Verifiable Credential Disclosure for Privacy-Safe Identity Attestation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in securely sharing personal data while protecting privacy, as relying parties often collect and store identifying information without consent, making them vulnerable to data breaches that compromise individual privacy.
Innovation Solution
A computing system issues decentralized identifiers (DIDs) and verifiable credentials, allowing individuals to control the sharing of attested claims instead of the identifying information itself, recorded in a verifiable data registry like a distributed ledger, ensuring privacy and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If relying parties collect and store identifying information to provide access to products or services, then service delivery is enabled, but privacy security deteriorates due to data breach risks
Solution Approach 1:
The patent extracts the identifying information from the data sharing process by using verifiable credentials that contain only the necessary attested claims without the underlying personal identifiers. This allows service delivery while removing the privacy risk associated with storing sensitive identifying information at relying parties.
Solution Approach 2:
The patent introduces a trusted issuer and verifiable credential system as an intermediary between the subject and relying party. The issuer creates cryptographically verifiable attestations that enable service delivery without requiring relying parties to collect or store sensitive identifying information, thus mediating the trade-off between service access and privacy security.
2Measurement precision
If identifying information is shared with relying parties for access control, then authentication is achieved, but data privacy deteriorates due to unauthorized storage and potential breaches
Solution Approach 1:
The patent creates a cryptographic copy of the identifying information in the form of verifiable credentials issued by trusted authorities. These credentials contain attested claims that replicate the authentication function without requiring sharing or storage of the actual sensitive personal data, thus maintaining authentication accuracy while preserving data privacy.
Solution Approach 2:
The patent extracts only the essential verification elements from the complete identifying information package. Verifiable credentials contain selectively attested claims that provide sufficient authentication data while excluding unnecessary sensitive personal information, thereby achieving authentication without compromising data privacy.
3Reliability
If decentralized identifiers and verifiable credentials are used to protect privacy, then data security is improved, but system complexity increases due to cryptographic verification requirements
Solution Approach 1:
The patent employs universally standardized cryptographic verification mechanisms that can be implemented across diverse systems and platforms. The verifiable credential format and verification methods are designed to be broadly applicable, reducing implementation complexity despite the enhanced security requirements by providing a unified approach to secure data sharing.
Data Source
AI summary
This disclosure describes techniques for client-controlled and secure disclosure of attestations of identifying information of subjects. For example, a method includes obtaining, by a computing system, identifying information associated with a subject. The method also includes generating, by the computing system and based on the identifying information associated with the subject, a decentralized identifier (DID) associated with the subject and one or more attested claims of the identifying information associated with the subject. The method further includes receiving, by the computing system and from the subject, a request to send the identifying information to one or more relying parties, and in response, recording, by the computing system, the DID in a verifiable data registry, and sending, by the computing system, the one or more attested claims to the one or more relying parties.