Apparatus and method for using a decentralized identity verifiable credential to authenticate a user in the open authorization framework
A method includes establishing a network connection between a proxy machine and a decentralized identity agent machine. The proxy machine and the decentralized identity agent machine are used to broker communications with a decentralized identity wallet machine and an authentication machine such that the decentralized identity wallet machine establishes an authenticated session at the authentication machine using a decentralized identity verifiable credential and without providing a username or password to the authentication machine.
1 . A method, comprising:
establishing a network connection between a proxy machine and a decentralized identity agent machine; and
using the proxy machine and the decentralized identity agent machine to broker communications with a decentralized identity wallet machine and an authentication machine such that the decentralized identity wallet machine establishes an authenticated session at the authentication machine using a decentralized identity verifiable credential and without providing a username or password to the authentication machine, wherein using the proxy machine includes the proxy machine;
receiving from the decentralized identity agent machine a notification signal about a connection with the decentralized identity wallet machine,
sending to the decentralized identity agent machine a verifiable credential proof demand signal,
receiving from the decentralized identity agent machine a successful proof validation signal,
sending to the authentication machine an access token request,
receiving from the authentication machine an access token signal, and
sending to the decentralized identity agent machine the access token signal.
2 . The method of claim 1 further comprising utilizing decentralized identifier communication (DIDComm) protocols between the decentralized identity wallet machine and the decentralized identity agent machine.
3 . The method of claim 1 further comprising maintaining at the proxy machine privacy preserving mappings between verifiable credentials and access tokens.
4 . The method of claim 1 further comprising encoding administrator access rights in a verifiable credential.
5 . The method of claim 1 further comprising mapping Open Authorization scopes into verifiable credential attributes and retrieving the Open Authorization scopes during a verifiable credential proof process.
6 . The method of claim 1 further comprising issuing a new verifiable credential without updating an associated application.
7 . The method of claim 1 wherein the authentication machine is an Open Authorization framework based authentication machine.