Method and system for digital identity and transaction verification
Methods of determining whether to trust an entity before sharing information with the entity, as well as methods of verifying whether to trust information received from an entity, are disclosed. In the processes, two entities, referred to as a holder and a verifier, desire to engage in an exchange of digital information. Before the holder will share information with the verifier, the holder will determine whether the verifier is a trusted entity. Before the verifier trusts information that it receives from the holder, it will examine a proof that it received from the holder to determine whether the proof includes information from or about a trusted third party referred to as an issuer. Information from an identity authority may be used in each of these verification steps.
1. A method of verifying whether to share information with an entity, the method comprising, by an electronic device of a holder:
receiving a data request from an electronic device of a verifier;
determining whether the verifier is a trusted entity by:
if the data request includes an identity authority (IA) token, using the IA token to determine whether the verifier is a trusted entity, and
if the data request does not include the IA token, using a decentralized identifier (DID) for the verifier that was included in the data request to determine whether the verifier is a trusted entity; and
upon determining that the verifier is a trusted entity, providing data to the verifier in response to the data request, otherwise rejecting the data request.
2. The method of claim 1 wherein, when the data request does not include the IA token, using the DID for the verifier to determine whether the verifier is a trusted entity comprises using the DID to either:
look up the IA token for the verifier on a distributed ledger and use information in the IA token to determine whether to trust the verifier; or
send the DID to a trusted IA to respond with information that the holder uses to determine whether to trust the verifier.
3. The method of claim 1 wherein, when the data request includes the IA token, using the IA token to determine whether the verifier is a trusted entity comprises:
if the IA token is from an IA that is known to the holder and the holder has a public key for the IA, examining information in the IA token to determine whether it has information indicating that the verifier may be trusted;
if the IA token is from an IA that is known to the holder, but the holder does not have a public key for the IA, looking up the IA token on a distributed ledger and examining information in the IA token accessed on the distributed ledger; or
if the IA token is from an IA that is not known to the holder, querying an IA that is known to the holder as to whether it has information enabling the verifier to determine whether or not the IA associated with the IA token in the proof may be trusted.
4. The method of claim 1 further comprising, by the electronic device of the holder:
receiving, from an electronic device of an issuer:
a verifiable credential that comprises an issuer DID, an issuer signature, an IA DID, and an IA signature; and
issued data, wherein the issued data is or is not included within the credential.
5. The method of claim 4 further comprising, by the electronic device of the holder, providing a proof to the verifier in response to the data request, wherein the proof comprises elements that are, or that are derived from, elements of the verifiable credential.
6. The method of claim 4 , wherein the data provided to the verifier comprises the issued data and/or is derived from the issued data.
7. The method of claim 1 further comprising, by the electronic device of the verifier:
sending the data request to the electronic device of the holder;
receiving the data and a proof from the holder, wherein the proof comprises a DID and a signature of an issuer;
determining whether the data is associated with a trusted issuer by:
examining the proof to determine whether the proof also includes the IA token,
if the proof includes the IA token, using the IA token to determine whether the issuer is a trusted entity, and
if the proof does not include the IA token, using the DID for the issuer that is in the proof to determine whether the issuer is a trusted entity; and
upon determining that the issuer is a trusted entity, accepting the proof and using the data, otherwise rejecting the proof and the data.
8. The method of claim 1 further comprising:
by the electronic device of the holder before receiving the data request, sending a service request to the verifier,
wherein the data request is sent by the verifier in response to the service request.
9. A computer program product comprising a memory device and programming instructions that are configured to cause a processor of an electronic device of a holder to perform a method of verifying whether to share information with an entity, the method comprising:
receiving a data request from an electronic device of a verifier;
determining whether the verifier is a trusted entity by:
if the data request includes an identity authority (IA) token, using the IA token to determine whether the verifier is a trusted entity, and
if the data request does not include the IA token, using a decentralized identifier (DID) for the verifier that was included in the data request to determine whether the verifier is a trusted entity; and
upon determining that the verifier is a trusted entity, providing data to the verifier in response to the data request, otherwise rejecting the data request.
10. The computer program product of claim 9 , further comprising programming instructions that are configured to cause the electronic device of the verifier to perform a method comprising:
sending the data request to the electronic device of the holder;
receiving the data and a proof from the holder, wherein the proof comprises a DID and a signature of an issuer; and
determining whether the data is associated with a trusted issuer by:
examining the proof to determine whether the proof also includes the IA token,
if the proof includes the IA token, using the IA token to determine whether the issuer is a trusted entity, and
if the proof does not include the IA token, using the DID for the issuer that is in the proof to determine whether the issuer is a trusted entity; and
upon determining that the issuer is a trusted entity, accepting the proof and using the data, otherwise rejecting the proof and the data.
