Associating decentralized identifiers with one or more devices

1 . A method implemented in a computer system that includes a processor, for generating and associating a decentralized identifier (DID) for a group of one or more related devices, the method comprising:

generating a device group DID for a group of devices by generating a private key of the device group DID based on a seed and a first hardware identifier of at least one device in the group of devices;

associating the device group DID with the group of devices;

for at least one corresponding device in the group of devices,

deriving a device DID by generating a private key of the device DID based on a seed, a second hardware identifier of the corresponding device, and the device group DID; and

associating the device DID with the corresponding device;

granting a scope of permission to the device group DID, including granting a first permission to add new devices into the group of devices;

in response to granting the scope of permission to the device group DID, granting the device DID a subset of the scope of permission, including granting the device DID the first permission to add new devices into the group of devices, as such the device group DID and the device DID is only linked to the device group DID or a corresponding device, and no personally identifiable information is directly associated with the device group DID or the device DID;

receiving a request for adding a new device to the group of devices;

verifying the new device with an existing device within the group of devices having the first permission; and

adding the new device into the group of devices, including:

deriving a new device DID;

associating the new device DID with the new device;

granting the new device DID the subset of the scope of permission; and

recording a first transaction associated with granting the new device DID the subset of the scope of permission in a distributed ledger.

2 . The method of claim 1 , wherein:

the scope of permission granted to the device group DID also includes a second permission to remove existing devices from the group of devices, and

at least one of the device DID is granted the second permission to remove existing devices from the group of devices.

3 . The method of claim 1 , wherein verifying the new device with at least one permissioned existing device within the group of devices comprises:

causing the request to be sent to at least one device within the group of devices; and

receiving a notification from the at least one device indicating that the request is approved.

4 . The method of claim 1 , wherein method further comprises:

receiving an indication to remove a particular device amongst the group of devices;

verifying removal of the particular device with an existing device that is not the particular device within the group of devices, the existing device having the first permission; and

based on verifying removal of the particular device, removing the particular device from the group of devices, removing the particular device comprising:

revoking the scope of permission that has been granted to the device DID that is associated with the particular device; and

deactivating the device DID that is associated with the particular device.

5 . The method of claim 4 , wherein verifying removal of the particular device comprises:

causing the request to be sent to at least one permissioned existing device; and

receiving a notification from the at least one permissioned existing device that the request is approved.

6 . The method of claim 4 , wherein the method further comprises:

recording, in the distributed ledger, a second transaction associated with revoking the scope of permission that has been granted to the device DID.

7 . The method of claim 1 , wherein the scope of permission includes a second permission to access a storage at an ID hub.

8 . The method of claim 7 , wherein the permission includes a permission to perform at least one of (1) reading a set of data stored at the storage, (2) writing a set of data into the storage, (3) copying a set of data stored at the storage, and (4) deleting a set of data stored at the storage.

9 . The method of claim 7 , wherein when a particular device within the group of devices requests to access a set of data stored at the ID hub, the device DID corresponding to the particular device and the device group DID corresponding to the group of devices are both verified.

10 . The method of claim 1 , wherein generating the device group DID or a device DID comprises:

receiving a passphrase from a user;

obtaining a constant value associated with the computing system; and

using the passphrase and the constant value as inputs of a hash function to generate the device group DID.

11 . The method of claim 10 , wherein the constant value includes one of a BIOS serial number of the device, a motherboard serial number of the device, a MAC address of a network adapter of the device, a Machine Security Identifier (SID) of the device.

12 . A computer system, comprising:

a processor; and

a computer-readable medium having thereon computer-executable instructions that are executable by the processor to at least:

generate a device group decentralized identity (DID) for a group of devices by generating a private key of the device group DID based on a seed and a first hardware identifier of at least one device in the group of devices;

associate the device group DID with the group of devices;

for at least one corresponding device in the group of devices,

derive, from the device group DID, a first device DID by generating a private key of the first device DID based on a seed, a second hardware identifier of the corresponding device, and the device group DID; and

associate the first device DID with the corresponding device;

grant a scope of permission to the device group DID, including granting a first permission to remove existing devices from the group of devices;

in response to granting the scope of permission to the first device group DID, grant the first device DID a subset of the scope of permission, including granting the first device DID the first permission to remove existing devices from the group of devices;

receive an indication to remove a particular device amongst the group of devices;

verify removal of the particular device with an existing device that is not the particular device within the group of devices, the existing device having the first permission; and

remove the particular device from the group of devices, including:

revoking the scope of permission granted to a second device DID that is associated with the particular device;

deactivating the second device DID; and

recording a first transaction associated with revoking the scope of permission granted to the second device DID in a distributed ledger.

13 . The computer system of claim 12 , wherein:

the scope of permission granted to the device group DID also includes a second permission to add new devices into the group of devices, and

the first device DID is granted the second permission to add new devices into the group of devices.

14 . The computer system of claim 13 , wherein the computer-executable instructions are also executable by the processor to:

receive a request for adding a new device to the group of devices;

verify the new device with an existing device within the group of devices having the second permission; and

add the new device into the group of devices, including:

deriving a new device DID;

associating the new device DID with the new device; and

granting the new device DID the subset of the scope of permission.

15 . The computer system of claim 14 , wherein verifying the new device with the existing device within the group of devices comprises:

causing the request to be sent to at least one device within the group of devices; and

receiving a notification from the at least one device indicating that the request is approved.

16 . The computer system of claim 14 , wherein the computer-executable instructions are also executable by the processor to record a second transaction associated with granting the new device DID the subset of the scope of permission in the distributed ledger.

17 . The computer system of claim 12 , wherein verifying removal of the particular device comprises:

causing a request to be sent to at least one permissioned existing device; and

receiving a notification from the at least one permissioned existing device that the request is approved.

18 . A method implemented in a computer system that includes a processor, for generating and associating a decentralized identifier (DID) for a group of one or more related devices, the method comprising:

generating a device group DID for a group of devices by generating a private key of the device group DID based on a seed and a first hardware identifier of at least one device in the group of devices, wherein generating the device group DID or a device DID comprises:

receiving a passphrase from a user;

obtaining a constant value associated with the computing system; and

using the passphrase and the constant value as inputs of a hash function to generate the device group DID;

associating the device group DID with the group of devices;

for at least one corresponding device in the group of devices,

deriving a device DID by generating a private key of the device DID based on a seed, a second hardware identifier of the corresponding device, and the device group DID; and

associating the device DID with the corresponding device;

granting a scope of permission to the device group DID, including granting a first permission to add new devices into the group of devices;

in response to granting the scope of permission to the device group DID, granting the device DID a subset of the scope of permission, including granting the device DID the first permission to add new devices into the group of devices, as such the device group DID and the device DID is only linked to the device group DID or a corresponding device, and no personally identifiable information is directly associated with the device group DID or the device DID;

receiving a request for adding a new device to the group of devices;

verifying the new device with an existing device within the group of devices having the first permission, including:

causing the request to be sent to at least one device within the group of devices; and

receiving a notification from the at least one device indicating that the request is approved; and

adding the new device into the group of devices, including:

deriving a new device DID;

associating the new device DID with the new device; and

granting the new device DID the subset of the scope of permission.

19 . The method of claim 18 , wherein adding the new device into the group of devices also includes recording a transaction associated with granting the new device DID the subset of the scope of permission in a distributed ledger.

20 . The method of claim 18 , wherein:

the scope of permission granted to the device group DID also includes a second permission to remove existing devices from the group of devices, and

at least one of the device DID is granted the second permission to remove existing devices from the group of devices.