Delegated access using verifiable credentials
A system may be configured to allow agents to execute transactions, subject to prior agreement between principals, when operating in denied, degraded, intermittent, and limited (DDIL) environments. In a DDIL environment, the agents may lack reliable network connectivity with their respective principals or other central authority for obtaining authorization for transactions. A service provider and a service consumer may agree to delegate advance authorization to a service provider agent and a service consumer agent to execute certain transactions on behalf of the service provider and service consumer. The agents may maintain audit logs of transactions that may be uploaded to the central authority when network connectivity is available, allowing the service consumer and service provider to settle accounts. If transactions occur before a rule change has been propagated to the agents, the system may include a mechanism for rolling back a transaction that is invalid under the new rule.
1 . A computer-implemented method comprising:
receiving, by a first device corresponding to a service provider agent of a service provider, from a second device corresponding to a service consumer agent of a service consumer, a first request corresponding to a first action, the first request corresponding to first data representing a verifiable credential;
identifying, based on the first action, second data representing a first program for verifying transaction requests;
determining, using a first public key corresponding to the service provider, that the first data was digitally signed using a first private key corresponding to the first public key;
determining that the first data specifies a second public key;
determining, using the second public key, that the first request was digitally signed using a second private key corresponding to the second public key;
in response to determining that the first data was digitally signed using the first private key and the first request was digitally signed using the second private key, determining, using the first program, that the service consumer agent corresponding to the second public key is authorized to request the first action;
in response to determining that the service consumer agent is authorized to request the first action, causing execution of a first transaction between the service provider agent and service consumer agent, the first transaction corresponding to the first action;
determining that network connectivity is available; and
in response to determining that network connectivity is available, uploading a record of the first transaction to a system component.
2 . The computer-implemented method of claim 1 , further comprising:
after causing execution the first transaction, receiving third data representing a second program for verifying transaction requests;
receiving, from a third device corresponding to a second service consumer agent, a second request to perform the first action;
determining, using the second program, that the second service consumer agent is not authorized to request the first action; and
in response to determining that the second service consumer agent is not authorized to request the first action, denying the second request.
3 . The computer-implemented method of claim 1 , further comprising:
determining that the first transaction was invalid due to a rule change occurring after the service provider agent received the second data but before execution of the first transaction; and
in response to determining that the first transaction was invalid due to a rule change, rolling back the first transaction.
4 . The computer-implemented method of claim 1 , further comprising:
prior to determining that the service consumer agent corresponding to the second public key is authorized to request the first action:
determining a first hash of the first program; and
verifying the first hash against a second hash stored on a distributed ledger.
5 . The computer-implemented method of claim 1 , further comprising:
prior to receiving the first request:
receiving, by a first system component corresponding to the service provider from a second system component corresponding to the service consumer, the second public key;
signing, by the first system component, a document containing the second public key with the first private key to create the verifiable credential; and
sending, by the first system component to the second system component, the verifiable credential.
6 . The computer-implemented method of claim 1 , further comprising:
storing, by a first system component corresponding to the service provider, the second data in at least a second system component corresponding to a first node of a distributed ledger, wherein the first device retrieves the second data from one of the second system component or a third system component corresponding to a second node of the distributed ledger.
7 . A system, comprising:
one or more processors; and
at least one memory comprising instructions that, when executed by the one or more processors, cause the system to:
receive, by a first device corresponding to a service provider agent of a service provider, from a second device corresponding to a service consumer agent of a service consumer, a first request corresponding to a first action, the first request corresponding to first data representing a verifiable credential;
identify, based on the first action, second data representing a first program for verifying transaction requests;
determine, using a first public key corresponding to the service provider, that the first data was digitally signed using a first private key corresponding to the first public key;
determine that the first data specifies a second public key;
determine, using the second public key, that the first request was digitally signed using a second private key corresponding to the second public key;
in response to determining that the first data was digitally signed using the first private key and the first request was digitally signed using the second private key, determine, using the first program, that the service consumer agent corresponding to the second public key is authorized to request the first action;
in response to determining that the service consumer agent is authorized to request the first action, cause execution of a first transaction between the service provider agent and service consumer agent, the first transaction corresponding to the first action;
determining that network connectivity is available; and
in response to determining that network connectivity is available, uploading a record of the first transaction to a system component.
8 . The system of claim 7 , wherein the at least one memory further comprises instructions that, when executed by the one or more processors, further cause the system to:
after causing execution the first transaction, receive third data representing a second program for verifying transaction requests;
receive, from a third device corresponding to a second service consumer agent, a second request to perform the first action;
determine, using the second program, that the second service consumer agent is not authorized to request the first action; and
in response to determining that the second service consumer agent is not authorized to request the first action, deny the second request.
9 . The system of claim 7 , wherein the at least one memory further comprises instructions that, when executed by the one or more processors, further cause the system to:
determine that the first transaction was invalid due to a rule change occurring after the service provider agent received the second data but before execution of the first transaction; and
in response to determining that the first transaction was invalid due to a rule change, roll back the first transaction.
10 . The system of claim 7 , wherein the at least one memory further comprises instructions that, when executed by the one or more processors, further cause the system to:
prior to determining that the service consumer agent corresponding to the second public key is authorized to request the first action:
determine a first hash of the first program; and
verify the first hash against a second hash stored on a distributed ledger.
11 . The system of claim 7 , wherein the at least one memory further comprises instructions that, when executed by the one or more processors, further cause the system to:
prior to receiving the first request:
receive, by a first system component corresponding to the service provider from a second system component corresponding to the service consumer, the second public key;
sign, by the first system component, a document containing the second public key with the first private key to create the verifiable credential; and
send, by the first system component to the second system component, the verifiable credential.
12 . The system of claim 7 , wherein the at least one memory further comprises instructions that, when executed by the one or more processors, further cause the system to:
store, by a first system component corresponding to the service provider, the second data in at least a second system component corresponding to a first node of a distributed ledger, wherein the first device retrieves the second data from one of the second system component or a third system component corresponding to a second node of the distributed ledger.