11. A method of verifying whether to trust information received from an entity, the method comprising, by an electronic device of a verifier:
sending a data request to an electronic device of a holder;
in response to the data request, receiving data and a proof from the holder, wherein the proof comprises a decentralized identifier (DID) and a signature of an issuer;
determining whether the data is associated with a trusted issuer by:
examining the proof to determine whether the proof also includes an identity authority (IA) token,
if the proof includes an IA token that was issued by a known IA, using the IA token to determine whether the issuer is a trusted entity,
if the proof does not include the IA token, using the DID for the issuer that is in the proof to determine whether the issuer is a trusted entity, and
if the IA token is from an IA that is not known to the holder, querying an IA that is known to the holder as to whether it has information enabling the verifier to determine whether or not the IA associated with the IA token in the proof may be trusted; and
upon determining that the issuer is a trusted entity, accepting the proof and using the data, otherwise rejecting the proof and the data.
12. The method of claim 11 wherein, when the proof does not include the IA token, using the DID for the issuer to determine whether the issuer is a trusted entity comprises using the DID to either:
look up the IA token for the issuer on a distributed ledger and use information in the IA token to determine whether to trust the issuer; or
send the DID request to a trusted IA to respond with information that the verifier uses to determine whether to trust the issuer.
13. The method of claim 11 wherein, when the proof includes the IA token, using the IA token to determine whether the issuer is a trusted entity comprises:
if the IA token is from an IA that is known to the verifier and the verifier has a public key for the IA, examining information in the IA token to determine whether the IA token has information indicating that the issuer may be trusted;
if the IA token is from an IA that is known to the verifier but the verifier does not have a public key for the IA, looking up the IA token on a distributed ledger and examining information in the IA token accessed on the distributed ledger; or
if the IA token is from an IA that is not known to the verifier, querying an IA that is known to the verifier as to whether it has information enabling the verifier to determine whether or not the IA associated with the IA token in the proof may be trusted.
14. The method of claim 11 , wherein the data is included within the proof.
15. The method of claim 11 further comprising, by the issuer before the verifier sends the data request to the electronic device of the holder:
writing the DID for the issuer to a distributed ledger;
presenting the DID for the issuer to the known IA in a request for the IA token from the known IA; and
receiving the IA token from the known IA in response to the request for the IA token.
16. The method of claim 15 further comprising, by the issuer, presenting the holder with a credential that includes the DID for the issuer and the signature of the issuer.
17. A computer program product comprising a memory device and programming instructions that are configured to cause a processor of an electronic device of a verifier to perform a method of determining whether to trust information received from with an entity, the method comprising:
sending a data request to an electronic device of a holder;
in response to the data request, receiving data and a proof from the holder, wherein the proof comprises a decentralized identifier (DID) and a signature of an issuer; and
determining whether the data is associated with a trusted issuer by:
examining the proof to determine whether the proof also includes an identity authority (IA) token,
if the proof includes an IA token that was issued by a known IA, using the IA token to determine whether the issuer is a trusted entity, and
if the proof does not include the IA token, using the DID for the issuer that is in the proof to determine whether the issuer is a trusted entity; and
upon determining that the issuer is a trusted entity, accepting the proof and using the data, otherwise rejecting the proof and the data.
18. The computer program product of claim 17 , further comprising programming instructions that are configured to cause an electronic device of the holder to:
present the DID for the issuer to the known IA in a request for the IA token from the known IA;
receive the IA token from the known IA in response to the request for the IA token; and
write the DID for the issuer to a distributed ledger.
19. The computer program product of claim 18 , further comprising programming instructions that are configured to cause an electronic device of a verifier to perform a method comprising:
sending a data request to an electronic device of the holder;
in response to the data request, receiving data and a proof from the holder, wherein the proof comprises a DID and a signature of an issuer; and
determining whether the data is associated with a trusted issuer by:
examining the proof to determine whether the proof also includes the IA token,
if the proof includes the IA token, using the IA token to determine whether the issuer is a trusted entity, and
if the proof does not include the IA token, using the DID for the issuer that is in the proof to determine whether the issuer is a trusted entity; and
upon determining that the issuer is a trusted entity, accepting the proof and using the data, otherwise rejecting the proof and the data.