach 1:
The patent introduces a session management unit as an intermediary component that mediates between the existing authentication system and SSI functions. This unit generates invitation codes with session IDs, manages DIDcomm connections, and coordinates credential verification without requiring deep integration of SSI functionality throughout the entire system, thus maintaining security while limiting complexity growth to a specific module.
Solution Approach 2:
The patent segments the authentication system into distinct functional modules: traditional authentication components, a session management unit for SSI operations, and credential verification components. This segmentation allows SSI functions to be implemented in an isolated manner, reducing the complexity impact on the overall system while maintaining authentication security.
2Reliability
If new DIDcomm connections are established for each login, then connection security is improved, but user operation time increases
Solution Approach 1:
The session management unit performs preliminary actions by generating invitation codes with embedded session IDs before the authentication process begins. These pre-configured codes contain all necessary information for establishing secure DIDcomm connections, eliminating the need for time-consuming connection setup during each login while maintaining security through the use of pre-established session parameters.
Solution Approach 2:
The patent reuses existing DIDcomm connection information and session parameters across multiple authentication sessions. Instead of creating entirely new connections each time, the system copies and reuses validated connection templates and session data, significantly reducing user operation time while maintaining connection security through the immutable session IDs.
3Measurement precision
If invitation codes are presented for every login, then connection identification is improved, but user operation complexity increases
Solution Approach 1:
The session management unit creates a universal invitation code mechanism that serves multiple functions: identifying connections, establishing DIDcomm sessions, and enabling authentication. This multi-functional approach consolidates what would otherwise require separate procedures into a single code presentation step, reducing user operation complexity while maintaining precise connection identification through embedded session IDs.
Data Source
AI summary
There is provided an information processing device and method, and a program that allow self-sovereign user authentication to be implemented in a simpler manner. The information processing device includes a session management unit that generates, for a transmission source device of an invitation code request for a DIDcomm connection, an invitation code including a session ID that identifies the DIDcomm connection, and performs control to record the session ID received over the DIDcomm connection from a connection destination device that has read the invitation code and a client ID that identifies the transmission source device included in the invitation code request with the session ID and the client ID associated with each other, and a communication unit that communicates with the connection destination device over the DIDcomm connection, in which in a case where the DIDcomm connection with the connection destination device has already been established, the session management unit reuses the DIDcomm connection with the connection destination device. The present technology may be applied to a verification server.