Encrypting data associated with decentralized identifier

1. A computing system comprising:

one or more processors; and

one or more computer-readable hardware storage devices having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, configure the computing system to perform at least:

generate an encryption/decryption key using a passphrase and an identifier of a personal storage that stores or is to store a data object, the personal storage being associated with a decentralized identifier (DID);

encrypt the data object stored or to be stored in the personal storage using the encryption/decryption key;

store the encrypted data object in the personal storage;

receive a request for accessing the encrypted data object from another entity that is not associated with the DID;

negotiate with the other entity a protection strategy for protecting the encryption/decryption key;

protect the encryption/decryption key based on the negotiation protection strategy; and

send the encrypted data object and the protected encryption/decryption key to the other entity.

2. The computing system of claim 1 , the computing system further configured to:

allow a DID management module that is configured to manage the DID to access the data object.

3. The computing system of claim 2 , the allowing the DID management module that is configured to manage the DID to access the data object comprising:

receiving a request for the encrypted data object from a DID management module that is configured to manage the DID;

sending the encrypted data object to the DID management module.

4. The computing system of claim 3 the allowing the DID management module that is configured to manage the DID to access the data object further comprising:

causing the DID management module to have access to the passphrase and the identifier of the personal storage;

causing the DID management module to regenerate the encryption/decryption key; and

causing the DID management module to decrypt the encrypted data object using the regenerated encryption/decryption key.

5. The computing system of claim 1 , wherein the passphrase is received from a user input.

6. The computing system of claim 1 , wherein the identifier of the personal storage is a constant that is associated with the first personal storage.

7. The computing system of claim 1 , wherein the generating an encryption/decryption key is further based on a key identifier, the key identifier corresponds to the data object, such that a different encryption/decryption key is generated for encrypting a different data object.

8. The computing system of claim 7 , wherein the key identifier is generated by the computing system or by a user input.

9. The computing system of claim 1 , wherein:

the negotiated protection strategy comprises protecting the encryption/decryption key using a second encryption/decryption key of the other entity;

the protecting the encryption/decryption key comprises encrypting the encryption/decryption key using the second encryption/decryption key of the other entity;

the sending the encrypted data object and the protected encryption/decryption key comprises sending the encrypted data object and the encrypted encryption/decryption key to the other entity.

10. The computing system of claim 9 , further comprising

causing the other entity to decrypt the encrypted encryption/decryption key; and

causing the other entity to decrypt the encrypted data object using the decrypted encryption/decryption key.

11. The computing system of claim 9 , wherein the protecting the encryption/decryption key further comprising:

receiving a public key from the other entity, wherein the encrypting the encryption/decryption key includes encrypting the encryption/decryption key using the received public key from the other entity; and

storing the encrypted encryption/decryption key with the encrypted data object.

12. The computing system of claim 11 , the computing system further configured to

cause the other entity to decrypt the encrypted encryption/decryption key using a private key that corresponds to the public key that was used to encrypt the encryption/decryption key.

13. The computing system of claim 1 , wherein the other entity is associated with a second DID that is different from the DID.

14. A method for encrypting and sharing one or more data objects stored in a personal storage that is associated with a decentralized identifier (DID), the one or more encrypted objects being stored in a personal storage associated with a first DID, the method comprising:

generating an encryption/decryption key using a passphrase and an identifier of the personal storage that stores or is to store a data object;

encrypting the data object stored or to be stored in the personal storage using the encryption/decryption key;

storing the encrypted data object in the personal storage;

receiving a request for accessing the encrypted data object from another entity that is not associated with the DID;

negotiating with the other entity a protection strategy for protecting the encryption/decryption key;

protecting the encryption/decryption key based on the negotiated protection strategy; and

sending the encrypted data object and the protected encryption/decryption key to the other entity.

15. The method of claim 14 , the method further comprising:

receiving a request for the encrypted data object from a DID management module that is configured to manage the DID; and

sending the encrypted data object to the DID management module.

16. The method of claim 15 , the method further comprising:

causing the DID management module to have access to the passphrase and the identifier of the personal storage;

causing the DID management module to regenerate the encryption/decryption key; and

causing the DID management module to decrypt the encrypted data object using the regenerated encryption/decryption key.

17. The method of claim 14 , the method further comprising: wherein the passphrase is received from a user input.

18. The method of claim 14 , wherein the identifier of the personal storage is a constant that associated with the first personal storage.

19. A computer program product comprising one or more hardware storage devices having stored thereon computer-executable instructions that are structured such that, when the computer-executable instructions are executed by one or more processors of a computer system, the computer-executable instructions configure the computer system to perform at least:

generate an encryption/decryption key using a passphrase and an identifier of a personal storage that stores or is to store a data object, the personal storage being associated with a decentralized identifier (DID);

encrypt the data object stored or to be stored in the personal storage using the encryption/decryption key;

store the encrypted data object in the personal storage;

receive a request for accessing the encrypted data object from another entity that is not associated with the DID;

negotiate with the other entity a protection strategy for protecting the encryption/decryption key;

protect the encryption/decryption key based on the negotiated protection strategy; and

send the encrypted data object and the protected encryption/decryption key to the other entity.

20. The computer program product of claim 19 , the computer system further configured to:

receive a request for the encrypted data object from a DID management module that is configured to manage the DID; and

send the encrypted data object to the DID management module;

cause the DID management module to have access to the passphrase and the identifier of the personal storage;

cause the DID management module to regenerate the encryption/decryption key; and

cause the DID management module to decrypt the encrypted data object using the regenerated encryption/decryption key.