Zero-knowledge identity verification in a distributed computing system
A request to identify a data value may be received via a network at a designated one of a plurality of identity nodes. A query that includes the data value may be transmitted to an identity service associated with the designated identity node. A response message from the identity service may include one or more designated network identifiers corresponding with the data value. The designated identity node may communicate with the plurality of identity nodes to identify a plurality of network identifiers corresponding with the data value. A trust ledger may be updated to include a correspondence between a selected one of the network identifiers and the data value.
1. A method comprising:
receiving via a network interface a request to identify a data value, the request received at a designated one of a plurality of identity nodes, the designated identity node located on a computing device including a processor and a memory module;
transmitting a query that includes the data value to an identity service associated with the designated identity node;
receiving a response message received from the identity service, the response message including a first one or more network identifiers corresponding with the data value and determined in part by identifying a first correspondence between the data value and one or more local identifiers specific to the identity service;
communicating with the plurality of identity nodes to identify a second plurality of network identifiers corresponding with the data value, the first one or more network identifiers being a subset of the second plurality of network identifiers, wherein each of the second plurality of network identifiers is stored in the trust ledger, the trust ledger being shared among the plurality of identity nodes, each of the second plurality of network identifiers being associated in the trust ledger with a respective one or more data values;
after being elected to select a network identifier, selecting a designated one of the second plurality of network identifiers based on a relative frequency among the plurality of network identifiers; and
updating a trust ledger to include a correspondence between the designated network identifier and the data value.
2. The method recited in claim 1 , the method further comprising:
selecting the designated network identifier from the plurality of network identifiers based on a consensus among the plurality of identity nodes.
3. The method recited in claim 2 , wherein the designated network identifier is the most common network identifier among the second plurality of network identifiers.
4. The method recited in claim 1 , wherein the respective one or more data values are hashed prior to storing in the trust ledger, the trust ledger capable of being queried to determine any network identifiers associated with a designated hashed data value.
5. The method recited in claim 1 , the method further comprising:
transmitting a trust ledger update message to the plurality of identity nodes via the network interface.
6. The method recited in claim 1 , wherein the first one or more network identifiers are determined in part by identifying a second correspondence between the one or more local identifiers and the first one or more network identifiers.
7. The method recited in claim 1 , wherein the data object is associated with a data object schema, the data object schema identifying one or more data fields associated with an instance of the data object schema, each of the data values corresponding with a respective one of the data fields.
8. The method recited in claim 1 , wherein communications with the plurality of identity nodes are conducted via a gossip communication protocol defining a peer-to-peer procedure for transmitting information among the plurality of identity nodes.
9. The method recited in claim 1 , wherein the trust ledger is implemented as a merkle tree.
10. The method recited in claim 1 , wherein the trust ledger is implemented as a blockchain.
11. A database system implemented via a server system, the server system comprising:
a communications interface implemented at a designated one of a plurality of identity nodes, the communications interface being operable to:
receive a request to identify a data value,
transmit a query that includes the data value to an identity service associated with the designated identity node,
receive a response message received from the identity service, the response message including a first one or more network identifiers corresponding with the data value and determined in part by identifying a first correspondence between the data value and one or more local identifiers specific to the identity service,
communicate with the plurality of identity nodes to identify a second plurality of network identifiers corresponding with the data value, the first one or more network identifiers being a subset of the second plurality of network identifiers, wherein each of the second plurality of network identifiers is stored in the trust ledger, the trust ledger being shared among the plurality of identity nodes, each of the second plurality of network identifiers being associated in the trust ledger with a respective one or more data values; and
a processor operable to:
after the designated identity node being elected to select a network identifier, select a designated one of the second plurality of network identifiers based on a relative frequency among the plurality of network identifiers; and
update a trust ledger to include a correspondence between the designated network identifier and the data value.
12. The database system recited in claim 11 , the method further comprising:
selecting the designated network identifier from the plurality of network identifiers based on a consensus among the plurality of identity nodes, wherein the designated network identifier is the most common network identifier among the second plurality of network identifiers.
13. The database system recited in claim 11 , wherein the respective one or more data values are hashed prior to storing in the trust ledger, the trust ledger capable of being queried to determine any network identifiers associated with a designated hashed data value.
14. The database system recited in claim 11 , the method further comprising:
transmitting a trust ledger update message to the plurality of identity nodes via the network interface.
15. A computer program product comprising computer-readable program code capable of being executed by one or more processors when retrieved from a non-transitory computer-readable medium, the computer-readable program code comprising instructions configurable to cause:
processing a request to identify a data value, the request received at a designated one of a plurality of identity nodes, the designated identity node located on a computing device including a processor and a memory module;
transmitting a query that includes the data value to an identity service associated with the designated identity node;
receiving a response message received from the identity service, the response message including a first one or more network identifiers corresponding with the data value and determined in part by identifying a first correspondence between the data value and one or more local identifiers specific to the identity service;
communicating with the plurality of identity nodes to identify a second plurality of network identifiers corresponding with the data value, the first one or more network identifiers being a subset of the second plurality of network identifiers, wherein each of the second plurality of network identifiers is stored in the trust ledger, the trust ledger being shared among the plurality of identity nodes, each of the second plurality of network identifiers being associated in the trust ledger with a respective one or more data values;
after being elected to select a network identifier, selecting a designated one of the second plurality of network identifiers based on a relative frequency among the plurality of network identifiers; and
updating a trust ledger to include a correspondence between the designated network identifier and the data value.
16. The computer program product recited in claim 15 , the method further comprising:
selecting the designated network identifier from the second plurality of network identifiers based on a consensus among the plurality of identity nodes, wherein the designated network identifier is the most common network identifier among the second plurality of network identifiers.
17. The computer program product recited in claim 15 , wherein the respective one or more data values are hashed prior to storing in the trust ledger, the trust ledger capable of being queried to determine any network identifiers associated with a designated hashed data value.